Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service (the “Agreement”) between [LEGAL ENTITY NAME] (“Master Patrol”) and the patrol company that uses the Service (“Customer”). It applies whenever Master Patrol processes Personal Data contained in Customer Data. Terms defined in the Agreement have the same meaning here.

1. Definitions

• Data Protection Law: the privacy and data protection laws of the United States and its states that apply to the processing, including, where applicable, the Oregon Consumer Privacy Act (ORS 646A.570 to 646A.589) and the California Consumer Privacy Act as amended (“CCPA”) and its regulations.
• Personal Data: information in Customer Data that identifies, relates to, or could reasonably be linked to an individual, including pseudonymized information.
• Controller and Processor have the meanings given in Data Protection Law, and include “business” and “service provider” under the CCPA.
• Subprocessor: a third party that Master Patrol engages to process Personal Data.
• Security Incident: a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Personal Data.
• Pseudonymize: replace a person's identity on a record with a random pseudonym (for example “Former employee #K7Q2MX”) that is unique within Customer's account and is not derived from any detail of the person. Pseudonymized records remain Personal Data.

2. Roles and instructions

• Customer is the Controller of Personal Data in Customer Data, and Master Patrol is its Processor. Customer decides the purposes of the processing; Master Patrol processes Personal Data only on Customer's documented instructions.
• Customer's instructions are: the Agreement and this DPA; Customer's configuration and use of the Service, including its retention settings and its Administrators' decisions on privacy requests and deletions; and any other written instructions Customer gives that are consistent with the Agreement.
• Master Patrol will tell Customer if it believes an instruction breaks Data Protection Law, and need not follow that instruction.
• Customer is responsible for having a lawful basis for the processing, for the accuracy of Personal Data, and for giving Employees, Clients and others any notices and obtaining any consents that Data Protection Law requires, including for the collection of precise location and photographs.
• The details of the processing are in Schedule 1.

3. Restrictions on Master Patrol

Master Patrol will not:

• sell or share Personal Data, as those terms are defined in the CCPA, or process it for targeted or cross-context behavioral advertising;
• retain, use or disclose Personal Data for any purpose other than providing the Service under the Agreement, or outside its direct business relationship with Customer, except as Data Protection Law permits a Processor to do; or
• combine Personal Data with personal information it receives from any other source, except as Data Protection Law permits.

Master Patrol will comply with the obligations that Data Protection Law places on Processors and give Personal Data the same level of protection the law requires of Customer. It will tell Customer if it can no longer meet those obligations, and Customer may then take reasonable and appropriate steps to stop and remedy unauthorized processing. Master Patrol certifies that it understands and will comply with these restrictions.

4. Personnel

Master Patrol limits access to Personal Data to personnel who need it to provide, support or secure the Service, and ensures each of them is bound by a duty of confidentiality.

5. Security

Master Patrol maintains the technical and organizational measures described in Schedule 2, taking into account the nature of the Personal Data and the risks of the processing. Master Patrol may update these measures, but not in a way that lowers the overall protection of Personal Data. Customer is responsible for the measures within its control, including managing its Users and their roles and keeping credentials secure.

6. Subprocessors

• Customer authorizes Master Patrol to engage the Subprocessors listed in Schedule 3.
• Master Patrol will have a written contract with each Subprocessor that requires it to protect Personal Data at least as well as this DPA does, and remains responsible to Customer for its Subprocessors' performance.
• Master Patrol will tell Customer's Administrators by email, and update Schedule 3, at least [30] days before a new Subprocessor begins processing Personal Data. Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, Customer may terminate the Agreement and receive a refund of any prepaid fees for the period after termination.

7. Data subject requests

• The Service lets Customer respond to requests from individuals: clients can make export and deletion requests under My Data, which Customer's Administrators review; Administrators can correct records; and deletions are carried out as described in section 9.2.
• If Master Patrol receives a request directly from an individual about Customer Data, it will forward it to Customer promptly, and in any event within [5] business days, and will not respond to it itself except to say that it has been forwarded. Master Patrol does not decide such requests.
• Master Patrol will give Customer reasonable help, taking into account the nature of the processing, with responding to requests, with data protection assessments Customer must carry out, and with consultations with authorities.

8. Security incidents

• Master Patrol will notify Customer without undue delay, and no later than [72] hours, after confirming a Security Incident affecting Customer's Personal Data.
• The notice will describe, as far as then known, the nature of the incident, the categories and approximate number of individuals and records affected, the likely consequences, and the steps taken or proposed. Master Patrol will add information as it becomes available, take reasonable steps to contain and remedy the incident, and cooperate with Customer so it can meet any duty to notify individuals or authorities.
• Notice of a Security Incident is not an admission of fault or liability.

9. Retention, deletion and return

9.1 Retention while the Agreement is in force

Customer sets the retention periods for its Customer Data in the Service. Until Customer changes them, these defaults apply:

Master Patrol deletes or pseudonymizes records automatically when their retention period ends, except while Customer has paused automatic deletion (for example, for a legal hold). Choosing retention periods is Customer's decision; Customer is responsible for checking the laws that apply to it before changing a default.

