Data Processing Addendum

Effective October 1, 2026

This Data Processing Addendum (the “DPA”) forms part of the Agreement between Job Space LLC (“Job Space”) and Customer. It applies when Job Space processes Customer Personal Data on Customer’s behalf in providing the service. Capitalized terms not defined here have the meanings given in the Terms of Service or an applicable Order.

1. Definitions

“Applicable Data Protection Law” means a law applicable to Job Space’s processing of Customer Personal Data under the Agreement. “Customer Personal Data” means personal information or personal data contained in Customer Data that Job Space processes on Customer’s behalf. “Data Subject” means the person to whom Customer Personal Data relates. “Security Incident” means unauthorized access to, acquisition of, or disclosure, alteration, destruction, or loss of Customer Personal Data in Job Space’s custody or control, including Customer Personal Data that was, or is reasonably believed to have been, acquired without authorization. It does not include unsuccessful attempts that do not compromise Customer Personal Data. “Subprocessor” means a third party engaged by Job Space to process Customer Personal Data on Customer’s behalf. “Sale” and “Sharing” have the meanings given to those terms by the California Consumer Privacy Act (Cal. Civ. Code § 1798.140(ad) and (ah)). “Sensitive Data” means personal information identified as sensitive under Applicable Data Protection Law, including sensitive personal information under the CCPA (Cal. Civ. Code § 1798.140(ae)).

2. Roles and instructions

Customer acts as controller or business, or as processor or service provider for its own client, as applicable. Job Space acts in the corresponding role as processor, service provider, contractor, or subprocessor. Customer instructs Job Space to process Customer Personal Data only to provide, secure, support, and maintain the service; perform the Agreement and Customer’s documented directions; prevent fraud and abuse; and comply with law. The Agreement, Customer’s use and configuration of the service, and authorized support requests constitute Customer’s documented instructions. Customer is responsible for the lawfulness, accuracy, and scope of those instructions and for providing required notices and obtaining required rights and consents. Customer discloses Customer Personal Data that is personal information under the California Consumer Privacy Act only for the limited and specified purposes stated in this DPA and Schedule 1.

This DPA does not apply when Job Space independently determines the purposes and means of processing personal information for account administration, billing, service security, fraud prevention, legal compliance, or its direct business relationship with Customer. Job Space processes that information as described in the Privacy Notice and Applicable Data Protection Law.

Job Space will notify Customer if, in Job Space’s reasonable opinion, an instruction violates Applicable Data Protection Law and may suspend the affected processing until the parties resolve the issue. Job Space is not required to provide legal advice or perform an instruction that would violate law or materially reduce the security of the service.

3. Processing restrictions

With respect to Customer Personal Data, Job Space will:

comply with all applicable sections of the California Consumer Privacy Act and its implementing regulations;
process it only for the specific purposes and operations stated in this DPA and Schedule 1, unless law permits or requires otherwise;
not sell it or share it for cross-context behavioral advertising;
not use it for targeted advertising, Job Space’s own marketing, or another customer’s benefit;
not retain, use, or disclose it outside the direct business relationship with Customer or for an unrelated commercial purpose;
not combine it with personal information received from another person or from Job Space’s own consumer interactions except as permitted by Applicable Data Protection Law to provide the service;
not process Sensitive Data except as strictly necessary to provide the service and only in accordance with documented Customer instructions and the limitations of Applicable Data Protection Law, including any consumer opt-out of secondary use under the CCPA;
provide the level of privacy protection required of a service provider or contractor under Applicable Data Protection Law; and
notify Customer if Job Space determines it can no longer meet an applicable obligation, after which Customer may take reasonable and appropriate steps to stop and remediate unauthorized use.
Job Space shall allow Customer to take reasonable and appropriate steps to stop and remediate unauthorized processing upon such notification, which may include terminating the affected processing and, if remediation is not possible within thirty (30) days, terminating the Agreement with respect to the affected processing.
Job Space certifies that it understands the restrictions and obligations set forth in this DPA and the California Consumer Privacy Act and will comply with them. Job Space shall not retain, use, or disclose Customer Personal Data for any purpose other than the business purposes specified in Schedule 1 and this DPA, including retaining, using, or disclosing Customer Personal Data for a commercial purpose other than providing the services specified in the Agreement.
For purposes of the Nevada Privacy of Information Collected on the Internet from Consumers Act (NRS 603A.300 et seq.), Job Space shall not make any Sale of covered information received from Customer without complying with applicable opt-out requirements.

