Data Processing Addendum

§1Parties & scope

This Data Processing Addendum (“DPA”) forms part of the agreement between SenSec LLC, a Wyoming limited liability company (“SenSec” or “Processor”), and the Customer (“Customer” or “Controller”) for use of the SenSec FieldOps platform and related services (the “Service”).

This DPA applies whenever SenSec processes Personal Data on behalf of Customer in connection with the Service and is incorporated by reference into the Terms of Service or any executed Order. It reflects the parties’ respective obligations under applicable data protection law, including the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK Data Protection Act 2018 together with the retained UK GDPR (“UK GDPR”), the California Consumer Privacy Act as amended by the CPRA (“CCPA/CPRA”), and equivalent state and national privacy laws (collectively, “Data Protection Laws”).

§2Definitions

Capitalised terms used and not otherwise defined in this DPA have the meanings given in the Terms of Service or in Data Protection Laws.

• “Customer Data” means information, content, files, and other data that Customer or its end users submit to or generate within the Service, as defined in the Terms of Service.
• “Personal Data” means any Customer Data that relates to an identified or identifiable natural person processed by SenSec on behalf of Customer under the Service.
• “Data Subject” means the identified or identifiable natural person to whom Personal Data relates.
• “Sub-processor” means any third party engaged by SenSec to process Personal Data under this DPA.
• “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.
• “Standard Contractual Clauses” or “SCCs” means the standard contractual clauses adopted by the European Commission in Decision (EU) 2021/914 for the transfer of personal data to third countries.
• “UK Addendum” means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner.

§3Subject matter, duration & nature of processing

The subject matter, duration, nature and purpose of the processing, the types of Personal Data and the categories of Data Subjects are set out in Annex A (Processing description). In summary:

• Subject matter: provision of the SenSec FieldOps platform for security, facility and industrial operations.
• Duration: the term of the Customer’s subscription, plus any period during which SenSec is lawfully required or permitted to retain Customer Data under the Terms of Service, applicable law, or Customer’s instructions.
• Nature: hosting, storage, transmission, access control, processing, analysis, retrieval, return and deletion of Personal Data as necessary to operate the Service.
• Purpose: delivering the Service to Customer in accordance with the Terms of Service and any documented instructions.

§4Roles & instructions

4.1 Role allocation

For Personal Data processed under the Service, Customer is the Controller (GDPR / UK GDPR) or Business (CCPA/CPRA), and SenSec is the Processor (GDPR / UK GDPR) or Service Provider (CCPA/CPRA). Where SenSec processes data as Controller for its own purposes (e.g., billing, platform security, aggregated analytics), that processing is governed by our Privacy Policy, not this DPA.

4.2 Documented instructions

SenSec will process Personal Data only on documented instructions from Customer, including with regard to international transfers. The Terms of Service, this DPA, Customer’s configuration choices, and standard operational requests submitted through the Service constitute such instructions. Additional or conflicting instructions require the parties’ written agreement and may be subject to additional fees.

4.3 Legal compliance

If SenSec is required by law to process Personal Data in a way that conflicts with Customer’s instructions, SenSec will notify Customer of that requirement in advance, unless the law prohibits such notification on important grounds of public interest.

4.4 CCPA / CPRA service provider terms

SenSec will not (i) sell or share Personal Data as defined by the CCPA/CPRA; (ii) retain, use or disclose Personal Data for any purpose other than the business purposes specified in the Terms of Service and Customer’s instructions; or (iii) combine Personal Data received from Customer with personal information from other sources, except as permitted by the CCPA/CPRA for a service provider.

§5Processor obligations

5.1 Confidentiality

SenSec will ensure that persons authorised to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that access is limited to those with a need-to-know.

5.2 Security measures

SenSec will implement and maintain appropriate technical and organizational measures designed to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing, and the likelihood and severity of risk to Data Subjects. A description of the current measures is set out in Annex B.

5.3 Assistance to Controller

Taking into account the nature of processing and the information available to it, SenSec will assist Customer, by appropriate technical and organizational measures and insofar as this is possible, to fulfil its obligations to respond to Data Subject requests under Data Protection Laws and its obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation).

§6Sub-processors

6.1 General authorisation

Customer provides SenSec a general authorisation to engage Sub-processors to process Personal Data in connection with the Service, subject to this Section 6.

6.2 Current Sub-processors

A current list of Sub-processors is maintained in Annex C and updated from time to time. The authoritative, live list is made available via the Service or upon request from privacy@sensec.app.

