Data Processing Addendum

This Data Processing Addendum (the “DPA”) supplements and forms part of the Terms of Service (the “Terms”) between you and Updrone, Inc. (“Updrone,” “we,” “us,” or “our”) and applies to the extent Updrone processes personal data contained in Tenant Content on your behalf in the course of providing the Service. Capitalized terms not defined here have the meanings given in the Terms. If there is any conflict between this DPA and the Terms with respect to the processing of personal data, this DPA controls.

You — the tenant business — are the data controller and the professional of record for your own operations, and you determine the purposes and means of the processing you carry out through the Service. Updrone acts as a data processor and processes personal data contained in Tenant Content solely to provide, secure, support, and maintain the Service for you. Where you use the Service to process personal data relating to your own end customers, you are the controller of that personal data and Updrone is your processor. Nothing in this DPA makes Updrone a controller of Tenant Content or a professional of record for any flight, measurement, or deliverable.

The subject matter of the processing is the provision of the Service as described in the Terms. The duration of the processing is the term of your subscription, together with any limited period thereafter during which the Service supports export or deletion of Tenant Content as described in Section 9.

The nature and purpose of the processing is the hosting, storage, and transmission of Tenant Content and the operation of the Service’s features on your instructions — including capture-processing, 3D scene and deliverable generation, customer relationship management, scheduling, payments facilitation, and messaging. The categories of data subjects are the individuals whose personal data you include in Tenant Content, which typically means your staff and team members and your end customers. The categories of personal data are those you choose to submit, which may include contact details; imagery, scenes, and measurements that may depict people or their property; and project, scheduling, and payment metadata. You are responsible for the categories of data subjects and personal data you elect to process through the Service and for not submitting special categories of personal data except as the Service is designed to support.

Updrone will process personal data contained in Tenant Content only on your documented instructions, including with regard to international transfers, unless required to do otherwise by applicable law — in which case Updrone will inform you of that requirement before processing, unless the law prohibits such notice. Your instructions are set out in this DPA, the Terms, and your configuration and use of the Service; your use of the Service’s features constitutes an instruction to process personal data as necessary to provide those features. Updrone will inform you if, in its opinion, an instruction infringes applicable data-protection law.

Updrone ensures that personnel authorized to process personal data are bound by appropriate obligations of confidentiality. Updrone implements and maintains appropriate technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access — including encryption of personal data in transit and at rest, scoped and role-based access controls, logical isolation of each tenant’s data from other tenants, and logging and monitoring of access to the systems that store Tenant Content. Updrone does not sell personal data and does not process personal data for its own independent purposes or for advertising.

You authorize Updrone to engage the subprocessors listed at /subprocessors to process personal data in connection with the Service. Updrone imposes on each subprocessor, by written contract, data-protection obligations that are substantially equivalent to those set out in this DPA, and Updrone remains responsible for the performance of each subprocessor’s obligations to the same extent Updrone would be responsible if performing the services directly.

Updrone will give you notice of any intended addition or replacement of a subprocessor — for example, by updating the list at /subprocessors and, where you have subscribed, by notifying you — before that subprocessor begins processing personal data. You may object to a new subprocessor on reasonable data-protection grounds within a reasonable period after notice; if you do, we will work with you in good faith to address your concern, and if we cannot, you may as your exclusive remedy discontinue the affected part of the Service.

Taking into account the nature of the processing, Updrone will assist you by appropriate technical and organizational measures, insofar as this is possible, in fulfilling your obligation to respond to requests from data subjects seeking to exercise their rights under applicable data-protection law. Because you are the controller and configure the Service, you are generally able to access, correct, delete, or export the personal data in your workspace using the Service’s features.

If Updrone receives a request from a data subject relating to personal data Updrone processes on your behalf, Updrone will, to the extent legally permitted, forward the request to you and will not respond to it directly except on your documented instructions or as required by applicable law.

Updrone will notify you without undue delay after becoming aware of a personal data breach affecting personal data processed on your behalf. The notification will include the information reasonably available to Updrone that you need to meet any obligation to report the breach or notify affected data subjects, and Updrone will provide further information as it becomes available.

Updrone will take reasonable steps to identify, investigate, and mitigate the effects of a personal data breach and will cooperate with you in good faith. Updrone’s notification of or response to a breach is not an acknowledgment of fault or liability.

Where processing under this DPA involves the transfer of personal data across borders — including from the European Economic Area, the United Kingdom, or Switzerland to a country that has not received an adequacy decision — Updrone will rely on an appropriate transfer mechanism recognized under applicable data-protection law, such as the Standard Contractual Clauses, which are incorporated into this DPA by reference where they apply.

You and Updrone will each do what is reasonably necessary to give effect to the applicable transfer mechanism and to keep it in place for the duration of the processing.

Updrone will make available to you information reasonably necessary to demonstrate compliance with its obligations under this DPA and will allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate.

Audits are subject to reasonable confidentiality obligations, reasonable advance notice and scheduling, and reasonable scope and frequency, and must be conducted in a manner that does not disrupt the Service or compromise the security or confidentiality of other tenants’ data. Where available and reasonably sufficient to address your request, Updrone may satisfy this obligation by providing existing reports, documentation of its practices, or written responses to your reasonable questions.

On expiry or termination of the Service, at your choice, Updrone will return or delete the personal data contained in Tenant Content as supported by the Service. For a limited period after termination, you may export your Tenant Content using the Service’s features, as described in the Terms; after that period, Updrone may delete it in the ordinary course.

The return or deletion obligation is subject to any personal data Updrone is required to retain by applicable law, which it will continue to protect in accordance with this DPA for as long as it is retained, and to personal data residing in routine backups, which are not immediately purged but age out and are overwritten on a rolling schedule.

Each party’s liability arising out of or related to this DPA, whether in contract, tort, or under any other theory of liability, is subject to the exclusions and limitations of liability set out in the Terms, and any reference in the Terms to the liability of a party means the aggregate liability of that party under the Terms and this DPA together.

Questions about this DPA, or requests to put in place an applicable transfer mechanism, can be sent to support@updrone.com. Privacy questions can be directed to support@updrone.com, and security matters to support@updrone.com.