Data Processing Addendum

This Addendum forms part of the Terms of Service between you (the "Controller") and Sebastien Vautier, sole proprietor trading as Beyond the Edge Studio ("Processor," "we," "us"). It applies wherever we process personal data on your behalf and the EU GDPR, the UK GDPR, the Swiss FADP, or a US state privacy law applies. Where it conflicts with the Terms on a processing matter, this Addendum prevails.

1. Roles

You are the controller of the personal data of homeowners who use your estimator. We are your processor, and we process that data only on your documented instructions. Under US state privacy laws we are a service provider or processor as those laws define the term, and we do not "sell" or "share" personal information as those laws define those terms.

For your own account data (your email address, your business details, your sign-in and session records) we are the controller, and the Privacy Policy governs that, not this Addendum.

2. Your instructions

Your instructions are: these Terms, this Addendum, the configuration you set in the dashboard (your questions, your price sheet, your notification addresses, your webhook destination, your retention period), and any further written instruction we accept.

We will tell you if, in our opinion, an instruction infringes the GDPR or other data-protection law. We may refuse an instruction that would require us to break the law, to disable retention, or to process data outside the Service's design.

You warrant that you have a lawful basis for the personal data you collect through the Service, that you have given the homeowner the information the law requires, and that your instructions do not put us in breach.

3. Subject matter, duration, nature, purpose (Art. 28(3))

4. Confidentiality

Everyone we authorise to process personal data is bound by a duty of confidence, contractual or statutory, that survives the end of their engagement. Access is limited to those who need it to run the Service.

5. Security (Art. 32)

We maintain the technical and organisational measures listed in Annex A. We may change a measure so long as the level of protection is not reduced.

6. Sub-processors (Art. 28(2) and (4))

You give general written authorisation for us to engage sub-processors. The current list, with role and location, is at subprocessors.md and is published at edgequote.beyondtheedgestudio.com/legal/subprocessors.

We will give you at least 30 days' notice before adding or replacing a sub-processor that handles personal data, by email to your account address and by updating that page. If you reasonably object on data-protection grounds within that period, we will work with you in good faith to find an alternative; if we cannot, you may terminate the affected Service without penalty and receive a pro-rata refund of prepaid fees.

Each sub-processor is engaged under a written contract imposing obligations no less protective than this Addendum, and we remain fully liable to you for its performance.

A webhook destination you configure is not a sub-processor. Data flows there on your instruction and your agreement with that provider governs it.

7. Assistance (Art. 28(3)(e) and (f))

Data subject requests. The dashboard lets you find, correct, export and delete a lead yourself, which will usually be the fastest route. If a homeowner contacts us directly, we will not respond substantively on your behalf; we will pass the request to you promptly, and tell the homeowner we have. Where we are ourselves obliged to act, we may do so and will tell you. We can locate a record by email address or by telephone number across all clients, which matters because a homeowner may give only one of the two.

Impact assessments and prior consultation. We will provide the information reasonably available to us to help you carry out a data protection impact assessment or a prior consultation, taking account of the nature of processing and the information we hold.

Breach notification. We will notify you without undue delay and in any event within 48 hours of becoming aware of a personal data breach affecting personal data we process for you, with the information we have at the time and updates as we learn more. You remain responsible for notifying your supervisory authority and affected data subjects; we will not do so on your behalf unless you ask and we agree in writing.

8. Retention, return and deletion (Art. 28(3)(g))

Leads are deleted automatically 24 months after they are created. You may set any period from 1 to 84 months on your account. Retention cannot be switched off, and we will not disable it on request; storage limitation under Art. 5(1)(e) is not a setting we are willing to make optional. Deletion is carried out by a scheduled job whose runs are recorded so that a job which silently stops can be detected from outside the application.

Job photographs uploaded but never attached to a lead are purged within hours. Photographs attached to a lead are deleted with it.

