Data Processing Addendum

This Data Processing Addendum ("DPA") is entered into by To be confirmed: legal entity name ("SiteAxis" or "Processor") and To be confirmed: customer legal name ("Customer" or "Controller" where applicable), effective To be confirmed: dpa effective date. It supplements the SiteAxis B2B SaaS MSA, Order Form or other specifically identified Customer Agreement ("Agreement") dated To be confirmed: agreement effective date.

Activation and priority. The DPA governs only the Personal Data processing activities to which applicable data-protection law and this Agreement apply; role labels are functional and cannot override law. These executed annexes are part of the DPA: Annex A – Processing Details, Annex B – Security Measures, Annex C – Subprocessors, Annex D – International Transfers if activated and Annex E – Retention, Return, Export and Deletion. Statutorily mandatory transfer clauses prevail where legally required; otherwise the DPA prevails over conflicting MSA provisions for covered Personal Data.

1. Definitions and roles

1.1 Applicable Data Protection Law means each privacy or data-protection law applicable to a Party in respect of the relevant processing, which may include Canadian federal/provincial privacy laws, the EU GDPR, UK GDPR or applicable U.S. state privacy laws only to the extent actually applicable. No geographical regime is automatically incorporated merely because it appears in a drafting template.

1.2 Customer Personal Data means identifiable information within Customer Project Records or other information SiteAxis processes on Customer's documented behalf under the Agreement. It includes personal information relating to business contacts when law protects that information. It can include worker-identifying injury, medical-attention or witness information submitted through authorized safety/incident workflows as specified in Annex A.

1.3 Controller, Processor, Business, Service Provider, Contractor, Subprocessor, Data Subject, Personal Data Breach and Processing are used as defined by the applicable law, with analogous terms interpreted according to that regime. "Subcontractor" as a construction participant does not mean "Subprocessor" without an actual instruction and data-processing role.

1.4 Subject to factual role analysis, Customer generally determines the purpose and essential means of processing its Customer Project Records; SiteAxis processes those records to provide the configured Services, pursuant to documented instructions. SiteAxis may separately determine purposes and means for its own website leads, prospective sales, contractual billing, platform-wide fraud prevention, tax records, vendor administration and business operations and act as an independent controller or organization. Each context is described in Annex A and the Privacy Policy. Multi-party Project records can implicate independent or joint-controller arrangements between participating construction companies; this DPA does not pretend to resolve their statutory roles or construction-record ownership.

2. Instructions and authorized processing

2.1 SiteAxis will process Customer Personal Data only on documented Customer instructions, including the Agreement, activated product configuration, authorized administrators' actions, valid Project Collaboration Schedule and further written instructions, unless law requires otherwise. Where legally permitted, SiteAxis will notify Customer before processing required by law.

2.2 Permitted instructions include maintaining authorized project workspaces and access controls; storing, indexing and displaying project records; processing forms, attachments, schedule imports, workflows, reports, notifications and approved exports; providing secured support and administration; protecting data and service integrity; enforcing lawfully configured security restrictions; and conducting documented deletion/return actions. Optional AI analysis, other integrations or non-essential analytics require separate feature authorization, actual provider review and applicable terms.

2.3 SiteAxis will promptly inform Customer if, in its reasonable view, an instruction violates Applicable Data Protection Law, unless prohibited, and may pause the affected processing while the Parties resolve the issue. SiteAxis is not obliged to undertake an unlawful or technically unsupported action. Instructions from an authorized Project Sponsor concerning shared records are subject to other participants' legal rights, applicable legal holds and the Project Collaboration Schedule.

2.4 Customer is responsible for lawful grounds, transparency, notices, consents where required, authority to submit records, and fair processing of workers, witnesses, subcontractor staff and visitors. Customer will limit sensitive safety information to what is necessary for legitimate site/incident management. SiteAxis does not warrant that an incident-related field is suitable for all regional health or employment data regimes.

3. Personnel confidentiality, access and security

3.1 SiteAxis will limit access to Customer Personal Data to authorized personnel and approved Subprocessors that require it for performing the Services and are bound by appropriate confidentiality obligations. It will take reasonable steps to ensure such personnel are trained in relevant obligations. Emergency support access is to be justified, time-limited where possible and auditable to the extent supported by the implemented system.

3.2 SiteAxis will maintain safeguards appropriate to processing risks, as specified factually in Annex B, considering the current service architecture, tenant/company and project access boundaries, role checks, MFA gates, Supabase access policies, server authorization and secure-file delivery where verified. The completed Annex B identifies the agreed measures. Pending proposals do not constitute a certification, recovery objective or geographic restriction.

3.3 Each Party will review security measures as appropriate to risk, including for injury-related data, files and audit histories. Material reduction of an agreed measure requires advance notice where practicable and a compliant substitute. Security obligations remain subject to mandatory statutory duties and the executed Security Exhibit.