4. Confidentiality and security

Job Space will ensure that personnel authorized to process Customer Personal Data are bound by confidentiality obligations and receive access only as needed for their duties. Job Space will maintain reasonable administrative, technical, physical, and organizational safeguards appropriate to the nature of Customer Personal Data and the risks of processing, including the measures in Schedule 2. Job Space may update those measures as technology and risks change, provided the overall protection of Customer Personal Data is not materially reduced.

5. Customer assistance

Customer is responsible for responding to Data Subjects and regulators. Taking into account the nature of processing and information available to Job Space, Job Space will provide reasonable assistance through service controls or other appropriate means with access, correction, deletion, portability, appeal, opt-out, security, breach-notification, and regulatory obligations applicable to Customer Personal Data. To the extent applicable to Customer’s use of the service, Job Space will cooperate with Customer’s California Consumer Privacy Act cybersecurity-audit and risk-assessment duties by providing all relevant information and facts in Job Space’s possession, custody, or control. Job Space will also reasonably assist Customer with applicable requirements concerning automated decisionmaking technology, including pre-use notices, opt-out requests, and access requests. Job Space will not independently respond to a consumer rights request or Data Subject access request about Customer Personal Data but will promptly notify Customer of such request and direct the consumer to make the request to Customer, unless Customer instructs it to respond directly or where applicable law requires it.

Job Space will provide reasonable assistance with verified consumer rights requests forwarded by Customer (including requests to know, access, correct, delete, and port personal information, and requests to opt out of Sale, Sharing, or automated decision-making) and will promptly forward to Customer any such request that Job Space receives. Job Space will also assist Customer in responding to consumer requests under the Nevada Privacy of Information Collected on the Internet from Consumers Act (NRS 603A.345), to the extent applicable.

6. Security incidents

Job Space will notify Customer immediately following discovery of a Security Incident involving Customer Personal Data. Job Space will not wait for a final investigation before giving available material information. The notice will describe, as information becomes reasonably available, the nature of the incident. To the extent available, the notification will also include affected data and people, likely consequences, containment and remediation measures, and a contact for follow-up. Job Space will take reasonable steps to contain, investigate, and remediate the incident and will provide information reasonably needed for Customer’s legally required notices. A notice is not an admission of fault or liability. Customer remains responsible for deciding whether and how to notify Data Subjects, regulators, or others, except where law assigns that duty directly to Job Space.

7. Subprocessors

Customer generally authorizes Job Space to use the providers identified on the current Subprocessor List. The list identifies each provider’s services, purposes, and data and describes how applicable provider location terms are determined.

Job Space will require each Subprocessor to protect Customer Personal Data through a written agreement that complies with Applicable Data Protection Law and imposes on the Subprocessor the same data-protection obligations that apply to Job Space for that processing, including every required service-provider, contractor, processor, or subprocessor term. Job Space remains responsible for its Subprocessors to the extent required by the Agreement and law.

Job Space will give Customer at least 30 days’ advance notice before authorizing a new Subprocessor to process Customer Personal Data. Customer may object during that period on reasonable, documented data-protection grounds. The parties will work in good faith on a commercially reasonable resolution. If none is available, Customer may terminate the affected service and receive a refund of prepaid fees for its unused portion. That termination and refund are Customer’s exclusive remedies for a Subprocessor objection.

8. Return and deletion

During the subscription, Customer may access or export Customer Data using available service features. At Customer’s choice, after Customer requests deletion or the subscription ends, Job Space will delete or return Customer Personal Data in accordance with Customer’s instructions and the Agreement. Eligible data may remain in active recovery systems for up to 30 days. Data in protected backups is isolated from ordinary use, removed through the applicable backup cycle, and deleted again before a restored system is returned to service. Job Space may retain limited information when law requires it or when reasonably necessary for security, fraud prevention, tax, accounting, or legal claims, subject to restricted access and deletion when the exception ends.

9. Information and assessments

On reasonable request, Job Space will provide information needed to demonstrate compliance with this DPA, which may include security summaries, policies, certifications, or independent assessment reports then available. No more than once in a 12-month period, Customer may conduct a reasonable assessment of controls relevant to Customer Personal Data. The annual limit does not apply after a Security Incident affecting Customer Personal Data or where a regulator or Applicable Data Protection Law requires an additional assessment.

