Data processing addendum

1. Definitions

• "Data Protection Laws": all laws on privacy and personal data that apply to the processing under the Agreement, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended by the California Privacy Rights Act and its regulations ("CCPA"), and other US state comprehensive privacy laws.
• "Customer Personal Data": personal data or personal information within Customer Data (as the Agreement defines it) that we process on Customer’s behalf.
• "Security Incident": a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data in our or our Subprocessors’ systems.
• "Subprocessor": a third party we engage to process Customer Personal Data.
• "Standard Contractual Clauses": the clauses annexed to European Commission Implementing Decision (EU) 2021/914; "UK Addendum": the International Data Transfer Addendum issued by the UK Information Commissioner.
• Terms such as "controller", "processor", "data subject", "processing", "business", "service provider", "sell" and "share" have the meanings given in the Data Protection Laws.

2. Roles and scope

Customer is the controller (or business) of Customer Personal Data, or a processor acting for its own clients, in which case we are its subprocessor. We are Customer’s processor (or service provider). Annex I describes the processing. We are a separate controller for the account, billing, security and website information our Privacy Policy describes; this DPA does not apply to that information.

Customer is responsible for having a lawful basis for the processing, for giving the notices and obtaining the consents the law requires, and for the accuracy of Customer Personal Data and of its instructions.

3. Customer’s instructions

We process Customer Personal Data only on Customer’s documented instructions, which are: the Agreement and this DPA; the processing Customer and its users start through the Service, including its settings and the services they connect; and other reasonable written instructions consistent with the Agreement. We will tell Customer if we believe an instruction breaches Data Protection Laws, and may then suspend the processing concerned. We may process Customer Personal Data otherwise only where the law requires, and will tell Customer of that legal requirement first unless the law forbids it.

4. CCPA and US state law terms

With respect to personal information subject to the CCPA and other US state laws, we:

• process it only for the business purposes of providing, securing and supporting the Service as described in the Agreement and Annex I;
• do not sell or share it, and do not retain, use or disclose it for any other purpose, including any commercial purpose, or outside the direct business relationship with Customer;
• do not combine it with personal information we receive from or on behalf of anyone else, or collect from our own interactions with individuals, except as the CCPA permits;
• comply with the obligations that apply to service providers and processors and provide the same level of privacy protection the law requires of Customer;
• will notify Customer within 10 business days if we determine we can no longer meet these obligations;
• grant Customer the right, on notice, to take reasonable and appropriate steps to ensure our use is consistent with Customer’s obligations, and to stop and remediate unauthorized use;
• will keep any deidentified data in deidentified form, publicly commit not to reidentify it, and pass these duties to any recipient;
• will help Customer answer consumer requests as section 10 describes, and bind each Subprocessor by a written contract with equivalent obligations.
• We certify that we understand and will comply with these restrictions.

5. Confidentiality of personnel

We ensure that everyone we authorize to process Customer Personal Data is bound by a duty of confidentiality and has access only as needed for their role.

6. Security

We implement and maintain the technical and organizational measures in Annex II, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing and the risks to individuals. We may update these measures, provided we do not materially reduce the overall protection of Customer Personal Data.

7. Customer’s security responsibilities

Customer is responsible for its own use of the Service, including choosing who is invited and with what role, protecting its users’ sign-in details, using two-step sign-in where appropriate, and backing up Reports it needs to keep.

8. Support and administrative access

Our authorized personnel may access Customer’s workspace to provide support, administer the account, investigate a security or technical problem, or comply with the law, without obtaining Customer’s consent each time. Each access is recorded in Customer’s activity history, which Customer can review. We give another organization access to Customer’s projects only on Customer’s written request.

9. Subprocessors

• Customer gives us general written authorization to engage Subprocessors. Our current Subprocessors are listed in Annex III and on our Subprocessors page.
• Before a new Subprocessor processes Customer Personal Data, we will update the page and notify Customer’s owners by email at least 30 days in advance, except where an emergency requires a shorter period, in which case we will give as much notice as possible and explain why.
• Customer may object on reasonable data protection grounds within 15 days of the notice. We will discuss the objection in good faith; if we cannot resolve it within 30 days, Customer may end the affected part of the Service, and we will refund prepaid fees for the remaining term.
• We impose on each Subprocessor, by written contract, data protection obligations at least as protective as this DPA, and remain responsible to Customer for its performance.

