Data Processing Addendum

1. How this DPA applies

This Data Processing Addendum is part of the Terms of Service between Primo and the customer that accepted them. "Primo," "we," "us," and "our" mean Primo. "You" means the customer. Words defined in the Terms have the same meaning here.

This DPA applies whenever we process Customer Personal Data to provide the service. You accept it when you accept the Terms, and no signature is needed. To get a signed copy for your records, email ryannovak07@gmail.com.

If this DPA conflicts with the Terms, this DPA controls on the processing of personal data. If the SCCs apply and conflict with this DPA, the SCCs control.

2. Definitions

• "Customer Personal Data" means personal data in Customer Data that we process on your behalf.
• "Data Protection Laws" means the privacy and data protection laws that apply to that processing. These include the California Consumer Privacy Act as amended by the California Privacy Rights Act, other US state privacy laws, the GDPR, and the UK GDPR.
• "Security Incident" means a breach of security that leads to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, Customer Personal Data.
• "Subprocessor" means a third party we engage to process Customer Personal Data.
• "SCCs" means the standard contractual clauses approved by the European Commission in Decision (EU) 2021/914.
• "UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner.
• "Controller," "processor," "data subject," "personal data," and "processing" have the meanings given in the GDPR. Where the CCPA applies, "controller" includes a "business" and "processor" includes a "service provider."

3. Roles

You are the controller of Customer Personal Data, and we are your processor. If you process it as a processor for another controller, we are your subprocessor, and you are responsible for any authorization that controller must give.

We act as a controller only for the account and billing data of your owners and admins. Our Privacy Policy covers that data, and this DPA does not.

4. Instructions

We process Customer Personal Data only on your documented instructions. Your instructions are:

• the Terms and this DPA
• your configuration and use of the service, including what your Users ask the Primo agent to do
• other written instructions you give us that are consistent with the Terms

If we believe an instruction violates Data Protection Laws, we will tell you and may decline to follow it. If the law requires us to process Customer Personal Data in another way, we will tell you before we do, unless the law forbids that notice.

Where the CCPA applies, we will not:

• sell or share Customer Personal Data
• keep, use, or disclose it outside our direct business relationship with you, or for any purpose other than the business purposes in the Terms
• combine it with personal information from other sources, except as the CCPA permits

Those business purposes are to provide, secure, support, and improve the service, and to comply with the law. We will meet our obligations under the CCPA, give Customer Personal Data the level of protection the CCPA requires, and tell you if we can no longer do so. You may take reasonable steps to stop and fix any unauthorized use. We do not use Customer Personal Data to train our own AI models.

You are responsible for the lawfulness of your instructions and the accuracy of Customer Personal Data. You are also responsible for giving the notices and getting the consents that section 7 of the Terms requires.

5. Confidentiality

We give access to Customer Personal Data only to personnel who need it to provide the service, and only to the extent they need it. Everyone with access is bound by a duty of confidentiality.

6. Security measures

We maintain technical and organizational measures that fit the risk of the processing. They include:

• separation of each customer's data by organization, enforced by row-level security in our database
• encryption in transit with TLS, and encryption at rest by our infrastructure providers
• least-privilege access to production systems and data
• PINs stored only as salted hashes, never in plain text
• card details handled by Stripe, with no full card numbers stored by Primo
• code execution in a fresh, isolated sandbox that is destroyed after each job
• written data protection terms with every subprocessor, under section 7
• incident response and notification, under section 9
• deletion on the schedule in section 10

We may update these measures, but we will not lower the overall protection they give.

7. Subprocessors

You give us general authorization to engage subprocessors. The table in our Privacy Policy lists our current subprocessors, with the purpose and location of each.

We will:

• bind each subprocessor by written contract to data protection obligations that protect Customer Personal Data at least as well as this DPA, to the extent they apply to its service
• remain responsible to you for each subprocessor's performance
• give at least 30 days' notice before a new subprocessor processes Customer Personal Data, through our changelog or by email to your account owner

We send Customer Personal Data to AI subprocessors only to produce the results your Users request, and they process it under their business API terms.

You can object to a new subprocessor on reasonable data protection grounds by emailing us within the notice period. We will work with you in good faith to resolve the objection. If we cannot resolve it, you may stop using the affected part of the service or cancel your subscription under the Terms.

8. Help with requests and assessments

If a data subject sends us a request about Customer Personal Data, we will forward it to you promptly. We will not respond to it ourselves, except to say that we forwarded it, unless you authorize us or the law requires it.