To the extent required by Applicable Data Protection Law, including the California Consumer Privacy Act and applicable CPPA regulations, Job Space will cooperate with Customer’s data protection assessments, cybersecurity audits, and risk assessments by providing information reasonably necessary for Customer to conduct assessments of the processing of Customer Personal Data. Job Space will make available to Customer all information necessary to demonstrate compliance with this DPA upon reasonable request. An assessment must use an independent, qualified assessor; provide at least 30 days’ notice; occur during normal business hours; protect confidential information; avoid access to another customer’s data; and not unreasonably disrupt the service. Customer bears its assessment costs. Job Space may satisfy an assessment request with current independent reports where those reports reasonably address the requested controls. A reasonable on-site assessment remains available where the supplied materials are insufficient or Applicable Data Protection Law requires additional access.

10. Required disclosures and locations

If Job Space is required to disclose Customer Personal Data by valid legal process, judicial or regulatory order, Job Space will (a) notify Customer before disclosure unless prohibited by law, (b) have the requester seek the relevant information from Customer, (c) challenge an unlawful or overbroad request where reasonable, and (d) if it is still required to disclose Customer Personal Data after the foregoing steps, disclose only the minimum amount of Customer Personal Data sufficient to meet the legal requirements. Customer instructs Job Space and its Subprocessors to process Customer Personal Data in locations needed to provide the service and described by the applicable service configuration and provider terms. Job Space does not make a country-specific data-residency commitment unless a signed Order expressly states one.

11. General

This DPA controls over a conflicting Agreement provision only for the processing of Customer Personal Data. The Agreement’s limitations of liability apply to this DPA to the maximum extent permitted by law. Nothing in this DPA limits a right or remedy that cannot lawfully be limited. If a provision is unenforceable, it will be limited to the minimum extent necessary and the remainder will continue. This DPA ends when Job Space no longer processes Customer Personal Data, except that provisions concerning confidentiality, deletion, audits, liability, and legal obligations survive as needed to give them effect. Notices under this DPA may be sent to the Customer account administrator and to Job Space at privacy@jobspace.com or 1048 Irvine Ave #582, Newport Beach, CA 92660.

Schedule 1. Processing details

Subject matter: Customer Personal Data processed to provide the subscribed Job Space business software and related support.
Duration: The subscription term and the limited deletion, recovery, legal-retention, and dispute periods described in the Agreement and this DPA.
Frequency: Continuous or intermittent, according to Customer’s use and configuration of the service.
Nature and specific purposes: Collection, organization, hosting, storage, retrieval, display, transmission, backup, recovery, deletion, authentication, security monitoring, support, customer-directed communications, and customer-directed integrations needed to operate, secure, support, and maintain the service.
Data Subjects: Customer’s authorized users, workforce, applicants, contractors, customers, prospective customers, suppliers, job-site contacts, communication recipients, and other people whose information Customer submits.
Data categories: Names and contact details; business and account identifiers; authentication identifiers; roles and service settings; worker, customer, supplier, job, appointment, equipment, quote, invoice, purchase, billing-status, file, image, note, message, attachment, conversation, consent, suppression, workflow, address, map and geocoding query or result, location, device, network, support, security, and audit information.
Restricted data: Unless a signed Order expressly authorizes it, Customer must not submit protected health information subject to HIPAA, consumer health data, payment-card authentication data, biometric templates, genetic data, government identification numbers, or other data subject to sector-specific processing requirements that the service is not expressly designed to meet.

Schedule 2. Security measures

Governance. Assigned security and privacy responsibilities, confidentiality duties, incident-response procedures, and vendor review before a vendor processes Customer Personal Data.
Identity and access. Access controls designed to enforce least privilege, strong authentication for administrative access, and prompt removal when access is no longer needed.
Data protection. Encryption in transit and at rest using safeguards appropriate to the service, with restricted access to keys and secrets.
Application and tenant controls. Logical separation and server-side access controls appropriate to the service, input validation, bounded sessions and tokens, dependency management, and security testing for code Job Space owns.
Network and platform protection. Network access controls, web-request filtering where appropriate, environment separation, secure configuration practices, and limited administrative paths.
Logging and monitoring. Security and operational logging, restricted log access, monitoring appropriate to security and operational events, and retention based on operational, security, and legal needs.
Resilience and disposal. Recovery controls appropriate to the service, protected backups, deletion procedures, reapplication of applicable deletion obligations before a restored system returns to ordinary use, and secure disposal when retention ends.