Draft — not yet in effect. This document is under legal review. Bracketed items will be completed before it takes effect.

RadarClean Data Processing Addendum

This Data Processing Addendum ("DPA") is part of the RadarClean Terms of Service (the "Terms") between [RadarClean LLC] ("RadarClean") and the Customer that accepted the Terms ("Customer"). Capitalized terms not defined here have the meanings in the Terms. If this DPA conflicts with the Terms on a data protection matter, this DPA controls.

1. Definitions

• "Personal Data" means any information relating to an identified or identifiable individual that RadarClean processes on behalf of Customer through the Service, as part of Customer Data.
• "Data Protection Laws" means all laws that apply to the processing of Personal Data under the Terms, which may include New York General Business Law §§899-aa and 899-bb, U.S. state consumer privacy laws (such as the California Consumer Privacy Act as amended, where applicable), and Brazil's Lei Geral de Proteção de Dados (Law No. 13,709/2018, "LGPD"), where applicable.
• "Process" means any operation performed on Personal Data, such as collecting, storing, using, transmitting, disclosing or deleting it.
• "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data.
• "Subprocessor" means a third party engaged by RadarClean that Processes Personal Data on Customer's behalf.
• "Data Subjects" means the individuals to whom Personal Data relates, such as Customer's clients, prospective clients, workers and Users.

2. Roles of the Parties

2.1 Customer is the controller (and the "business," where that term applies) of Personal Data. RadarClean is the processor (and the "service provider" or "processor," where those terms apply), Processing Personal Data on Customer's behalf.

2.2 Customer is responsible for:

• the lawfulness of the Personal Data it provides and of its instructions;
• giving any notices to, and obtaining any consents from, Data Subjects required by Data Protection Laws (including notices to workers about location tracking and consent from clients to receive texts).

3. Processing Only on Instructions

3.1 RadarClean will Process Personal Data only:

• (a) to provide, maintain, secure and support the Service under the Terms;
• (b) in accordance with Customer's documented instructions, which consist of the Terms, this DPA, and Customer's configuration and use of the Service (including support access granted by Customer);
• (c) as required by applicable law, in which case RadarClean will inform Customer before Processing unless the law prohibits it.

3.2 RadarClean will inform Customer if, in its opinion, an instruction violates Data Protection Laws.

3.3 Details of the Processing are set out in Annex 1.

4. Restrictions

RadarClean will not:

• (a) sell or share Personal Data (as those terms are defined in applicable state laws), or use it for targeted or cross-context behavioral advertising;
• (b) retain, use or disclose Personal Data for any purpose other than the business purposes specified in the Terms and this DPA, or outside the direct business relationship with Customer;
• (c) combine Personal Data with personal information it receives from or on behalf of any other customer, or that it collects from its own interactions with individuals, except as expressly permitted by Data Protection Laws for service providers;
• (d) use or disclose Personal Data for the benefit of any other customer or of any business owned by RadarClean's founder, consistent with Section 9 of the Terms.

RadarClean certifies that it understands and will comply with these restrictions.

5. Personnel

5.1 RadarClean will limit access to Personal Data to personnel who need access to perform the Service, and will ensure that they are bound by written confidentiality obligations.

5.2 Some RadarClean personnel and contractors work from Brazil. Their access is subject to the same controls described in Annex 2, including the support access rules in Section 10 of the Terms.

6. Security

6.1 RadarClean will implement and maintain appropriate administrative, technical and physical measures designed to protect Personal Data, taking into account the nature of the Processing and the risks involved, including the measures in Annex 2. These measures are intended to meet the reasonable safeguards requirement of New York General Business Law §899-bb.

6.2 RadarClean may update its security measures, provided the overall level of protection is not reduced.

7. Subprocessors

7.1 Customer authorizes RadarClean to engage the Subprocessors listed in Annex 3.

7.2 RadarClean will:

• bind each Subprocessor by written terms that protect Personal Data at least as much as this DPA;
• remain responsible for its Subprocessors' compliance.

7.3 Changes. RadarClean will notify Customer by email and in the app at least [30] days before adding or replacing a Subprocessor. If Customer reasonably objects on data protection grounds within that period, the parties will discuss in good faith. If they cannot resolve the objection, Customer may cancel the affected subscription without penalty and receive a pro-rata refund of prepaid fees for the unused period.

8. Security Incidents

8.1 RadarClean will notify Customer without undue delay and in any event within 72 hours after confirming a Security Incident.

