Data Processing Addendum

1. Scope and Roles

This Data Processing Addendum (“DPA”) is part of the SaaS Logic Terms of Service and any order form or agreement between SaaS Logic LLC (“SaaS Logic”, “we”) and the organization that uses our services (“Customer”, “you”). It applies automatically to every Customer of FacilityView360, FacilityView360 Twin, CMMS Pro, CMMS Lite, HotelOps360, AssetView3D, SecureDutyPro, Ground Pilot GPS, Time Card, ReturnLink, Find The Eats and the other SaaS Logic products (the “Services”).

Customer Data means the data you and your users put into, or generate through, the Services, including the personal information in it. For Customer Data, you decide what is collected and why, and we process it on your behalf: you are the business or controller, and SaaS Logic is your service provider or processor.

This DPA does not cover information SaaS Logic handles for its own purposes, such as billing contacts, sales and support conversations, and website visits. Our Privacy Policy covers those.

If this DPA conflicts with the Terms on the processing of Customer Data, this DPA controls. A DPA or data terms signed with you control over this page.

2. Our Commitments

For Customer Data, SaaS Logic will:

• process it only to provide, secure and support the Services, following your documented instructions. The Terms, your order, your settings in the Services, and requests from your administrators are your instructions. We will tell you if we believe an instruction breaks the law;
• never sell or rent it, never share it for cross-context behavioral advertising, and never use it for our own marketing;
• not combine it with personal information from other sources, except as needed to provide the Services you use (for example, single sign-on across SaaS Logic products);
• not use it to train AI models, and not allow our subprocessors to do so;
• limit access to staff who need it to run and support the Services, and bind them to confidentiality;
• use only the subprocessors listed in Annex A, under written terms that protect the data at least as well as this DPA; and
• keep the security measures in Annex B in place.

We may create aggregated or de-identified information that cannot reasonably be linked to you or any person, and use it to operate and improve the Services. We will not try to re-identify it.

You are responsible for having the right to collect and share the Customer Data you put into the Services, including any notices and consents your users, guests, drivers or the public must receive.

3. What We Process

Purpose: providing the Services you subscribe to, including hosting, storage, backup, support, security, and the features you choose to use. Processing lasts for your subscription and the deletion period in section 9.

People the data is about: your employees, contractors and other users; your customers, guests, tenants, visitors and vendors; drivers and passengers of tracked vehicles; and members of the public who appear in records you keep (for example, vehicles at a parking lot or traffic camera).

Types of data, depending on the products and features you use:

• Account and contact details: names, job titles, work emails, mobile numbers, sign-in records and roles.
• Operational records: work orders, preventive maintenance, assets, locations, inventory, invoices, inspections, rooms and housekeeping, support tickets, documents and drawings.
• Photos, video and audio: photos attached to records, building models, camera snapshots and video, push-to-talk radio clips, and phone-system call records and voicemail.
• Location data: GPS positions and trips of vehicles, devices and security officers, and patrol and checkpoint scans.
• Time records: clock-ins, hours and timesheets.
• Vehicle and parking records: license plates, permits and passes.
• Transaction records: orders and sales in point-of-sale features. Card numbers are handled by Stripe; we don't store them.

The Services are not designed for the special categories of data described in section 13.

4. Subprocessors

You authorize the subprocessors listed in Annex A. SaaS Logic remains responsible for their work under this DPA.

We will update Annex A at least 30 days before a new subprocessor starts processing Customer Data. In an urgent case, such as replacing a failed provider, we will update it as soon as we can. To be emailed about changes, ask support@saas-logic.com to add you to the subprocessor notice list.

If you object to a new subprocessor for a reasonable data-protection reason, tell us within those 30 days. We will try to find a fair solution, such as not using that provider for your data. If we can’t, you may cancel the affected Service without further charges after the cancellation takes effect.

5. AI Features

Some optional features send Customer Data to an AI provider to produce a result, for example:

• reading an uploaded invoice, receipt, quote or service record;
• reading equipment nameplates, panel schedules and inspection tags from photos;
• suggesting an asset’s name and details from its photos;
• suggesting troubleshooting steps from your own records and photos;
• researching recalls and replacement values for an asset;
• answering questions in the Ann support chat; and
• analyzing traffic camera images.

The providers are listed in Annex A. They process the data only to return the result, under terms that do not allow them to train their models on it. Results are suggestions for your staff to review.

An administrator can ask support@saas-logic.com to turn off AI features for their organization. We will confirm in writing when it is done.

6. Security

We keep administrative, technical and physical safeguards designed to protect Customer Data against unauthorized or accidental access, loss, change or disclosure. The main measures are listed in Annex B. We may improve or replace them, but will not reduce the overall protection of Customer Data during your subscription.

You are responsible for the security of your own accounts, devices and settings. That includes who you give access to, keeping sign-in phones and devices secure, and removing users who leave.

7. Security Incidents

If we confirm a breach of security that leads to unauthorized access to, or loss, change or disclosure of, your Customer Data (a “Security Incident”), we will:

• notify your account administrators without undue delay, by email and, where we can, by phone;
• tell you what we know: what happened, which data and how many records or people are likely affected, what we are doing about it, and a contact for questions;
• update you as we learn more;
• take reasonable steps to contain the incident and reduce harm; and
• give you reasonable help with any notices you must send to people, regulators or others.

