Data Processing Agreement

1. Background and Purpose

Home Watch IT, LLC ("Processor") provides home watch management software (the "Services") to home watch professionals under the HWIT Master Services Agreement ("Service Agreement"). This Data Processing Agreement ("DPA") sets out the terms under which such processing takes place and satisfies the requirements of Article 28 of EU Regulation 2016/679 ("EU GDPR") and the equivalent United Kingdom legislation ("UK GDPR"). This DPA forms part of and supplements the Service Agreement. In the event of conflict, this DPA shall prevail in relation to all matters concerning personal data processing.

2. Definitions

3. Roles of the Parties

The Controller is the data controller for all End-User Personal Data processed through the Services. The Processor is the data processor, acting solely on the Controller's documented instructions. The Processor shall not process Customer Data for any purpose other than providing the Services, except where required to do so by applicable law. Each Party shall comply with its respective obligations under Applicable Law.

4. Details of Processing

5. Processor Obligations

5.1 Instructions

The Processor shall process Customer Data only on the documented instructions of the Controller. If required by applicable law to process beyond those instructions, the Processor shall inform the Controller before such processing, unless legally prohibited from doing so.

5.2 Confidentiality

The Processor shall ensure that all personnel authorised to process Customer Data are subject to binding confidentiality obligations and are made aware of the requirements of this DPA.

5.3 Security

The Processor shall implement and maintain appropriate technical and organisational measures including: encryption of personal data in transit and at rest; measures to ensure ongoing confidentiality, integrity, and availability; role-based access controls; and secure deletion procedures upon account termination.

5.4 Sub-Processors

The Controller provides general written authorisation for the Processor to engage the Sub-Processors listed in Schedule B. The Processor shall impose equivalent data protection obligations on each Sub-Processor, provide at least 30 days' notice of any Sub-Processor change, and remain fully liable for their acts and omissions.

5.5 Data Subject Rights

The Processor shall, insofar as technically possible, assist the Controller in fulfilling obligations to respond to Data Subject requests. The Processor shall notify the Controller without undue delay if it receives a Data Subject request directly.

5.6 Audit Rights

The Processor shall, upon reasonable written request (no more than once per 12-month period), provide the Controller with information sufficient to demonstrate compliance with this DPA.

6. Personal Data Breach Notification

The Processor shall notify the Controller without undue delay, and in any event within 48 hours of becoming aware of a Personal Data Breach, including a description of the nature of the breach, categories and approximate number of Data Subjects and records affected, likely consequences, and measures taken to address it.

7. International Data Transfers

Customer Data is stored and processed in the United States of America. The Controller hereby authorises such transfer on the basis of the following safeguards:

The Standard Contractual Clauses (Controller to Processor, Module 2) under Commission Decision (EU) 2021/914 are hereby incorporated into this DPA by reference. Governing law: Ireland. Competent supervisory authority: the Irish Data Protection Commission. For UK data, the UK Addendum (ICO Version B1.0) is incorporated alongside the SCCs.

8. Controller Obligations

The Controller warrants that it has a lawful basis for all processing; has provided Data Subjects with all required privacy notices; shall not instruct the Processor to process data in a manner that would violate Applicable Law; and shall not submit special category personal data without prior written agreement.

9. Data Retention and Deletion

Upon termination, the Processor shall immediately delete all live Customer Data; purge residual copies in encrypted backups within 15 days; and confirm deletion in writing upon request.

10. Liability

Each Party shall be liable to the other for damages caused by its breach of this DPA or Applicable Law. The Processor's total aggregate liability shall be subject to the limitations set out in the Service Agreement.

11. Term and Termination

This DPA shall remain in force for the duration of the Service Agreement and shall automatically terminate upon its termination. Obligations relating to deletion of Customer Data survive termination.

12. General Provisions

This DPA is governed by the laws of Ireland (other than SCCs/UK Addendum). It constitutes the entire agreement between the Parties regarding personal data processing and supersedes all prior agreements on such subject matter.

Schedule A — Annex I: Description of Processing

Schedule B — Approved Sub-Processors