6.3 New Sub-processors

SenSec will notify Customer of any intended changes concerning the addition or replacement of Sub-processors at least fifteen (15) days in advance. Customer may, within that period, object in writing to such changes on reasonable data-protection grounds. If the parties cannot resolve the objection, Customer may, as its sole remedy, terminate the affected portion of the Service on reasonable notice and receive a pro-rated refund for any prepaid fees covering the post-termination period.

6.4 Flow-down terms

SenSec will impose, by contract, data protection obligations on each Sub-processor that are no less protective of Personal Data than those set out in this DPA. SenSec remains fully liable to Customer for the performance of each Sub-processor’s obligations.

§7International transfers

7.1 Cross-border processing

SenSec may process Personal Data in the United States and in other countries in which SenSec or its Sub-processors maintain facilities. For any transfer of Personal Data from the European Economic Area, the United Kingdom, or Switzerland to a country that has not received an adequacy decision, the parties will rely on appropriate transfer mechanisms.

7.2 Standard Contractual Clauses

The parties agree that, where and to the extent required by Data Protection Laws, the Standard Contractual Clauses (Module Two: Controller to Processor) apply to transfers of Personal Data from Customer (as data exporter) to SenSec (as data importer). Where Customer is itself a Processor and SenSec is a Sub-processor, Module Three of the SCCs applies. Customer agrees that the “docking clause” is not adopted and that Clause 17 Option 2 and Clause 18(b) of the SCCs are completed by reference to the law and courts of Ireland unless otherwise required by mandatory law.

7.3 UK Addendum

For transfers from the United Kingdom, the parties incorporate by reference the UK Addendum, with the SCCs as specified above. The UK Addendum is completed using the information in Annex A.

7.4 Swiss transfers

For transfers from Switzerland, references in the SCCs to the GDPR will be read as references to the Swiss Federal Act on Data Protection, and the competent supervisory authority will be the Swiss Federal Data Protection and Information Commissioner.

7.5 Supplementary measures

SenSec will maintain the supplementary technical, organizational and contractual measures described in Annex B to protect Personal Data transferred outside the EEA, United Kingdom and Switzerland.

§8Data subject rights

Taking into account the nature of the processing, SenSec will assist Customer by appropriate technical and organizational measures, insofar as this is possible, to fulfil Customer’s obligations to respond to Data Subject requests to exercise their rights under Data Protection Laws (including the rights of access, rectification, erasure, restriction, portability, and objection).

If SenSec receives a request directly from a Data Subject, SenSec will, unless prohibited by law, promptly forward it to Customer and will not respond to the Data Subject’s request other than to acknowledge receipt or to refer the Data Subject to Customer.

§9Personal data breach

9.1 Notification

SenSec will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer’s Personal Data. The notification will include, to the extent then known: the nature of the breach, the categories and approximate number of Data Subjects and records concerned, likely consequences, and the measures taken or proposed to address the breach and mitigate its effects.

9.2 Cooperation

SenSec will cooperate with Customer and take reasonable steps as Customer may direct to assist in the investigation, mitigation and remediation of the Personal Data Breach. Such notification is not an acknowledgement by SenSec of any fault or liability.

9.3 Direct reporting

SenSec is not obliged to report Personal Data Breaches affecting Customer’s Personal Data directly to supervisory authorities or Data Subjects, unless required to do so as Controller for its own processing or by mandatory law.

§10Return & deletion of data

Upon termination or expiry of the Service, SenSec will, at Customer’s choice and subject to reasonable written request within thirty (30) days of termination, provide Customer a one-time export of Customer Data in a structured, commonly-used machine-readable format, and thereafter delete or anonymise the Personal Data processed on Customer’s behalf.

SenSec may retain Personal Data to the extent required by applicable law or for legitimate business purposes, including back-up archives, audit logs, and Derived Data that has been aggregated or anonymised such that it no longer constitutes Personal Data. Any retained Personal Data will remain subject to the confidentiality and security obligations of this DPA.

§11Audit & cooperation

11.1 Documentation

SenSec will make available to Customer, upon reasonable request, the information necessary to demonstrate compliance with this DPA and Article 28 GDPR. SenSec will satisfy this obligation primarily through third-party audit reports (e.g., SOC 2 Type II), certifications (e.g., ISO/IEC 27001), penetration testing summaries and published documentation.

