Data Processing Addendum

This Data Processing Addendum ("DPA") is entered into by SiteAxis ("SiteAxis" or "Processor") and the business identified in the account or Order ("Customer" or "Controller" where applicable), effective the date the Customer accepts the Terms or signs an Order. It supplements the SiteAxis B2B SaaS MSA, Order Form or other specifically identified Customer Agreement ("Agreement") dated the date of the Customer's acceptance of the Terms or signed Order.

Activation and priority. The DPA governs only the Personal Data processing activities to which applicable data-protection law and this Agreement apply; role labels are functional and cannot override law. These executed annexes are part of the DPA: Annex A – Processing Details, Annex B – Security Measures, Annex C – Subprocessors, Annex D – International Transfers if activated and Annex E – Retention, Return, Export and Deletion. Statutorily mandatory transfer clauses prevail where legally required; otherwise the DPA prevails over conflicting MSA provisions for covered Personal Data.

1. Definitions and roles

1.1 Applicable Data Protection Law means each privacy or data-protection law applicable to a Party in respect of the relevant processing, which may include Canadian federal/provincial privacy laws, the EU GDPR, UK GDPR or applicable U.S. state privacy laws only to the extent actually applicable. No geographical regime is automatically incorporated merely because it appears in a drafting template.

1.2 Customer Personal Data means identifiable information within Customer Project Records or other information SiteAxis processes on Customer's documented behalf under the Agreement. It includes personal information relating to business contacts when law protects that information. It can include worker-identifying injury, medical-attention or witness information submitted through authorized safety/incident workflows as specified in Annex A.

1.3 Controller, Processor, Business, Service Provider, Contractor, Subprocessor, Data Subject, Personal Data Breach and Processing are used as defined by the applicable law, with analogous terms interpreted according to that regime. "Subcontractor" as a construction participant does not mean "Subprocessor" without an actual instruction and data-processing role.

1.4 Subject to factual role analysis, Customer generally determines the purpose and essential means of processing its Customer Project Records; SiteAxis processes those records to provide the configured Services, pursuant to documented instructions. SiteAxis may separately determine purposes and means for its own website leads, prospective sales, contractual billing, platform-wide fraud prevention, tax records, vendor administration and business operations and act as an independent controller or organization. Each context is described in Annex A and the Privacy Policy. Multi-party Project records can implicate independent or joint-controller arrangements between participating construction companies; this DPA does not pretend to resolve their statutory roles or construction-record ownership.

2. Instructions and authorized processing

2.1 SiteAxis will process Customer Personal Data only on documented Customer instructions, including the Agreement, activated product configuration, authorized administrators' actions, valid Project Collaboration Schedule and further written instructions, unless law requires otherwise. Where legally permitted, SiteAxis will notify Customer before processing required by law.

2.2 Permitted instructions include maintaining authorized project workspaces and access controls; storing, indexing and displaying project records; processing forms, attachments, schedule imports, workflows, reports, notifications and approved exports; providing secured support and administration; protecting data and service integrity; enforcing lawfully configured security restrictions; and conducting documented deletion/return actions. Optional AI analysis, other integrations or non-essential analytics require separate feature authorization, actual provider review and applicable terms.

2.3 SiteAxis will promptly inform Customer if, in its reasonable view, an instruction violates Applicable Data Protection Law, unless prohibited, and may pause the affected processing while the Parties resolve the issue. SiteAxis is not obliged to undertake an unlawful or technically unsupported action. Instructions from an authorized Project Sponsor concerning shared records are subject to other participants' legal rights, applicable legal holds and the Project Collaboration Schedule.

2.4 Customer is responsible for lawful grounds, transparency, notices, consents where required, authority to submit records, and fair processing of workers, witnesses, subcontractor staff and visitors. Customer will limit sensitive safety information to what is necessary for legitimate site/incident management. SiteAxis does not warrant that an incident-related field is suitable for all regional health or employment data regimes.

3. Personnel confidentiality, access and security

3.1 SiteAxis will limit access to Customer Personal Data to authorized personnel and approved Subprocessors that require it for performing the Services and are bound by appropriate confidentiality obligations. It will take reasonable steps to ensure such personnel are trained in relevant obligations. Emergency support access is to be justified, time-limited where possible and auditable to the extent supported by the implemented system.

3.2 SiteAxis will maintain safeguards appropriate to processing risks, as specified factually in Annex B, considering the current service architecture, tenant/company and project access boundaries, role checks, MFA gates, Supabase access policies, server authorization and secure-file delivery where verified. The completed Annex B identifies the agreed measures. Pending proposals do not constitute a certification, recovery objective or geographic restriction.