10. Requests from individuals

The Service lets Customer view, correct, export and delete Customer Personal Data. If we receive a request from an individual about Customer Personal Data, we will not respond except to direct the person to Customer, and will forward the request to Customer promptly. Taking into account the nature of the processing, we will give Customer reasonable help to answer requests it cannot fulfil through the Service.

11. Security Incidents

We will notify Customer without undue delay, and no later than 72 hours, after confirming a Security Incident. The notice will describe, to the extent known, the nature of the incident, the categories and approximate number of individuals and records concerned, the likely consequences, and the measures taken or proposed, and we will update it as we learn more. We will take reasonable steps to contain and remedy the incident and help Customer meet its own notification duties. Notice is not an admission of fault. Unsuccessful attempts that do not compromise Customer Personal Data, such as blocked sign-in attempts or network scans, are not Security Incidents.

12. Assessments and consultations

Taking into account the nature of the processing and the information available to us, we will give Customer reasonable help with data protection impact assessments and prior consultations with supervisory authorities that relate to the Service.

13. Return and deletion

For 30 days after the Agreement ends, Customer may download its Reports and files or ask us for a full copy of Customer Data. We then delete Customer Personal Data from the live Service, and backup copies expire within a further 30 days, unless the law requires us to keep it, in which case we keep it confidential and process it only for that purpose. On request we will confirm deletion in writing.

14. Information and audits

We will make available the information reasonably necessary to demonstrate our compliance with this DPA, including by answering one written security questionnaire a year and providing this DPA’s Annex II and our Security overview. We do not currently hold a SOC 2 report or ISO 27001 certification. If that information is not enough to demonstrate compliance, or a supervisory authority requires it, Customer (or an independent auditor bound by confidentiality and not a competitor of ours) may audit our compliance once a year, on 30 days’ written notice, during business hours, without disrupting the Service or accessing other customers’ data, and at Customer’s expense.

15. International transfers

• We store and process Customer Personal Data, including its backup copies, in the United States, and our Subprocessors may process it in the locations listed in Annex III.
• Where Customer Personal Data subject to the GDPR is transferred to us in a country without an adequacy decision, the Standard Contractual Clauses are incorporated into this DPA: Module 2 where Customer is a controller and Module 3 where Customer is a processor. Clause 7 (docking) applies; under Clause 9(a), Option 2 applies with the notice period in section 9; the optional language in Clause 11 does not apply; under Clause 17, Option 1 applies and the law of Ireland governs; under Clause 18, the courts of Ireland have jurisdiction. Annexes I to III of this DPA complete the Clauses’ annexes.
• For personal data subject to the UK GDPR, the UK Addendum is incorporated, with its tables completed from this DPA and the Clauses, and either party may end it as its section 19 allows. For personal data subject to Swiss law, the Clauses apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection and the Swiss Federal Data Protection and Information Commissioner as the competent authority.
• If a public authority asks us for Customer Personal Data, we will try to redirect it to Customer, notify Customer unless the law forbids it, and challenge requests we reasonably consider unlawful.

16. Liability and term

Each party’s liability under this DPA is subject to the limitations in the Agreement, except where Data Protection Laws or the Standard Contractual Clauses do not allow it. This DPA lasts as long as we process Customer Personal Data.

Annex I: Description of the processing

• Parties: Customer (data exporter; controller or processor), whose contact details are in its account; Environmental Nexus LLC (data importer; processor), 7901 4th Street North, Suite 300, St. Petersburg, FL 33702, [email protected].
• Data subjects: Customer’s authorized users; Customer’s clients and their contacts; landowners and others named in public records or project files; people interviewed for site assessments; people shown in uploaded photographs; recipients of email sent through the Service; Customer staff whose credentials appear in reports.
• Categories of personal data: names, email addresses, telephone numbers, job titles and professional profile links; licence and certification numbers; signature images; site addresses and parcel ownership records; interview notes; photographs; messages, emails and comments written in the Service; activity records; and any other personal data Customer chooses to put into project files.
• Special categories and sensitive data: none intended. Customer should not upload special category data, government identifiers or financial account numbers.
• Frequency: continuous, for the term of the Agreement.
• Nature and purpose: hosting, storing, organizing, retrieving and displaying Customer Data; researching public records for project sites; drafting, reviewing and exporting Reports; sending email and notifications Customer’s users start; syncing services Customer’s users connect; backup, security and support.
• Retention: for the term of the Agreement and 30 days after, plus up to 30 days in backups, as section 13 describes.
• Transfers to Subprocessors: for the purposes and data listed in Annex III. Replies to email sent from the Service, emails Customer sends to our enexus.cc addresses, and any Customer Data in them, are stored by our email provider in Germany.
• Competent supervisory authority: as Clause 13 of the Standard Contractual Clauses determines.