11.2 On-site audits

Where the information made available under Section 11.1 is not sufficient to demonstrate compliance, Customer (or an independent auditor mandated by Customer and reasonably acceptable to SenSec, excluding any competitor of SenSec) may conduct an audit of the relevant processing activities, subject to: (a) at least thirty (30) days’ prior written notice; (b) agreement on scope, timing, and duration; (c) mutual execution of a confidentiality agreement; (d) conduct during SenSec’s business hours and in a manner that does not unreasonably interfere with SenSec’s operations; and (e) no more than once per twelve-month period, except as required by a supervisory authority or following a confirmed Personal Data Breach.

11.3 Costs

Each party bears its own costs for audits. SenSec may charge Customer for its reasonable time and expenses incurred in supporting an on-site audit at its then-current professional services rates.

§12Liability & order of precedence

The liability of each party under and in connection with this DPA is subject to the limitations and exclusions set out in the Terms of Service. In the event of any conflict or inconsistency between this DPA and the Terms of Service as they relate to the processing of Personal Data, this DPA controls. The SCCs and UK Addendum prevail over the terms of this DPA to the extent of any conflict.

§13Miscellaneous

• Variation. SenSec may update this DPA from time to time to reflect changes in law or SenSec’s practices. Material changes will be notified to Customer through the Service or by email. Where Data Protection Laws require the Customer’s prior written consent to a variation, that consent may be obtained electronically.
• Severability. If any provision of this DPA is held to be invalid or unenforceable, the remainder of this DPA will remain in full force and effect.
• Interpretation. Headings are for convenience only; the singular includes the plural and vice versa; and “including” means “including without limitation.”
• Counterparts. Where signed, this DPA may be executed in counterparts, each of which constitutes an original and together form one instrument.

---

Annex AProcessing description

A.1 Categories of Data Subjects

• Customer’s personnel (security officers, supervisors, dispatchers, managers)
• Customer’s end clients and their authorised contacts
• Visitors and other individuals recorded in patrol, incident, or access-control workflows
• Customer’s administrative users of the Service

A.2 Types of Personal Data

• Identifiers and contact data (name, business email, phone, role)
• Employment and shift data (assignment, site, schedule)
• Geolocation data from patrol and duty telemetry
• Authentication and access data (user IDs, tokens, audit logs)
• Operational content: incident reports, task records, voice notes, photographs, video and document attachments uploaded by Customer’s users

A.3 Special category data

The Service is not designed for the systematic processing of special categories of data within the meaning of Article 9 GDPR. Customer is responsible for ensuring that it does not upload special category or criminal-offence data without an appropriate legal basis and, where required, additional safeguards.

A.4 Frequency & duration

Processing is continuous for the duration of the subscription. Retention is determined by Customer’s configuration and applicable legal holds, in accordance with Section 10.

A.5 Purpose

Provision of the SenSec FieldOps platform and related support, as described in the Terms of Service.

Annex BTechnical & organizational measures

The following summarises the measures SenSec implements to protect Personal Data. Further detail is available under a non-disclosure agreement.

• Access control. Role-based access, least-privilege defaults, multi-factor authentication for administrative access, scoped API keys, and session monitoring.
• Encryption. TLS 1.2 or higher for data in transit; AES-256 or equivalent for data at rest; key management under tenant-isolation controls.
• Network & infrastructure. Segmented production environments, managed firewalls, rate limiting, WAF, anomaly-based intrusion detection, and hardened container images.
• Application security. Secure software development lifecycle, static and dynamic analysis, dependency scanning, annual third-party penetration testing, and coordinated vulnerability disclosure.
• Logging & monitoring. Immutable audit logs for access, export and administrative actions; 24/7 monitoring; defined incident response playbooks.
• Resilience. Encrypted backups, redundant storage, and tested disaster recovery procedures.
• Personnel. Background checks where legally permitted, confidentiality undertakings, and mandatory security and privacy training.
• Supplier management. Due diligence and contractual controls on Sub-processors, including flow-down of security obligations.
• Data minimisation. Pseudonymisation of direct identifiers in analytics and model-improvement pipelines where reasonably practicable.

Annex CSub-processor list

The authoritative, current list of Sub-processors is maintained by SenSec and made available to Customer through the Service or on request. Typical categories include:

• Cloud hosting & storage: primary infrastructure provider (U.S. and, where required, EU region).
• Content delivery & edge: global CDN and edge security provider.
• Communications: transactional email and SMS providers.
• Error monitoring & analytics: application monitoring and product analytics providers.
• Customer support tooling: ticketing and in-app help providers.
• Payment processing: PCI-DSS-compliant payment provider (billing Personal Data only).

To request the live list, contact privacy@sensec.app.