As the nature of the processing allows, we will help you respond to data subject requests, through features in the service and reasonable help on request. We will also give you reasonable help with data protection impact assessments and consultations with regulators, using the information available to us.

9. Security incidents

We will notify you without undue delay and within 72 hours after we confirm a Security Incident. We send the notice to your account owner's email address. It will describe, as far as we know at the time:

• what happened
• the categories and approximate number of data subjects and records involved
• the likely consequences
• what we have done or plan to do about it
• who to contact for more information

We will update you as we learn more, and we will take reasonable steps to contain the incident and limit its effects. You decide whether to notify regulators or data subjects. Our notice is not an admission of fault.

10. Deletion and return

When your subscription ends:

1. You have 30 days to export Customer Personal Data.
2. We then delete it from our production systems within a further 30 days.
3. Copies in our backups roll off within 30 days after that.

If the law requires us to keep any Customer Personal Data, we keep it confidential and process it only for that purpose. On request, we will confirm deletion in writing.

11. Audits

We will make available the information you reasonably need to verify our compliance with this DPA. We start with documentation and written answers to a reasonable security questionnaire.

If that information is not enough to meet a requirement of Data Protection Laws, or a regulator requires more, you may audit our compliance. You may do so once every 12 months, and again after a Security Incident. An audit must:

• follow at least 30 days' written notice
• take place during business hours, with a scope we agree on in advance
• be carried out by you or by an independent auditor bound by confidentiality
• not give access to other customers' data
• be at your cost

12. International transfers

We process Customer Personal Data in the United States. If a transfer of Customer Personal Data to us from the EEA, the UK, or Switzerland needs a transfer mechanism, the SCCs form part of this DPA as follows:

• Module Two applies where you are a controller, and Module Three applies where you are a processor.
• Clause 7, the optional docking clause, does not apply.
• Under Clause 9, Option 2 applies, with the 30-day notice period in section 7.
• The optional language in Clause 11 does not apply.
• Under Clause 17, Option 1 applies, and the law of Ireland governs. Under Clause 18, the courts of Ireland have jurisdiction.
• Annex I is the annex to this DPA. Annex II is section 6. Annex III is the subprocessor table in our Privacy Policy.

For transfers from the UK, the UK Addendum applies, completed with the information in this DPA and the selections above. For transfers from Switzerland, the SCCs apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection.

13. Liability

Each party's liability under this DPA and the SCCs is subject to the limits and exclusions in the Terms, to the extent the law allows. Nothing in this section limits a party's liability to data subjects under the SCCs.

14. Term

This DPA lasts as long as we process Customer Personal Data, including during the deletion period after the Terms end.

Annex. Description of the processing

Parties

The data exporter is you, the customer, acting as a controller or as a processor. Your contact is your account owner.

The data importer is Primo, of Las Vegas, Nevada, USA, acting as a processor. Contact Primo at ryannovak07@gmail.com.

Data subjects

• your employees and other Users, such as owners, managers, and crew
• people who appear by chance in photos or in voice call audio, such as coworkers or guests
• people named in messages or files you upload, such as vendors or contractors listed in an SOP binder

Categories of personal data

• names, email addresses, phone numbers, roles, and store assignments
• PINs, stored only as salted hashes
• mission answers, timers, maintenance tickets, and training records
• photos taken as proof of work
• voice call audio, transcripts, and dictation
• chat messages and uploaded files
• performance points and ratings
• device and push-notification tokens
• usage logs

Sensitive data

None is intended. Photos may show people by chance, and voice audio captures the speaker and sometimes people nearby. Primo does not use photos or audio for facial recognition or any other biometric identification. Do not upload special categories of data, such as health records, unless you need to and the law allows it. The measures in section 6 apply to all Customer Personal Data.

Nature and purpose of the processing

We host, store, transmit, display, and delete Customer Personal Data. We also send it to AI models for analysis and transcription. We do this only to provide the service under the Terms. That covers missions with photo proof and timers, maintenance tickets, training, leaderboards, the Primo agent, and support.

Frequency and duration

Processing is continuous for as long as the Terms are in effect. It then follows the deletion schedule in section 10.

Subprocessors

Our subprocessors process Customer Personal Data for the purposes listed in our Privacy Policy, for as long as the Terms are in effect.

Competent supervisory authority

For the SCCs, the supervisory authority under Clause 13 is the one that applies based on where you are established or where your EU representative is located. For transfers from the UK, it is the UK Information Commissioner. For transfers from Switzerland, it is the Swiss Federal Data Protection and Information Commissioner.