3.4 Customer will manage invitations, role changes, devices, lawful sharing decisions and offboarding for users under its authority. SiteAxis remains responsible for its own security commitments and approved processors; neither Party shifts all responsibility to the other by a blanket disclaimer.

4. Personal Data Breaches

4.1 SiteAxis will notify Customer without undue delay after becoming aware of a Personal Data Breach concerning Customer Personal Data, providing available facts and supplementary updates as reasonably ascertained. If a separately verified and executed notice target applies, it is To be confirmed: security incident notice hours hours from the defined triggering event; this blank is a required operational/legal decision and no fixed-hour commitment is effective until completed. Notifications should include incident nature, affected data categories/approximate scope when known, actions taken or proposed, relevant contact and anticipated follow-up.

4.2 SiteAxis will investigate, contain and mitigate breaches within its scope; preserve proportionate incident evidence; cooperate reasonably with Customer's risk assessment; and assist Customer with mandatory regulator/data subject notifications. The Party legally responsible for a statutory report must decide whether/how to report, subject to law. Neither Party may falsely state that a fixed notice period in a generic template satisfies every jurisdiction's requirements.

4.3 Routine blocked probes, unsuccessful attempts and inconsequential events are logged/handled as security events according to applicable rules; they are not automatically a Personal Data Breach merely because the platform registered a failed request. Material incidents affecting availability or Confidential Information may also trigger separate MSA/SLA procedures.

4.4 SiteAxis will use To be confirmed: security email and Customer's designated To be confirmed: customer security contact as notice channels, with contingency escalation To be confirmed: incident escalation channel. These must be validated and monitored before signature.

5. Data subject requests and regulator assistance

5.1 Taking account of the nature of processing and information available, SiteAxis will provide reasonable assistance through supported methods to help Customer respond to valid access, correction, deletion, portability, restriction, objection and privacy requests where Applicable Data Protection Law requires such assistance. Customer generally controls responses concerning its project records and must verify requester identity, authority and other participants' rights.

5.2 SiteAxis will forward requests about Customer-controlled records to Customer through an appropriate designated contact unless prohibited or an emergency requires direct action; it will not disclose another company or project's data merely because one user requests an export. Operator-reviewed privacy request, manifest and deletion dry-run capabilities are not a contractual promise of immediate self-service bulk export or deletion.

5.3 SiteAxis will provide relevant information and reasonable assistance with privacy impact assessments, security inquiries and legally required regulator consultations to the extent necessary and feasible. Complex custom extracts, intrusive audits or unsupported changes may require agreed fees, except where prohibited by law or required as part of a breach remedy.

6. Subprocessors

6.1 Customer grants general authorization for SiteAxis to use Subprocessors identified and actually authorized in Annex C, subject to the applicable law. SiteAxis will conduct proportional due diligence and engage each Subprocessor under legally appropriate written confidentiality, security and data-processing obligations; it remains accountable for Subprocessor performance as required by law and this DPA.

6.2 SiteAxis will provide notice of new or replacement Subprocessors at least To be confirmed: subprocessor notice days days before the change, where feasible and as law requires, by To be confirmed: subprocessor notice method. For urgent security/reliability replacements, SiteAxis may give shorter notice with reasons and protections, subject to mandatory law. An unverified vendor in a technical design inventory is not automatically authorized in a customer-executed Annex C.

6.3 Customer may object in writing within To be confirmed: subprocessor objection days days of notice on reasonable, documented data-protection grounds. Parties will discuss mitigation in good faith. If no reasonably available mitigation is agreed, Customer may discontinue the affected service or terminate the affected Order under To be confirmed: subprocessor objection remedy, subject to law and any mandatory processing restrictions. Mere construction-company participation does not create a vendor subprocessing relationship.

6.4 A public subprocessor list, once validated and published, may be incorporated by version/hash and snapshot in Annex C; changes shall be tracked so a later list cannot silently rewrite historical contractual authorizations.

7. Cross-border processing

7.1 Customer Personal Data may be processed in jurisdictions identified in the verified Annex C and Annex D transfer map. SiteAxis will implement legally required mechanisms for restricted transfers, including appropriate contracts, risk assessment and supplementary measures when applicable. Neither Party promises Canadian-only or Québec-only residency, or an EU adequacy status, without evidence and an express Order Form commitment.

7.2 When the EU GDPR requires standard contractual clauses for a particular restricted transfer, the Parties will separately execute or explicitly incorporate by reference the complete, unmodified operative text of the appropriate European Commission SCCs with chosen module, parties, optional clauses and completed annexes. Merely linking to the Commission's website or naming the SCCs without required particulars may be insufficient. Where UK or Swiss transfers apply, the appropriate legally valid UK IDTA/Addendum or Swiss adaptations must likewise be completed. Annex D is a configuration worksheet, not a substitute for legally required instruments.