On termination, and at your choice, we will return your data (CSV export is available in the dashboard, and we will provide a copy on request) and then delete it. Data is available for 30 days after termination and is then deleted, except where we are required by law to keep it, in which case this Addendum continues to apply to it for as long as we hold it.

9. Audit (Art. 28(3)(h))

We will make available the information necessary to demonstrate compliance with this Addendum, including Annex A and the sub-processor list, and will contribute to audits and inspections conducted by you or an auditor you mandate. We may satisfy an audit request by providing a current report or questionnaire response where one exists. On-site audits require 30 days' notice, are limited to once in any 12-month period unless a breach or a regulator requires otherwise, must not disrupt the Service or compromise another customer's data, and are at your cost.

10. International transfers (Chapter V)

We process in the United States; the production database is provisioned in AWS us-east-1 (confirmed 2026-09-03). Where personal data of people in the EEA, the UK or Switzerland is transferred to us or to a sub-processor outside those areas, the transfer is made under the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), incorporated into this Addendum by reference, with:

• Clause 7 (docking) applying
• Clause 9 option 2, general written authorisation, with the 30-day notice period in Section 6
• Clause 11 optional redress body: not selected
• Clause 17 governed by the law of Ireland
• Clause 18(b) forum: the courts of Ireland
• Annex I populated by Sections 1 and 3 of this Addendum and by the sub-processor list; Annex II populated by Annex A below

For UK transfers, the International Data Transfer Addendum (version B1.0) to the SCCs applies, with Tables 1 to 4 populated from the same sources and the "Importer" permitted to end the Addendum under Section 19. For Switzerland, references to the GDPR are read as references to the FADP and the Swiss FDPIC is a competent authority.

Why Ireland, when the Terms choose Nevada. SCC Clause 17 requires the Clauses to be governed by the law of an EU member state that allows third-party beneficiary rights, and Clause 18 requires an EU member-state forum; a US law cannot be chosen for the Clauses at all. The Terms govern the commercial relationship and may choose Nevada; the Clauses govern the transfer and must choose an EU law. Both are therefore correct at once, and Section 15 of the Terms carves the Clauses out of its own choice of law. Ireland is the customary choice for a US exporter because Irish contract law is close to the common-law drafting of the Terms; France would be equally valid and closer to the customer base. [DECISION — proposed default: keep Ireland. Switch to France only if the lawyer prefers a civil-law forum for the Clauses.]

11. US state privacy terms

For personal information subject to the CCPA/CPRA or an equivalent state law, we are a service provider or processor. We will not: sell or share it; retain, use or disclose it for any purpose other than performing the Service or as otherwise permitted by that law; retain, use or disclose it outside our direct business relationship with you; or combine it with personal information from another source, except as that law permits. We certify that we understand and will comply with these restrictions. You may take reasonable and appropriate steps to stop and remediate unauthorised use.

12. Liability

Liability under this Addendum is subject to the limitations in the Terms, except to the extent applicable data-protection law does not permit that limitation. [PLACEHOLDER — see Terms note 5: confirm whether DPA liability should sit inside or outside the general cap.]

13. Term

This Addendum takes effect when you accept the Terms and continues for as long as we process personal data on your behalf.

---

Annex A — Technical and organisational measures (Art. 32)

Transport and storage. All connections over TLS; outbound email over opportunistic TLS (encrypted wherever the receiving server supports it). Database and backups managed by the sub-processors named in the sub-processor list, encrypted at rest by those providers.

Pseudonymisation. IP addresses are hashed before storage and no raw IP address is written anywhere in the application. Sign-in tokens are stored as hashes, never in plaintext.

Authentication and access. Sign-in is by single-use magic link with a 15-minute expiry and a limit of three outstanding links; a link is rotated on redemption, not on request, so a link a stranger triggers into your inbox cannot lock you out and an intercepted link cannot be replayed after use. A bare GET does not consume a link, so a mail scanner or link previewer cannot burn it. Sessions are server-side records with expiry and last-seen tracking and can be revoked. Access is scoped to a single Contractor's data; agency-administrator access to a Contractor's account is recorded.

