Legal

Data Processing Addendum (DPA)

Last updated: July 27, 2026

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Falcon Tech ("Falcon Tech") and the Operator and applies where Falcon Tech processes End Customer Personal Information on the Operator's behalf. It supports the Operator's compliance with applicable data protection laws, including the California Consumer Privacy Act (CCPA/CPRA) and, where applicable, the EU/UK General Data Protection Regulation (GDPR).

If there is a conflict between this DPA and the Terms of Service on the subject of data protection, this DPA controls.

1. Roles of the parties

The Operator is the "Controller" / "Business" with respect to End Customer Personal Information it enters into or generates within the Services.
Falcon Tech is the "Processor" / "Service Provider" and processes End Customer Personal Information only on the Operator's documented instructions to provide the Services.

The Operator's use of the Services and its configuration choices constitute its instructions. The Operator is responsible for having a lawful basis and any required notices/consents to provide End Customer Personal Information to Falcon Tech.

2. Scope of processing (Annex)

Subject matter: provision of the Services described in the Terms.
Duration: for the term of the Terms, plus any limited retention described in the Privacy Policy.
Nature and purpose: hosting, storing, transmitting, organizing, displaying, and otherwise processing End Customer Personal Information to operate the Services (e.g., quotes, invoices, scheduling, communications initiated by the Operator, accounting sync the Operator enables).
Types of personal information: End Customer names, postal addresses, email addresses, phone numbers, property details, service and job records, photos, quote/invoice/payment-status data, and message content the Operator creates.
Categories of data subjects: the Operator's own customers and prospects.

3. Falcon Tech's obligations as Processor / Service Provider

Falcon Tech will:

3.1 Instructions. Process End Customer Personal Information only on the Operator's documented instructions, including as configured through the Services, unless required to act otherwise by law (in which case it will inform the Operator unless legally prohibited).

3.2 No sale; limited use. Not sell or "share" End Customer Personal Information, and not retain, use, or disclose it for any purpose other than providing the Services (or as otherwise permitted for a service provider under applicable law). Falcon Tech will not combine End Customer Personal Information with data from other sources except as permitted by law to provide the Services. Falcon Tech certifies it understands and will comply with these restrictions.

3.3 Confidentiality. Ensure that personnel authorized to process End Customer Personal Information are bound by confidentiality obligations.

3.4 Security. Implement and maintain reasonable and appropriate technical and organizational measures designed to protect End Customer Personal Information, including encryption in transit and at rest, tenant isolation via database row-level security, and access controls (see Privacy Policy, "How we protect information").

3.5 Assistance. Taking into account the nature of the processing, provide reasonable assistance to the Operator in (a) responding to data-subject requests (access, deletion, correction, portability, opt-out), and (b) meeting the Operator's security, breach-notification, and (where applicable) data-protection- impact-assessment obligations. The Services' self-service tools (edit, delete, export) are a primary means of this assistance.

3.6 Breach notification. Notify the Operator without undue delay after becoming aware of a personal-data breach affecting End Customer Personal Information, with information reasonably available to help the Operator meet its obligations.

3.7 Deletion or return. On termination of the Services, delete or return End Customer Personal Information as described in the Privacy Policy and Terms, except where retention is required by law. Operators may export their data before closure.

3.8 Records and audits. Make available information reasonably necessary to demonstrate compliance with this DPA and, on reasonable prior written request and subject to confidentiality, respond to the Operator's reasonable audit inquiries (which may be satisfied through documentation and provider certifications).

4. Subprocessors

4.1 Authorization. The Operator authorizes Falcon Tech to engage subprocessors to provide the Services. Current subprocessors are listed in subprocessors.md (e.g., cloud hosting/database, payment processing, accounting sync, SMS/email delivery, mapping, subscription billing, error monitoring).

4.2 Obligations. Falcon Tech will impose data-protection obligations on each subprocessor that are substantially consistent with this DPA and remains responsible for its subprocessors' performance.

4.3 Changes. Falcon Tech may add or replace subprocessors and will update the subprocessors list; where required by law, it will provide a mechanism for notice and a reasonable opportunity to object on legitimate data-protection grounds.

5. International transfers

Where End Customer Personal Information is transferred across borders, Falcon Tech will rely on an appropriate transfer mechanism recognized under applicable law. The Services are operated primarily in the United States.

6. CCPA/CPRA service-provider terms

With respect to Personal Information subject to the CCPA/CPRA, the parties agree that Falcon Tech is a Service Provider. Falcon Tech shall not: (a) sell or share the Personal Information; (b) retain, use, or disclose it for any purpose other than the business purposes specified in the Terms, including outside the direct business relationship; or (c) combine it with Personal Information received from others, except as permitted by the CCPA/CPRA. Falcon Tech certifies that it understands and will comply with these restrictions.

7. Liability

Each party's liability under this DPA is subject to the limitations of liability in the Terms of Service.

8. Term

This DPA is effective for as long as Falcon Tech processes End Customer Personal Information on the Operator's behalf and survives termination until such data is deleted or returned.