Annex II: Technical and organizational measures

• Encryption in transit: all connections to the application use HTTPS with TLS 1.2 or 1.3 and HTTP Strict Transport Security, through Cloudflare and an origin certificate on our server.
• Encryption of secrets: access tokens for connected services, two-step sign-in secrets and webhook secrets are encrypted in the database with authenticated encryption, under a separate key for each organization that is itself encrypted with a key held only on the application server.
• Encryption of backups: backups are encrypted before they are stored. The live database and stored files rely on the hosting provider’s physical security and on our server access controls.
• Authentication: passwords hashed with Argon2, at least 12 characters and checked against known breached passwords; optional two-step sign-in with authenticator apps, recovery codes or passkeys, which an organization’s owners can require; Google and Microsoft sign-in; single sign-on (SAML or OpenID Connect) and user provisioning (SCIM) on Enterprise plans; throttling and lock-out after repeated failed sign-ins.
• Sessions: sign-in tokens stored only as keyed hashes; cookies that scripts cannot read and that are sent only over HTTPS; sessions end after 7 days idle and 30 days at most and can be revoked; every changing request carries an anti-forgery token.
• Access control: roles at the organization level (owner, administrator, member, viewer) and the project level (owner, reviewer, editor, reader); every request is checked against the person’s organization and role, and access is refused when a check cannot be made.
• Separation of customers: each organization’s data is kept apart by the database itself as well as by the application’s checks, and each organization’s stored files are kept in a storage location of its own.
• Staff access: limited to named platform administrators; each opening of a customer workspace and everything done in it is recorded in that customer’s activity history.
• Infrastructure: servers accept administrative access only with named keys, and firewalls admit only the traffic the service needs.
• Backups and recovery: the database and stored files are backed up nightly, encrypted and checked, and kept as encrypted off-server copies in the United States for up to 30 days.
• Monitoring: an external monitor checks the service’s health; application errors are reported to Sentry with personal details removed; access logs redact secrets.
• Activity records: changes, approvals, exports and deletions are recorded in an activity log that is not edited.
• Rate limits: per-organization and per-person limits on requests and heavy actions protect the service from abuse.
• Data minimization: only the site location is sent to public agency services; data from connected calendars is limited to the fields listed in the Privacy Policy.
• Incident response: we investigate, contain and notify Security Incidents as section 11 describes.

Annex III: Subprocessors

• IONOS Inc.: Hosts the application, its database and stored files, and its encrypted backups. Data: All Customer Data and account information. Location: United States.
• Cloudflare, Inc.: Domain name service, encrypted connections and network protection for the application. Data: All data passing between users and the application, including IP addresses. Location: United States; global network.
• InterServer, Inc. (MailBaby): Delivers the email the application sends, such as invitations, notifications, and the reports, letters and messages users send to their clients without a connected mailbox. Data: Sender and recipient names and addresses, message content and attachments. Location: United States.
• Hetzner Online GmbH: Hosts the mailboxes the application reads: replies to email sent from the application, and email sent to [email protected]. Data: Sender and recipient names and addresses, message content and attachments. Location: Germany (EU).
• Docusign, Inc.: Sends documents for signature, when a customer connects its own DocuSign account. Data: The documents sent for signature, and the signers’ names and email addresses. Location: United States, or the region of the customer’s DocuSign account.
• Functional Software, Inc. (Sentry): Error monitoring. Data: Technical details of errors, with account and organization identifiers; names, email addresses, request bodies and files are removed before sending. Location: United States.
• For emails Customer sends us: Hetzner Online GmbH: Email for messages sent to our other enexus.cc addresses. Data: Contents of emails you send us. Location: Germany (EU).