Data Processing Agreement

This Data Processing Addendum (\"DPA\") forms part of, and is incorporated into, the Terms of Service or other written or electronic agreement (\"Agreement\") between Deliberate Livin LLC (\"KlientHQ,\" \"Processor,\" \"we,\" \"us,\" or \"our\"), a Texas limited liability company, and the customer entity that is a party to the Agreement (\"Customer\" or \"Controller\"). Capitalized terms not defined herein have the meanings set forth in the Agreement.

This DPA applies when Processor Processes Personal Data on behalf of Customer in providing the Services.

1. Definitions

• \"CCPA/CPRA\" means the California Consumer Privacy Act of 2018 (Cal. Civ. Code § 1798.100 et seq.), as amended by the California Privacy Rights Act, and its regulations.
• \"Data Protection Laws\" means all applicable laws relating to privacy, data protection, and security, including CCPA/CPRA, Virginia Consumer Data Protection Act, Colorado Privacy Act, and other similar U.S. state laws (collectively \"U.S. Privacy Laws\").
• \"Personal Data\" means any information relating to an identified or identifiable natural person that Customer provides to Processor or that Processor Processes on Customer's behalf in connection with the Services, including names, email addresses, phone numbers, addresses, job locations, signatures, and other data described in Schedule 1.
• \"Process\" or \"Processing\" means any operation or set of operations performed on Personal Data.
• \"Services\" means the field service management platform provided by Processor under the Agreement.
• \"Sub-processor\" means any third party engaged by Processor to Process Personal Data.

2. Roles of the Parties

Customer is the Controller (or \"Business\" under CCPA/CPRA) and Processor is the Processor (or \"Service Provider\" under CCPA/CPRA). Processor will Process Personal Data solely as a service provider on Customer's documented instructions, for the purpose of providing the Services, and in accordance with this DPA.

3. Processing Instructions

Processor will Process Personal Data only:

• To provide the Services;
• As necessary to comply with applicable law;
• As documented in this DPA or the Agreement;
• Upon Customer's additional written instructions.

If Processor believes an instruction infringes Data Protection Laws, Processor will inform Customer promptly.

4. Details of Processing

The subject matter, duration, nature, purpose, types of Personal Data, and categories of Data Subjects are described in Schedule 1 (Details of Processing).

5. Confidentiality

Processor will ensure that persons authorized to Process Personal Data are subject to confidentiality obligations.

6. Security

Processor will implement and maintain technical and organizational measures appropriate to the risk, including those described in Schedule 2 (Security Measures). Processor uses TLS encryption in transit and AES-256 at rest, and does not store full payment card numbers (processed via Stripe).

7. Sub-processors

Customer provides general authorization for Processor to engage the Sub-processors listed in Schedule 3 (Current Sub-processors).

Processor will notify Customer of new or replacement Sub-processors at least 30 days in advance (via email or account notification). Customer may object within 15 days; parties will negotiate in good faith.

Processor will bind Sub-processors to obligations substantially similar to this DPA.

8. Data Subject Rights & Assistance

Processor will assist Customer (at Customer's cost) in responding to Data Subject requests (access, deletion, correction, opt-out) and with compliance obligations (e.g., assessments), to the extent legally required and technically feasible.

9. Data Breach Notification

Processor will notify Customer without undue delay (and in any event within 72 hours) after becoming aware of a Personal Data Breach. Notification will include nature, affected data, remedial actions, and mitigation steps.

10. CCPA/CPRA Specific Provisions

Processor:

• Receives Personal Data only for the business purpose of providing the Services;
• Will not retain, use, disclose, or sell Personal Data except as necessary for the Services or as permitted by CCPA/CPRA;
• Will not combine Personal Data with data from other sources except as permitted;
• Certifies compliance with CCPA/CPRA obligations.

11. Deletion or Return of Personal Data

Upon termination/expiration of the Agreement, Processor will (at Customer's election) delete or return all Personal Data and certify deletion within 30 days, except as required by law.

12. Audits

Customer may request an audit once per 12 months (at Customer's expense) upon 30 days' notice. Processor may satisfy audit via third-party reports (e.g., SOC 2) or onsite inspection (limited scope).

13. International Transfers

All Processing occurs in the United States. If any transfer occurs outside the U.S., Processor will ensure adequate safeguards.

14. Term & Termination

This DPA survives termination of the Agreement for as long as Processor Processes Personal Data. It terminates when all Personal Data is deleted/returned.

15. Governing Law

Governed by Texas law, without regard to conflict of laws.

Schedule 1 – Details of Processing

• Subject Matter: Provision of field service management SaaS (scheduling, customer management, SMS/email outreach, invoicing, payments, and optional voice/AI call handling).
• Duration: Term of the Agreement + post-termination wind-down.
• Nature/Purpose: Collection, storage, analysis, transmission for job scheduling, reminders, communications, invoicing.
• Categories of Data Subjects: Customer's end-customers (homeowners/business clients), team members.
• Types of Personal Data: Names, emails, phone numbers, addresses, job locations/geolocation, signatures, payment methods (via Stripe or Square), communication history, and — when Sales Agent or voice features are enabled — call recordings, call transcripts, voicemail audio, and AI-generated call summaries.

Schedule 2 – Security Measures

• Encryption: TLS 1.2+ in transit; AES-256 at rest.
• Access Controls: RBAC, least privilege, MFA.
• Monitoring: Logs, anomaly detection.
• Breach Response: Incident plan, notification procedures.
• Physical: Secure data centers (Google Cloud).

Schedule 3 – Current Sub-processors