3.3 Each Party will review security measures as appropriate to risk, including for injury-related data, files and audit histories. Material reduction of an agreed measure requires advance notice where practicable and a compliant substitute. Security obligations remain subject to mandatory statutory duties and the executed Security Exhibit.

3.4 Customer will manage invitations, role changes, devices, lawful sharing decisions and offboarding for users under its authority. SiteAxis remains responsible for its own security commitments and approved processors; neither Party shifts all responsibility to the other by a blanket disclaimer.

4. Personal Data Breaches

4.1 SiteAxis will notify Customer without undue delay after becoming aware of a Personal Data Breach concerning Customer Personal Data, providing available facts and supplementary updates as reasonably ascertained. SiteAxis will give this notice within 72 hours of becoming aware of the breach. Notifications should include incident nature, affected data categories/approximate scope when known, actions taken or proposed, relevant contact and anticipated follow-up.

4.2 SiteAxis will investigate, contain and mitigate breaches within its scope; preserve proportionate incident evidence; cooperate reasonably with Customer's risk assessment; and assist Customer with mandatory regulator/data subject notifications. The Party legally responsible for a statutory report must decide whether/how to report, subject to law. Neither Party may falsely state that a fixed notice period in a generic template satisfies every jurisdiction's requirements.

4.3 Routine blocked probes, unsuccessful attempts and inconsequential events are logged/handled as security events according to applicable rules; they are not automatically a Personal Data Breach merely because the platform registered a failed request. Material incidents affecting availability or Confidential Information may also trigger separate MSA/SLA procedures.

4.4 SiteAxis will use security@siteaxis.app and Customer's designated the account administrators' email addresses as notice channels, with contingency escalation the Customer's account administrators by email.

5. Data subject requests and regulator assistance

5.1 Taking account of the nature of processing and information available, SiteAxis will provide reasonable assistance through supported methods to help Customer respond to valid access, correction, deletion, portability, restriction, objection and privacy requests where Applicable Data Protection Law requires such assistance. Customer generally controls responses concerning its project records and must verify requester identity, authority and other participants' rights.

5.2 SiteAxis will forward requests about Customer-controlled records to Customer through an appropriate designated contact unless prohibited or an emergency requires direct action; it will not disclose another company or project's data merely because one user requests an export. Operator-reviewed privacy request, manifest and deletion dry-run capabilities are not a contractual promise of immediate self-service bulk export or deletion.

5.3 SiteAxis will provide relevant information and reasonable assistance with privacy impact assessments, security inquiries and legally required regulator consultations to the extent necessary and feasible. Complex custom extracts, intrusive audits or unsupported changes may require agreed fees, except where prohibited by law or required as part of a breach remedy.

6. Subprocessors

6.1 Customer grants general authorization for SiteAxis to use Subprocessors identified and actually authorized in Annex C, subject to the applicable law. SiteAxis will conduct proportional due diligence and engage each Subprocessor under legally appropriate written confidentiality, security and data-processing obligations; it remains accountable for Subprocessor performance as required by law and this DPA.

6.2 SiteAxis will provide notice of new or replacement Subprocessors at least 30 days before the change, where feasible and as law requires, by email to the Customer's account administrators and an update to the published subprocessor list. For urgent security/reliability replacements, SiteAxis may give shorter notice with reasons and protections, subject to mandatory law. An unverified vendor in a technical design inventory is not automatically authorized in a customer-executed Annex C.

6.3 Customer may object in writing within 30 days of notice on reasonable, documented data-protection grounds. Parties will discuss mitigation in good faith. If no reasonably available mitigation is agreed, Customer may discontinue the affected service or terminate the affected Order under termination of the affected Services with a pro-rata refund of prepaid fees for the unused period, subject to law and any mandatory processing restrictions. Mere construction-company participation does not create a vendor subprocessing relationship.

6.4 A public subprocessor list, once validated and published, may be incorporated by version/hash and snapshot in Annex C; changes shall be tracked so a later list cannot silently rewrite historical contractual authorizations.

7. Cross-border processing

7.1 Customer Personal Data may be processed in jurisdictions identified in the verified Annex C and Annex D transfer map. SiteAxis will implement legally required mechanisms for restricted transfers, including appropriate contracts, risk assessment and supplementary measures when applicable. Neither Party promises Canadian-only or Québec-only residency, or an EU adequacy status, without evidence and an express Order Form commitment.

