WiserBuild – Data Processing Agreement (DPA)

This Data Processing Agreement ("DPA") is an addendum to the WiserBuild Terms of Service (the "Main Agreement") between AACI Group, Inc. ("Company" or "Processor"), as the owner and operator of the WiserBuild digital service, and you, the Customer (or "Controller"). WiserBuild is a digital service owned and operated by AACI Group, Inc.; accordingly, AACI Group, Inc. is the sole legal entity responsible for providing the Service and fulfilling the obligations set forth in this DPA. This DPA applies when the Customer is subject to Data Protection Laws (defined below) and personal data is processed by AACI Group, Inc. on the Customer's behalf as part of providing the WiserBuild Service. By using WiserBuild and agreeing to the Terms of Service, the Customer is also agreeing to this DPA. In the event of any conflict between this DPA and the Main Agreement with respect to the processing of personal data, the terms of this DPA shall prevail.

1. Definitions

For the purposes of this DPA, the following terms have the meanings set out below. Terms used but not defined in this DPA shall have the meanings given in the Main Agreement or applicable data protection laws.

• "Personal Data" means any information relating to an identified or identifiable natural person ("Data Subject"); an identifiable person is one who can be identified, directly or indirectly, by reference to such data. For the purposes of this DPA, Personal Data specifically refers to the personal information Customer uploads, stores, or processes through the WiserBuild Service.
• "Processing" (and its cognates, "Process" or "Processed") means any operation or set of operations performed on Personal Data, whether or not by automated means, such as collection, recording, organizing, structuring, storing, altering, retrieving, consulting, using, disclosing, combining, erasing, or destroying.
• "Data Controller" or "Controller" means the entity which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data. For purposes of this DPA, the Customer (you or your organization) is the Data Controller with respect to Personal Data that you provide or use in connection with the WiserBuild Service.
• "Data Processor" or "Processor" means the entity which processes Personal Data on behalf of the Data Controller. In this DPA, AACI Group, Inc., as the provider of the WiserBuild Service, is the Data Processor processing Personal Data on behalf of the Customer.
• "Data Protection Laws" means all data protection and privacy laws and regulations applicable to the Processing of Personal Data under this DPA. This includes, where applicable, the European Union's General Data Protection Regulation (EU) 2016/679 ("GDPR"), the United Kingdom's GDPR and Data Protection Act 2018 ("UK GDPR"), the California Consumer Privacy Act ("CCPA") as amended by the California Privacy Rights Act ("CPRA"), and any other applicable data protection or privacy laws.
• "Sub-processor" means any third party (including any affiliate of AACI Group, Inc.) engaged by the Processor to assist in Processing Personal Data on behalf of the Controller in connection with the WiserBuild Service.

2. Details of Processing

This section outlines the specific details of the Personal Data Processing performed by AACI Group, Inc. on behalf of the Customer:

• Subject Matter: The Processing of Personal Data as necessary to provide the WiserBuild Service and related technical support to the Customer under the Main Agreement.
• Duration of Processing: The Processing will continue for the duration of the Customer's use of the WiserBuild Service and until deletion of all Personal Data as described in this DPA (for example, upon termination of the Main Agreement and completion of data deletion requests).
• Nature and Purpose of Processing: AACI Group, Inc. will Process Personal Data as needed to host, maintain, and provide the functionality of the WiserBuild platform. This includes storing data, enabling Customer and its users to input and manage information (such as project plans, user profiles, etc.), and processing data as per the features of the Service (e.g., generating reports, facilitating communication between users, or integrating with other services at the Customer's request).
• Types of Personal Data: The Personal Data processed may include (but is not limited to) identification and contact data (names, emails, phone numbers); account credentials; professional or employment information (company name, job title); project-related data that may contain personal information (such as property addresses tied to individuals, design specifications linked to owners or contractors); and any other personal information that the Customer or its authorized users input into the Service.
• Categories of Data Subjects: Data Subjects include individuals about whom data is provided to AACI Group, Inc. via the WiserBuild Service. These may include the Customer's representatives and end users (such as employees, contractors, or agents who are authorized to use WiserBuild), the Customer's own clients or customers (for example, homeowners or property owners whose information is entered into the platform), and any other individuals whose personal data is uploaded to WiserBuild by or at the direction of the Customer.

3. Obligations of AACI Group, Inc. (Processor)

As the Data Processor, AACI Group, Inc. agrees to the following with respect to any Personal Data processed on behalf of the Customer:

• Processing on Instructions: AACI Group, Inc. will Process Personal Data only on documented instructions from the Customer. The Main Agreement (and any use of settings or features within the WiserBuild Service) constitutes the Customer's initial instructions to AACI Group, Inc.
• Confidentiality: AACI Group, Inc. will ensure that any personnel (including employees and contractors) authorized to Process Personal Data are obligated to maintain the confidentiality of the Personal Data.
• Security Measures: AACI Group, Inc. will implement and maintain appropriate technical and organizational measures to protect Personal Data against unauthorized or unlawful Processing and against accidental loss, destruction, damage, theft, alteration, or disclosure.
• Sub-processors: The Customer provides a general authorization for AACI Group, Inc. to engage Sub-processors for carrying out specific processing activities on behalf of the Customer, provided that AACI Group, Inc. ensures any Sub-processor processes Personal Data in a manner consistent with AACI Group, Inc.'s obligations under this DPA.
• Assistance to Controller: AACI Group, Inc. will assist the Customer, by appropriate technical and organizational measures and insofar as possible, in fulfilling the Customer's obligations to respond to requests by Data Subjects to exercise their rights under Data Protection Laws.
• Personal Data Breach Notification: In the event AACI Group, Inc. becomes aware of a Personal Data Breach, AACI Group, Inc. will notify the Customer without undue delay.
• Deletion or Return of Data: Upon termination or expiration of the Main Agreement, or upon the Customer's written request, AACI Group, Inc. will, at the choice of the Customer, delete or return all Personal Data processed on behalf of the Customer.
• Compliance and Audits: AACI Group, Inc. will make available to the Customer all information reasonably necessary to demonstrate compliance with the obligations set forth in this DPA.

4. Obligations of Customer (Controller)

As the Data Controller, the Customer agrees to:

• Lawful Use of Service: Ensure that it has obtained all necessary rights, authorizations, and consents from Data Subjects for the Processing of their Personal Data by AACI Group, Inc. as described in the Main Agreement and this DPA.
• Data Accuracy: Be responsible for the quality and accuracy of Personal Data provided to AACI Group, Inc. The Customer should only share Personal Data that is necessary for using the WiserBuild Service and will keep the data up-to-date as needed.
• Instructions: Provide documented instructions to AACI Group, Inc. that are compliant with Data Protection Laws.
• Security Responsibilities: Implement appropriate security measures for components of the data processing that the Customer controls (for example, securing the Customer's account credentials, and using appropriate access controls when granting access to the Service within its organization).
• Third-Party Rights: Be solely responsible for compliance with any laws applicable to the Customer's data or use of the Service, including those relating to the collection, transmission, and processing of Personal Data.

5. International Data Transfers

AACI Group, Inc. is based in the United States and may process Personal Data in the U.S. or other countries outside of the Data Subject's country of residence. For purposes of GDPR and similar laws, any transfer of Personal Data from the European Economic Area (EEA), the United Kingdom, or Switzerland to a country not deemed by the relevant authority to provide an adequate level of data protection will be governed by appropriate safeguards as required by applicable Data Protection Laws:

• Standard Contractual Clauses: The parties agree that the Standard Contractual Clauses for the transfer of personal data to processors established in third countries (the "SCCs"), as approved by the European Commission (currently pursuant to Decision 2021/914, commonly known as the 'EU SCCs'), are hereby incorporated into this DPA by reference.
• UK and Swiss Transfers: For data transfers from the United Kingdom, the EU SCCs as incorporated above shall apply as modified by the UK "International Data Transfer Addendum" issued by the UK Information Commissioner's Office (IDTA). For data transfers from Switzerland, the parties agree to abide by the EU SCCs with appropriate modifications.
• Additional Measures: The Processor will, if required by Data Protection Laws, implement supplementary measures to ensure that transferred data is afforded essentially equivalent protection to that in the country of origin.

6. Liability and Indemnity

The liability of each party under this DPA is subject to the exclusions and limitations of liability set forth in the Main Agreement. Each party's total liability for all claims arising out of or in connection with this DPA and the Processing of Personal Data shall not exceed the limitations of liability agreed to in the Main Agreement.

The Customer shall indemnify and hold harmless AACI Group, Inc. (and its affiliates, officers, and employees) from any cost, charge, damages, expense or loss incurred by AACI Group, Inc. arising from any breach by the Customer of its obligations under this DPA or Data Protection Laws, or from the processing of Personal Data in accordance with the Customer's instructions that infringe applicable laws.

7. Term and Termination

This DPA becomes effective between the parties upon the Customer's acceptance of the Main Agreement and remains in effect until deletion of all Personal Data by AACI Group, Inc. as described above. Termination or expiration of the Main Agreement will automatically terminate this DPA. Sections of this DPA that are intended by their nature to survive termination (such as those relating to data deletion, confidentiality, liability, and international transfers) shall survive termination or expiration of this DPA for as long as necessary to fulfill those obligations.

8. Miscellaneous

• Order of Precedence: In the event of any conflict or inconsistency between the terms of this DPA and the terms of the Main Agreement or other agreements between the parties, the terms of this DPA shall prevail with regard to the Processing of Personal Data.
• Amendments: No amendment or modification to this DPA will be effective unless in writing and signed by authorized representatives of both parties, except that this DPA may be updated by AACI Group, Inc. as needed to comply with changes in Data Protection Laws.
• Governing Law: This DPA shall be governed by and interpreted in accordance with the same laws and jurisdiction as stated in the Main Agreement, except to the extent that the applicable Data Protection Laws mandatorily require otherwise.
• Severability: If any provision of this DPA is found by a court of competent jurisdiction to be invalid or unenforceable, that provision shall be severed from the DPA, and the remainder of this DPA shall remain in full force and effect.
• Entire Agreement: This DPA and the Main Agreement (including all attachments and documents incorporated by reference) constitute the entire agreement between the parties with regard to the Processing of Personal Data described herein.
• Contact and Communication: Any communications related to this DPA should be directed to AACI Group, Inc.'s designated privacy or legal contact (as provided in the Privacy Policy or Main Agreement).