8.2 The notice will include, to the extent known:

• the nature of the incident, the categories and approximate number of Data Subjects and records affected;
• the likely consequences;
• the measures taken or proposed to address it;
• a contact person.

RadarClean will update Customer as more information becomes available.

8.3 RadarClean will take reasonable steps to contain and remedy the incident and will reasonably assist Customer in meeting its obligations to notify Data Subjects and authorities (for example, the 30-day notification deadline under New York General Business Law §899-aa).

8.4 RadarClean's notice of a Security Incident is not an admission of fault.

9. Assistance

9.1 Data Subject requests. If RadarClean receives a request from a Data Subject relating to Customer Data (for example, to access or delete their information), RadarClean will refer the request to Customer and will not respond directly, except to confirm that the request was forwarded. RadarClean will provide reasonable assistance, including through the Service's export and deletion features, so Customer can respond.

9.2 Other assistance. RadarClean will provide reasonable information needed for Customer's risk assessments and to respond to regulators, taking into account the nature of the Processing.

10. Return and Deletion

10.1 During the subscription, Customer may export and delete Customer Data using the Service.

10.2 After the subscription ends, Customer may export Customer Data for [30] days (read-only mode). RadarClean will then delete Personal Data from the live Service, and from backups within [90] days, unless law requires retention. Personal Data that remains in backups until deletion stays protected by this DPA.

10.3 On request, RadarClean will confirm deletion in writing.

11. Demonstrating Compliance

11.1 Once every 12 months, on written request, RadarClean will respond to a reasonable written security and privacy questionnaire from Customer.

11.2 If a regulator requires an audit, or after a Security Incident, the parties will agree in good faith on a reasonable additional review, at Customer's cost, subject to confidentiality and without access to other customers' data.

12. Location of Processing

12.1 Customer Data is stored and processed on infrastructure provided by Cloudflare, Inc., which operates data centers in the United States and other countries.

12.2 Service addresses (without names) and coordinates are sent to the address and routing services listed in Annex 3, some of which operate in the European Union.

12.3 RadarClean personnel may access Personal Data from the United States and Brazil.

12.4 Where the LGPD applies to Processing carried out in Brazil, RadarClean will process Personal Data in accordance with the LGPD and will adopt any transfer mechanism required by it.

13. U.S. State Privacy Laws

Where a U.S. state privacy law applies to Customer and Customer Data, RadarClean will:

• comply with the obligations that law imposes on service providers or processors;
• provide the same level of privacy protection as that law requires;
• notify Customer if it determines that it can no longer meet its obligations;
• allow Customer to take reasonable and appropriate steps to stop and remediate unauthorized Processing.

14. De-identified Data

RadarClean may create De-identified Data as described in Section 11 of the Terms. When it does, RadarClean will:

• take reasonable measures to ensure the data cannot be associated with an individual or with Customer;
• publicly commit not to re-identify it;
• contractually require any recipient to comply with the same commitments.

15. Liability and Term

15.1 Each party's liability under this DPA is subject to the limitations in Section 18 of the Terms.

15.2 This DPA remains in effect as long as RadarClean Processes Personal Data on Customer's behalf.

---

Annex 1 — Details of the Processing

Annex 2 — Security Measures

1. Access control: individual accounts; two-step verification required for owners and managers; role-based permissions (owner, manager, office, helper); lockout after repeated failed attempts; single-use, short-lived session hand-off tokens; only hashes of tokens stored. 2. Customer separation: every database query is scoped to the Customer's account, enforced by code review and automated checks before each release; platform tools can reach only account-level tables. 3. Encryption: data encrypted in transit (HTTPS/TLS); sensitive fields (such as two-step secrets, recovery codes and GPS tokens) encrypted at the application level with a separate key; storage encryption provided by the infrastructure provider. 4. Support access: granted only by the Customer's owner, time-limited, limited to defined areas, every action logged and visible to the owner, revocable at any time. 5. Audit logs: logins, permission changes, platform views and support actions recorded in the Customer's audit log. 6. Backups: automated daily backups per Customer, retained for [90] days, stored with the same access controls. 7. Change management: automated tests on every change; staging environment separate from production; production changes require approval. 8. Personnel: access limited by need; written confidentiality agreements; access removed when no longer needed. 9. Incident response: documented procedure to investigate, contain, notify (Section 8) and review incidents. 10. Vendor management: Subprocessors bound by written data protection terms (Section 7).

Annex 3 — Authorized Subprocessors

Terms of Service · Data Processing Addendum · App Privacy Notice · Website Privacy Policy