Data Processing Addendum

"Customer Personal Data" means personal information (as defined in the CCPA and other US state privacy laws) or personal data (as defined in the GDPR and UK GDPR) that Customer or its users put into the Service, or that the Service collects for Customer — for example about Customer's officers, staff, applicants, clients and members of the public. "Data Protection Laws" means the California Consumer Privacy Act as amended (Cal. Civ. Code §1798.100 et seq.) and its regulations (Cal. Code Regs. tit. 11 §7000 et seq.) ("CCPA"), the comprehensive privacy laws of other US states, and, where they apply, the GDPR (Regulation (EU) 2016/679) and UK GDPR.

For Customer Personal Data, Customer is the "business" / "controller" and RapidReady is the "service provider" / "processor". RapidReady is a controller only for its own account, billing, sign-in security and website data, which our Privacy Policy covers.

We process Customer Personal Data only on Customer's documented instructions, including for transfers, unless the law requires otherwise (in which case we tell you first unless the law forbids it). Your instructions are: the Terms, this DPA, and your use and configuration of the Service's features. We will tell you if we believe an instruction breaks Data Protection Laws (GDPR Art. 28(3)(a) and 28(3) final paragraph; Va. Code §59.1-579(B); Colo. Rev. Stat. §6-1-1305(3)).

Details of the processing (subject matter, duration, nature and purpose, types of data and categories of people) are in Annex 1.

For Customer Personal Data subject to the CCPA (Cal. Civ. Code §1798.100(d), §1798.140(ag); Cal. Code Regs. tit. 11 §7051(a)):

1. No selling or sharing. We will not sell or share Customer Personal Data (§7051(a)(1)).
2. Limited, specified business purposes. We process Customer Personal Data only for these business purposes: providing, hosting, securing, supporting and maintaining the Service for Customer; sending the messages and alerts Customer's configuration calls for; detecting security incidents and protecting against fraud or illegal activity; debugging and repair; and building or improving the quality of the Service, provided we do not build profiles to use for another business or correct or augment data acquired from another source (§7051(a)(2); §7050(a)).
3. No other use. We will not retain, use or disclose Customer Personal Data for any purpose (including any commercial purpose) other than those business purposes, or as the CCPA otherwise permits (§7051(a)(3)).
4. Only within our relationship. We will not retain, use or disclose Customer Personal Data outside the direct business relationship between RapidReady and Customer (§7051(a)(4)).
5. No combining. We will not combine Customer Personal Data with personal information we receive from or on behalf of another person, or collect from our own interactions with consumers, except as §7050(a) permits (§7051(a)(5)).
6. Compliance and same level of protection. We will comply with the obligations the CCPA places on service providers and provide the same level of privacy protection the CCPA requires of businesses, including reasonable security under Cal. Civ. Code §1798.81.5 (§7051(a)(6)).
7. Your right to check. You may take reasonable and appropriate steps to make sure we use Customer Personal Data consistently with your CCPA obligations, including the information and assessments in section 9 (§7051(a)(7)).
8. We tell you if we cannot comply. We will notify you within 5 business days if we determine we can no longer meet our obligations under the CCPA (§7051(a)(8)).
9. You can stop and fix unauthorized use. On notice, you may take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data, including suspending our processing of the affected data (§7051(a)(9)).
10. Consumer requests. You will tell us about any consumer request you need our help with and give us the information needed to comply (§7051(a)(10)); we will help as set out in section 6.
11. Subcontractors. We engage other service providers and contractors only under a written contract with obligations at least as protective as these, and we tell you about them (Annex 3) (Cal. Civ. Code §1798.140(ag)(2)).
12. De-identified data. Where we de-identify Customer Personal Data to improve the Service (as the Terms and Privacy Policy describe), we take reasonable measures so it cannot be associated with a person or household, publicly commit to keep it de-identified and not to re-identify it, and contractually require any recipient to do the same (Cal. Civ. Code §1798.140(m)). Customer instructs us to do this as part of providing the Service.

1. Instructions — section 2.
2. Confidentiality — everyone we authorize to process Customer Personal Data is bound by confidentiality (contract or statutory duty).
3. Security — we implement the technical and organizational measures in Annex 2, appropriate to the risk (Art. 32).
4. Subprocessors — Customer gives general authorization to the subprocessors in Annex 3. We give at least 30 days' notice of a new or replacement subprocessor by updating Annex 3 and emailing account owners. You may object on reasonable data-protection grounds within that period; we will try to resolve it, and if we cannot, you may end the affected part of the Service and receive a pro-rata refund of prepaid fees for it. We impose the same data-protection obligations on each subprocessor by contract and remain responsible for its performance (Art. 28(2), 28(4)).
5. Data subject requests — we help you answer requests to exercise rights under Chapter III, by appropriate technical and organizational measures (section 6).
6. Security, breaches and assessments — we help you meet Art. 32–36: security of processing, notifying personal data breaches (section 7), data protection impact assessments and prior consultation, taking into account the nature of processing and the information available to us.
7. End of processing — section 8 (deletion or return).
8. Information and audits — section 9.