Telling you about a Security Incident is not an admission of fault. Unsuccessful attempts that don’t compromise Customer Data, such as blocked sign-in attempts, scans or denial-of-service attempts, are not Security Incidents.

8. Requests from Individuals

Most requests from people to see, correct, export or delete their information can be handled by your administrators in the Services. If they can’t, we will help, taking into account what we can reasonably do.

If we receive a request about Customer Data directly, we will send it to you and not answer it ourselves, unless the law requires us to. If a government or court asks us for Customer Data, we will tell you first, unless the law forbids it, so you can respond.

9. Return and Deletion

• Export: you can export your records at any time during your subscription. For 30 days after your subscription ends, we keep your Customer Data, and on request we will give you an export of it.
• Deletion: within 30 days after that export period, we delete your Customer Data from the Services’ live systems. You can ask us to delete it sooner, in writing.
• Backups: copies in our backups are deleted as those backups expire, within 13 months after deletion from the live systems. Until then they stay protected, are not used, and remain covered by this DPA.
• Your own storage: data you send to a storage account of your own (for example dashcam video saved to your own cloud storage) stays under your control there. When your service ends, we delete our access to it.
• Confirmation: on request, we will confirm in writing when deletion is complete.

We may keep information longer only where the law requires us to, and only for that purpose. Your billing records with us are covered by our Privacy Policy, not this section.

10. Where Data Is Kept

The Services are hosted in the United States, and our primary storage and backups of Customer Data are in the United States. Some subprocessors, such as email delivery and network services, may process data in other countries to deliver the Services. Where they do, they are bound to protect it as this DPA requires.

The Services are offered to customers in the United States. If your organization is subject to the GDPR or UK data protection law, contact us before entering personal data about people in Europe or the UK, so we can put the required transfer terms in place.

11. Information and Audits

On request, once a year (or more often after a Security Incident, or if a regulator requires it), we will answer your reasonable written security and privacy questionnaire. We will also give you the information you reasonably need to show that this DPA is being followed.

If the law or a regulator requires an audit beyond that, we will cooperate with a reasonable audit. It must be agreed in advance, done during business hours, avoid disruption to other customers, and be under confidentiality, at your cost.

12. Privacy Laws

We will process Customer Data in line with the privacy laws that apply to us as your service provider or processor. These include the California Consumer Privacy Act and similar US state laws.

Under those laws, we will not keep, use or disclose Customer Data outside our direct business relationship with you, or for any purpose other than the business purposes in this DPA. We will give the same level of privacy protection the law requires, and tell you if we can no longer meet our obligations. You may take reasonable steps to stop and fix any unauthorized use.

We certify that we understand and will follow these restrictions.

13. Regulated and Sensitive Data

Unless we agree otherwise in a signed writing, do not put the following into the Services:

• protected health information under HIPAA;
• criminal justice information under the FBI CJIS Security Policy;
• payment card numbers, except through our payment processor’s secure forms;
• student education records under FERPA;
• Social Security, driver’s license or financial account numbers; and
• other sensitive data that needs special protection under law.

The Services are not designed to meet the extra requirements for that data.

14. General

This DPA lasts as long as we process Customer Data for you. The limits of liability in the Terms apply to this DPA, unless the law does not allow it.

We may update this DPA by posting a new version here with a new effective date. A change will not reduce the protection of Customer Data during your current subscription term without your agreement.

Signed copies: if your organization needs a signed DPA, print this page or save it as a PDF (the signature page is at the end), sign it, and email it to support@saas-logic.com. We will countersign and send it back. A signed copy has the same terms as this page, unless we both sign changes.

Contact for privacy and security matters: SaaS Logic LLC, 1750 14th St, Orange City, FL 32763, United States, support@saas-logic.com.

Annex A: Subprocessors

Last updated November 10, 2026. Which ones handle your data depends on the products and features you use.

Annex B: Security Measures

• Encryption in transit: the Services are served over HTTPS (TLS). Connections between our servers and site devices use encrypted private networks.
• Encrypted backups: databases are backed up at least hourly to encrypted, access-restricted storage. Restores are tested.
• Tenant isolation: each customer’s records are kept separate, and every request is checked against the signed-in user’s organization and role.
• Sign-in security: one-time sign-in codes, sign-in alerts and a record of sign-ins and failed attempts. Administrators can review their organization’s users and roles.
• Restricted administrative access: server access only over a private network, with keys (no passwords), limited to staff who need it. Secrets are kept out of code.
• Network protection: firewalls that expose only the services customers use, and automatic blocking of repeated attack attempts.
• Resilience: a standby server with live copies of the main databases, and a written failover plan.
• Monitoring: automated checks of sites, servers and disk space, with alerts to staff.
• Updates: operating system security updates applied automatically. Application changes are tested before release and can be rolled back.
• People: confidentiality duties for staff and contractors, and access removed when no longer needed.

Signature Page (for signed copies)

This DPA is agreed between the Customer named below and SaaS Logic LLC, as of the date of the last signature.