Input and abuse controls. Public write endpoints require a JSON content type, so they are not reachable as CORS simple requests. Bot verification (Cloudflare Turnstile) on public forms. Per-address and per-network rate limiting with recorded abuse events and IP blocking. Form tokens with a bounded lifetime and a recoverable stale path. Uploaded images are validated against their actual file signature, size-capped, count-capped per lead, re-encoded before storage, and purged if never attached.

Outbound controls. Webhook destinations are DNS-resolved and checked against the full reserved-address ranges before delivery, are restricted to HTTPS on port 443, and are signed. The test facility is throttled. Homeowner recap email is capped per recipient per 24 hours across all Contractors, so the Service cannot be used as a mail relay. Bounces and spam complaints from the email provider arrive over a signature-verified webhook and add the address to a suppression list.

Deletion. Automated retention deletion as described in Section 8, with recorded job runs and a heartbeat that makes a stalled job observable.

Change control. Every change to the codebase passes an automated security gate: dependency audit, static analysis, secret scanning, type checking, and a unit and integration test suite.

Logging. Security-relevant events, including changes to notification recipients and webhook destinations, are logged and notified.

Personnel. The Service is operated by a sole proprietor. There is currently no separate staff, and consequently no separate onboarding, background-check or leaver process. [PLACEHOLDER — this must be updated the moment anyone else is given access.]

[PLACEHOLDER — Annex A states no formal disaster-recovery objectives (RPO/RTO), no penetration test, no ISO 27001 or SOC 2 certification, and no documented backup-restore test schedule, because none exists. Do not add any of these to Annex A until they do. A measure listed here that is not actually in place is worse than one that is absent.]

---

NOTES FOR YOUR LAWYER

1. The SCC governing law in Section 10 is Ireland; the Terms select Nevada. That is not a conflict. Clause 17 requires an EU member-state law and Clause 18 an EU forum, so the Clauses cannot follow the Terms' choice and the Terms carve the Clauses out. The only decision is Ireland versus France; Section 10 explains the reasoning and proposes Ireland. Confirm.
2. The 48-hour breach notification window in Section 7 is a commitment we have to be able to meet. It is tighter than the GDPR's own "without undue delay" and tighter than many processor DPAs. It is achievable here because the operator is one person with alerting in place, but it becomes a real exposure if the business grows without a rota. Confirm, or widen to 72 hours.
3. Annex A is unusually specific and every line of it is presently true. That is the point: an accurate Annex is a defence and an aspirational one is a misrepresentation. It must be re-checked against the code whenever a control changes, and the placeholder about DR, penetration testing and certification must not be quietly deleted.
4. Sole proprietor with no staff. Several Art. 32 expectations (segregation of duties, leaver process, staff training records) are structurally unavailable. Annex A says so rather than papering over it. Confirm this is the right disclosure posture for a customer questionnaire.
5. Retention cannot be switched off. This is a deliberate refusal to follow a controller instruction. It is defensible under Art. 28(3) second paragraph, but a large customer may push back. Confirm the position.
6. US service-provider certification (Section 11). The certification language is required by the CCPA regulations. Confirm the exact wording matches the current regulation text, which has been amended since first adoption.
7. Audit rights (Section 9) are drafted narrowly, with cost on the customer and a once-a-year cap. That is normal for a business of this size but is often negotiated. Know where the floor is before a negotiation starts.
8. No cyber-liability insurance is referenced anywhere in this pack. Consider whether to obtain it before signing a DPA with any customer of size, and whether to reference it here.

WHAT THIS DOES NOT COVER

• Processing where you are not the controller, for example data a homeowner sends you outside the Service.
• Your own Art. 30 record of processing activities, your own DPIA, and your own controller-side notices. This Addendum helps you build them; it does not replace them.
• Any transfer you initiate yourself to a webhook destination. That is your transfer, under your own Chapter V analysis.
• Certification or attestation of any kind. There is none.