9.2 Deleting an individual

When Customer approves the deletion of an individual, Master Patrol:

• deletes the individual's login and removes their name, email address and phone numbers;
• keeps records that are evidence of who did what at a client's property or with a client's codes (activity and incident reports, photos and files the individual uploaded, approvals, the code-access log, and the privacy-request record), with the individual Pseudonymized, until the retention period for those records ends;
• deletes records that have no value as evidence, such as read receipts, device records and copies of records kept to resolve editing conflicts; and
• Pseudonymizes the individual's billing usage record once the invoice for that period is final.

Master Patrol does not alter free text that Users typed into records, because altering it would damage the records as evidence. Customer acknowledges that Pseudonymized records remain Personal Data. Master Patrol will process them only for the purposes for which they are kept (security, establishing or defending legal claims, legal obligations, and Customer's service records), and Customer is responsible for confirming that an exception under Data Protection Law permits keeping them and for documenting its reasons.

9.3 Return and deletion at the end of the Agreement

• Return. Before Customer closes its account, the Service offers Customer an export of its Customer Data. If the account is locked for non-payment, export is available once the overdue amount is paid.
• On closure, Master Patrol destroys alarm codes, gate codes and site notes, and removes the names, email addresses and phone numbers of Customer's Employees and Clients, Pseudonymizing them on retained records.
• Hold. Master Patrol holds the remaining Customer Data, Pseudonymized, for 90 days after closure, so that a mistaken closure or a dispute can be resolved. During that time Customer may ask Master Patrol to reopen the account; removed personal details are not restored.
• Deletion. After the 90 days, Master Patrol permanently deletes all Customer Data, unless a law requires Master Patrol to keep it. Copies in backups are deleted when the backups expire, within [BACKUP RETENTION PERIOD]. Master Patrol keeps only its own records: Customer's Stripe customer record and invoices, and a minimal record that the account existed and was closed.
• On request, Master Patrol will confirm the deletion in writing.

10. Information and audits

• Master Patrol will make available to Customer the information reasonably necessary to demonstrate its compliance with this DPA, including answering reasonable security questionnaires.
• Customer, or an independent assessor it appoints that is bound by confidentiality, may assess Master Patrol's compliance no more than once in any 12 months, on at least [30] days' written notice, during business hours, without unreasonably disrupting the Service, and at Customer's cost. Alternatively, Master Patrol may arrange for a qualified and independent assessor to assess its policies and measures, using an appropriate and accepted framework, and give Customer the report.
• Additional assessments are allowed after a Security Incident affecting Customer, or where an authority requires one.

11. Requests from authorities

If a court, law enforcement agency or other authority asks Master Patrol for Customer's Personal Data, Master Patrol will refer the request to Customer where possible, notify Customer before disclosing unless the law forbids it, and disclose only what is legally required.

12. Data location

Master Patrol stores and processes Customer Data in the United States [HOSTING REGION]. Schedule 3 lists the location of each Subprocessor.

13. Term, liability and law

• This DPA lasts for as long as Master Patrol processes Customer's Personal Data.
• Each party's liability under this DPA is subject to the limitations in the Agreement. [LEGAL REVIEW: confirm.]
• If this DPA and the Agreement conflict on the processing of Personal Data, this DPA controls.
• This DPA is governed by the laws of the State of Oregon, and the forum provisions of the Agreement apply.

Schedule 1: Details of processing

Schedule 2: Security measures

• Encryption in transit. All connections to the Service use HTTPS; plain HTTP is redirected to HTTPS, and browsers are told to use HTTPS only.
• Encryption of codes. Alarm codes, gate codes and site notes are encrypted with AES-256-GCM using envelope encryption: each customer has its own data key, which is itself encrypted with a master key. Each encrypted value is bound to its customer, site and field, so it cannot be decrypted if moved elsewhere. Keys can be rotated.
• Re-authentication. Showing or changing a code requires the User to have entered their password within the previous two minutes. Custom site fields marked as sensitive have the same requirement.
• Code changes. Officers propose code changes for a supervisor or administrator to approve; a proposed code is stored encrypted, never in the approval record, and is deleted once the proposal is decided. Every change to a code is logged with who made it, when, and how. Code values are never written to logs.
• Separation between customers. Every request is tied to the customer named in the User's signed sign-in token, and every database query is limited to that customer. Automated tests attempt to cross customer boundaries and must fail.
• Role-based access. Each User's role decides what they can see and change, and the Service checks the role on every request. Officers cannot change site records directly; changes go through approval.
• Client portal. Clients see only the sites they are linked to with portal access, and internal site details are withheld from them.
• Files. Uploads are restricted to permitted file types, checked against their actual content, and size-limited. Location data embedded in photos is removed. Files are served only through the Service's own permission checks.
• Account status. The Service enforces locked, suspended and closed status on every request, so a valid sign-in alone does not grant access.
• Sessions. Customer sets an idle time after which signed-in screens are signed out.
• Network. The Service accepts connections only from the United States.
• Payments. Card and bank details are collected and held by Stripe; Master Patrol never receives full card or account numbers.
• Personnel. Access to production systems and Customer Data is limited to personnel who need it.
• Hosting. [HOSTING PROVIDER: physical security, encryption of stored data and backups, to be confirmed once the provider is chosen.]
• Backups. [BACKUP FREQUENCY, ENCRYPTION AND RETENTION PERIOD]

Schedule 3: Subprocessors