7.3 If a transfer mechanism is invalidated or becomes inadequate for a covered transfer, the Parties will seek a lawful alternative; SiteAxis may suspend only the affected transfer/service if required to avoid unlawful processing.

8. Audits and compliance information

8.1 On reasonable written request, SiteAxis will provide relevant and available information sufficient to demonstrate compliance with this DPA, including accurate security documentation, subprocessor list and descriptions of implemented practices, subject to safeguarding other customers' data, privileged information and trade secrets. No SOC 2, ISO certification or independent penetration-test report is represented by this draft.

8.2 If additional audit is required by applicable law or reasonably necessary to assess an unresolved material risk, Customer may request a targeted audit following To be confirmed: audit notice days days notice (except where immediate action is legally required). Parties will first consider existing independent reports (if any), interviews and a scoped virtual review; any on-site audit requires mutually agreed confidentiality, security, safety and non-disruption procedures and reasonable frequency. Mandatory audit/regulator rights are preserved.

8.3 Each Party bears its ordinary audit costs unless an executed agreement provides otherwise or law requires a different allocation. SiteAxis will reasonably address verified material deficiencies.

9. Return, retention and deletion

9.1 At termination/expiry of an applicable service and subject to Annex E, Customer may instruct SiteAxis to return available Customer Personal Data in To be confirmed: customer exit supported formats during an agreed To be confirmed: termination export window days-day controlled access period. Exports require authorized identity/role verification and may be restricted where another entity or law has continuing rights. This process must be supported operationally before the schedule becomes binding.

9.2 After the controlled return/retention period and subject to lawful holds and continuing multi-party Project rights, SiteAxis will delete or irreversibly anonymize eligible Customer Personal Data from active systems within To be confirmed: primary data deletion days days after the applicable approved deletion trigger, according to Annex E. Backups roll off or undergo agreed restoration controls within To be confirmed: backup max age days days, subject to lawful retention and actual provider configuration. These are deliberately unfilled and must not be represented as existing system capability.

9.3 SiteAxis may retain covered data after termination only to the extent permitted or required by applicable law and consistent with its processing role and lawful instructions. Any retention for claims, audit, security or shared Project Records requires a documented lawful basis, a limited scope and a review period; a contractual preference alone does not displace a mandatory return or deletion obligation. To the extent feasible, Customer will be informed of categories, retention basis and anticipated review date unless barred by law.

9.4 A Customer cannot compel deletion of another organization's independent content or contractual evidence without lawful authority. Where record ownership or instructions conflict, SiteAxis may preserve the disputed items under least-access restriction pending resolution and will reasonably cooperate with authorized participants and counsel.

10. AI and automated processing

10.1 AI services are optional and feature-gated. The Parties will not treat potential AI functionality as an authorization to submit confidential schedules, inspection photos, injury details or other Personal Data to an external model. AI processing requires expressly enabled service, approved provider/region, verified privacy terms and any activated AI Addendum.

10.2 SiteAxis shall not use Customer Personal Data to train its own general-purpose AI models without Customer's express prior written agreement and a lawful basis. No third-party model-training authorization is implied by use of the service. Any binding commitment regarding third-party model training, retention, opt-out settings or provider logging requires verified vendor contractual evidence in Annex C and the AI Addendum; until then, processing requiring such promises must not be activated for real Customer Personal Data.

10.3 Material AI-generated safety, scheduling, commercial or legal conclusions require human validation; automated outputs do not replace expert judgment or Customer's regulatory obligations.

11. Liability and miscellaneous

11.1 Liability, defence and indemnity under this DPA are governed by the MSA's completed and approved liability clauses, except mandatory law or statutory transfer instruments control. No vague "higher standard" clause may accidentally waive legally mandatory SCC protections.

11.2 This DPA remains effective for the duration SiteAxis processes covered Customer Personal Data and continues as necessary to govern lawfully retained data. Changes affecting customer rights, security, subprocessors or transfer safeguards require the notice or execution mechanism specified by applicable law and the Agreement.

11.3 Each Party shall designate the contacts identified below and keep them current. The Parties may sign electronic counterparts where enforceable. Invalidity of one provision does not displace statutory minimum terms or the complete operative SCCs, if applicable.

Execution

Annex status: A [must complete] · B [must verify] · C [must validate] · D [activate only if needed] · E [must operationalize]. All unresolved fields must be completed and the applicable annexes agreed before execution.

Draft annexes

• Annex A — Processing details
• Annex B — Security measures
• Annex C — Subprocessors
• Annex D — International transfers
• Annex E — Retention and exit