Data Processing Addendum (DPA)

DRAFT TEMPLATE - NOT LEGAL ADVICE. Must be reviewed by a qualified US attorney before use. Replace every [BRACKETED] item.

This DPA forms part of the Terms of Service between [AIOS LEGAL ENTITY NAME] ("Processor" / "Service Provider") and the Customer ("Controller" / "Business").

1. Roles

Customer is the business/controller of personal information about its tenants, vendors, owners and staff. We process it only as a service provider/processor on Customer's documented instructions (the Terms, Customer's configuration of the Service, and this DPA).

2. Our obligations

• Process personal information only to provide the Service; not sell or share it; not retain, use or disclose it outside the direct business relationship (CCPA/CPRA service-provider terms).
• Ensure staff with access are bound by confidentiality.
• Maintain the security measures in Annex A.
• Notify Customer without undue delay, and within [72 hours], after becoming aware of a personal data breach.
• Assist Customer with consumer rights requests and data-protection assessments where reasonable.
• Delete or return personal information within 30 days after the end of the Service, unless law requires retention.
• Make available information needed to show compliance, and allow reasonable audits on [30 days'] notice no more than once a year.

3. Sub-processors

Customer authorizes the sub-processors listed in the Privacy Policy. We will give [30 days'] notice of new sub-processors by email; Customer may object and terminate if we cannot reasonably address the objection. We impose data-protection terms on sub-processors at least as protective as this DPA.

4. Data transfers

Data is hosted in the United States. [If serving non-US customers, add SCCs.]

5. Customer obligations

Customer is responsible for having a lawful basis and any required notices and consents (including TCPA consent for SMS) for the personal information it provides or causes to be collected.

Annex A: security measures

• TLS encryption in transit; encrypted storage volumes at the host.
• Passwords stored as salted PBKDF2-SHA256 hashes.
• Logical per-company data isolation enforced in every query, with automated tests.
• Role-based access (owner, admin, manager, agent); agents see only assigned properties.
• CSRF protection, secure HTTP-only session cookies, login rate limiting and lockout.
• Signed webhooks (Stripe, Twilio).
• Audit log of account and data actions.
• Daily backups, retained [35] days.

Annex B: processing details

• Subject matter: tenant communications and property maintenance management.
• Data subjects: tenants, prospective tenants, vendors, owners, Customer staff.
• Data categories: names, contact details, unit/property, message content, photos, maintenance details.
• Sensitive data: not intended. Customer should not upload Social Security numbers, bank details, or health information.
• Duration: term of the agreement plus 30 days.