Data Processing Addendum

1. Introduction and Scope

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Verdic Systems, Inc. ("Data Processor", "we", or "us") and the Customer ("Data Controller" or "you"). It reflects the parties' agreement with regard to the processing of Personal Data in connection with the Blueprint platform.

By using our services, the Customer agrees to this DPA. In the event of a conflict between the Terms of Service and this DPA, this DPA shall govern regarding the processing of Personal Data.

2. Roles of the Parties

For the purposes of applicable data protection laws (including the GDPR and CCPA/CPRA), the Customer acts as the Data Controller. The Customer determines the purposes and means of processing Personal Data, including deciding which employees or third parties to invite as users to the platform.

Verdic Systems, Inc. acts as the Data Processor. We will only process Personal Data on documented instructions from the Customer, including providing the Blueprint platform services, preventing or addressing technical issues, or as required by law.

3. Customer Responsibilities

As the Data Controller, you are solely responsible for:

• Ensuring that you have a lawful basis to collect and process the Personal Data submitted to our platform.
• Providing all necessary notices to, and obtaining all necessary consents from, your end-users (employees, contractors, or clients).
• Handling and responding to any data subject requests (such as the right to access, delete, or correct data) initiated by your end-users.

4. Verdic Systems Responsibilities

As the Data Processor, we agree to:

• Confidentiality: Ensure that our personnel authorized to process Personal Data have committed themselves to confidentiality.
• Security: Implement and maintain appropriate technical and organizational measures (including our "Air Gap" data policy) to protect Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, or damage.
• Assistance: Reasonably assist you, taking into account the nature of the processing, in fulfilling your obligation to respond to data subject requests. If we receive a request directly from your end-user, we will promptly forward it to you and will not respond to the end-user directly without your authorization.

5. Sub-processors

You authorize us to engage third-party sub-processors (such as our database hosts and payment processors) to assist in providing the services. We remain fully liable to you for the performance of our sub-processors' data protection obligations.

6. Data Deletion and Retention

Upon termination or cancellation of your account, you instruct us to securely delete or anonymize your tenant database, including all Personal Data contained within, in accordance with our standard data retention policies (typically within 30 days of cancellation). We may retain certain data only to the extent required by applicable law (such as financial records).