7.2 When the EU GDPR requires standard contractual clauses for a particular restricted transfer, the Parties will separately execute or explicitly incorporate by reference the complete, unmodified operative text of the appropriate European Commission SCCs with chosen module, parties, optional clauses and completed annexes. Merely linking to the Commission's website or naming the SCCs without required particulars may be insufficient. Where UK or Swiss transfers apply, the appropriate legally valid UK IDTA/Addendum or Swiss adaptations must likewise be completed. Annex D is a configuration worksheet, not a substitute for legally required instruments.

7.3 If a transfer mechanism is invalidated or becomes inadequate for a covered transfer, the Parties will seek a lawful alternative; SiteAxis may suspend only the affected transfer/service if required to avoid unlawful processing.

8. Audits and compliance information

8.1 On reasonable written request, SiteAxis will provide relevant and available information sufficient to demonstrate compliance with this DPA, including accurate security documentation, subprocessor list and descriptions of implemented practices, subject to safeguarding other customers' data, privileged information and trade secrets. SiteAxis does not currently hold a SOC 2 or ISO 27001 certification or an independent penetration-test report.

8.2 If additional audit is required by applicable law or reasonably necessary to assess an unresolved material risk, Customer may request a targeted audit following 30 days notice (except where immediate action is legally required). Parties will first consider existing independent reports (if any), interviews and a scoped virtual review; any on-site audit requires mutually agreed confidentiality, security, safety and non-disruption procedures and reasonable frequency. Mandatory audit/regulator rights are preserved.

8.3 Each Party bears its ordinary audit costs unless an executed agreement provides otherwise or law requires a different allocation. SiteAxis will reasonably address verified material deficiencies.

9. Return, retention and deletion

9.1 At termination/expiry of an applicable service and subject to Annex E, Customer may instruct SiteAxis to return available Customer Personal Data in the in-product exports (CSV/XLSX/PDF) and original uploaded files during an agreed 30-day controlled access period. Exports require authorized identity/role verification and may be restricted where another entity or law has continuing rights.

9.2 After the controlled return/retention period and subject to lawful holds and continuing multi-party Project rights, SiteAxis will delete or irreversibly anonymize eligible Customer Personal Data from active systems within 90 days after the applicable approved deletion trigger, according to Annex E. Backups roll off or undergo agreed restoration controls within 30 days, subject to lawful retention and actual provider configuration.

9.3 SiteAxis may retain covered data after termination only to the extent permitted or required by applicable law and consistent with its processing role and lawful instructions. Any retention for claims, audit, security or shared Project Records requires a documented lawful basis, a limited scope and a review period; a contractual preference alone does not displace a mandatory return or deletion obligation. To the extent feasible, Customer will be informed of categories, retention basis and anticipated review date unless barred by law.

9.4 A Customer cannot compel deletion of another organization's independent content or contractual evidence without lawful authority. Where record ownership or instructions conflict, SiteAxis may preserve the disputed items under least-access restriction pending resolution and will reasonably cooperate with authorized participants and counsel.

10. AI and automated processing

10.1 AI features are optional and off by default. They process Customer Personal Data only after a Customer administrator enables them, using the provider and region listed in Annex C (Alibaba Cloud Model Studio, United States, Virginia). Only the content needed for the requested feature is sent. Administrators can disable AI for the company or per module at any time.

10.2 SiteAxis shall not use Customer Personal Data to train its own general-purpose AI models without Customer's express prior written agreement and a lawful basis. Under the AI provider's terms, data sent through its API is not used to train its models. AI results are stored with the related record in SiteAxis.

10.3 Material AI-generated safety, scheduling, commercial or legal conclusions require human validation; automated outputs do not replace expert judgment or Customer's regulatory obligations.

11. Liability and miscellaneous

11.1 Liability, defence and indemnity under this DPA are governed by the MSA's completed and approved liability clauses, except mandatory law or statutory transfer instruments control. No vague "higher standard" clause may accidentally waive legally mandatory SCC protections.

11.2 This DPA remains effective for the duration SiteAxis processes covered Customer Personal Data and continues as necessary to govern lawfully retained data. Changes affecting customer rights, security, subprocessors or transfer safeguards require the notice or execution mechanism specified by applicable law and the Agreement.

11.3 Each Party shall designate the contacts identified below and keep them current. The Parties may sign electronic counterparts where enforceable. Invalidity of one provision does not displace statutory minimum terms or the complete operative SCCs, if applicable.

Execution

Annexes A to E are part of this DPA. Annex D applies only to transfers that require it.

Annexes

• Annex A — Processing details
• Annex B — Security measures
• Annex C — Subprocessors
• Annex D — International transfers
• Annex E — Retention and exit