Data Processing Addendum (DPA)

1. Definitions and Roles

Capitalized terms used but not defined in this DPA have the meanings given in the Terms of Service or applicable Data Protection Laws (including the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act, "CCPA").

• Customer Personal Information: Any personal information or personal data relating to an identified or identifiable homeowner, consumer, employee, or subcontractor submitted to or processed by the Service on behalf of Contractor.
• Roles of the Parties: Contractor is the Business or Controller of Customer Personal Information. Let's Get Quoted is a Service Provider or Processor acting solely on Contractor's documented instructions.

2. Scope and Purpose of Processing

Let's Get Quoted processes Customer Personal Information only on behalf of Contractor and in accordance with Contractor's documented instructions, which include the Terms of Service, this DPA, and the configuration and use of features in the Service (including scheduling, quotes, invoices, payments, SMS/email messaging, AI voice reception, and job records).

The duration of processing corresponds to the term of Contractor's account plus any retention required for legal, accounting, tax, security, or regulatory obligations.

3. Service Provider Statutory Restrictions (CCPA / US State Privacy Laws)

Pursuant to the CCPA and applicable US state privacy laws, Let's Get Quoted expressly agrees, certifies, and understands that it:

• Will not sell or share Customer Personal Information (as those terms are defined under the CCPA).
• Will not retain, use, or disclose Customer Personal Information for any purpose other than for the business purposes specified in the Terms of Service and this DPA, or as otherwise permitted by applicable law.
• Will not retain, use, or disclose Customer Personal Information outside of the direct business relationship between Let's Get Quoted and Contractor.
• Will not combine Customer Personal Information received from, or on behalf of, Contractor with personal information received from, or on behalf of, another person or source, except to the extent permitted under applicable service-provider regulations (such as fraud detection, security, or platform maintenance).
• Will notify Contractor immediately if Let's Get Quoted determines that it can no longer meet its obligations under applicable Data Protection Laws.

4. Confidentiality and Security Measures

Let's Get Quoted ensures that persons authorized to process Customer Personal Information (including employees, contractors, and subprocessors) are bound by appropriate obligations of confidentiality.

Let's Get Quoted maintains reasonable technical, physical, and administrative security measures designed to protect Customer Personal Information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, appropriate to the nature of the data processed.

5. Subprocessors

Contractor grants Let's Get Quoted general authorization to engage third-party subprocessors to support the provision of the Service (including cloud hosting, database infrastructure, telephony and messaging carriers, AI inference engines, and payment processors).

Let's Get Quoted imposes contractual data-protection terms on each subprocessor that are no less restrictive than those in this DPA. Let's Get Quoted remains responsible for the performance of its subprocessors' obligations.

6. Security Incident Notification

Let's Get Quoted will notify Contractor without undue delay upon confirming a Security Incident affecting Customer Personal Information. Let's Get Quoted will take reasonable steps to mitigate the effects of the incident and provide Contractor with information reasonably necessary for Contractor to meet its legal breach notification obligations.

7. Data Subject Requests and Assistance

Taking into account the nature of the processing, Let's Get Quoted provides tools within the Service (including data export, update, and suppression functions) to assist Contractor in responding to consumer requests to exercise their rights under Data Protection Laws (such as requests to access, correct, or delete personal information).

If Let's Get Quoted receives a request directly from a Contractor's customer, Let's Get Quoted will advise the consumer to submit their request directly to the Contractor.

8. Deletion and Return of Customer Data

Upon termination of Contractor's account, Let's Get Quoted will delete or de-identify Customer Personal Information in accordance with its routine data deletion cycles, except to the extent that retention is required by applicable laws, accounting rules, tax regulations, anti-fraud measures, or security audits.

9. Audits and Compliance Verification

Upon Contractor's reasonable written request, Let's Get Quoted will make available information reasonably necessary to demonstrate compliance with this DPA, which may include security summaries, third-party attestations, or responses to written security questionnaires.

10. Precedence

In the event of any conflict between this DPA and the Terms of Service regarding the processing of Customer Personal Information, this DPA will control.