International transfers. We process Customer Personal Data in the United States. The transfer mechanisms in section 12 (EU Standard Contractual Clauses, UK Addendum, Swiss adaptations, Brazil ANPD clauses and others) are incorporated into this DPA by reference.

For Customer Personal Data subject to the Virginia (Va. Code §59.1-579), Colorado (Colo. Rev. Stat. §6-1-1305), Connecticut (Conn. Gen. Stat. §42-521), Texas (Tex. Bus. & Com. Code §541.104), Oregon (Or. Rev. Stat. §646A.578) or similar laws, we: follow Customer's instructions (section 2); ensure confidentiality (section 4(b)); use subcontractors only under written contracts with the same obligations, after giving you the chance to object (section 4(d)); delete or return data at the end of the services unless the law requires us to keep it (section 8); make available all information in our possession needed to show compliance, and allow and cooperate with reasonable assessments by you or your designated assessor, or, at our option, provide a report of an independent assessment (section 9); help you with consumer requests, security, breach notification and data protection assessments (sections 6–7); and process sensitive data only as you instruct.

The Service lets Customer's owner, executives and HR download a person's data and record and decide deletion requests (Privacy Requests page), and export the whole company's data (Settings). If we receive a request about Customer Personal Data, we will not answer it ourselves except to tell the person we have passed it on; we will forward it to Customer without undue delay (normally within 5 business days) and help Customer answer it. We do not decide such requests for Customer.

If we become aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data, we will notify Customer's account owner without undue delay, and where feasible within 72 hours of becoming aware of it (GDPR Art. 33(2); Cal. Civ. Code §1798.82(b)). The notice will describe, as far as we then know, what happened, the data and people affected, likely consequences, and what we are doing; we will add details as we learn them. We will take reasonable steps to contain and fix the breach and help Customer meet its own notification duties. Notifying Customer is not an admission of fault.

Return. Customer can export its data at any time, and for 30 days after the subscription ends (Terms section 19). Deletion. On Customer's written request after the subscription ends, we will delete Customer Personal Data, or permanently de-identify it so it no longer identifies anyone, within 90 days, and confirm in writing. Exceptions: copies in our hosting provider's backups until they expire in the normal course; data the law requires us to keep; data under a legal hold; and our security audit trail, which is tamper-evident and kept to protect the integrity of the Service. Anything we keep stays protected by this DPA and is used for no other purpose.

On request (no more than once a year, unless a regulator requires it or after a security incident), we will answer a reasonable written security and privacy questionnaire and make available the information needed to show compliance with this DPA. If that is not enough to meet Customer's legal obligations, Customer (or an independent auditor bound by confidentiality) may audit our compliance on 30 days' notice, during business hours, at Customer's cost, in a way that does not compromise other customers' data. We do not currently hold a third-party certification (such as SOC 2 or ISO 27001).

Customer is responsible for having a lawful basis and giving the notices and obtaining the consents the law requires for the Customer Personal Data it puts into the Service — including notices of electronic monitoring and location tracking to its workers (for example under N.Y. Civ. Rights Law §52-c, Conn. Gen. Stat. §31-48d, Del. Code tit. 19 §705, and the CCPA notice at collection for employees), and any obligations that apply when it uses the Service's risk indicators (for example attendance, no-show or retention risk) in decisions about its workers. The Service shows each officer a location notice before location is first used and records the acknowledgement; this helps Customer but does not replace Customer's own notices.

This DPA lasts as long as we process Customer Personal Data. Each party's liability under this DPA is subject to the limitations in the Terms, except where Data Protection Laws do not allow them. We may update this DPA to reflect changes in law or our subprocessors; we will tell account owners of material changes as the Terms describe, and no change will reduce the protection of Customer Personal Data.

Where we process. We and our subprocessors (Annex 3) process Customer Personal Data in the United States. This section applies when Customer, or a controller Customer acts for, is subject to a law listed below. The transfer mechanism listed for that law is incorporated into this DPA by reference and applies from the date Customer accepted the Terms, without a separate signature; Annex 1, 2 and 3 complete its annexes. If Customer needs a signed copy, email nick@rapidreadycommand.com. If a transfer mechanism conflicts with the rest of this DPA, the transfer mechanism prevails for that transfer.

1. European Economic Area — EU Standard Contractual Clauses. The Standard Contractual Clauses in the Annex to Commission Implementing Decision (EU) 2021/914 apply: Module Two (controller to processor) where Customer is a controller, and Module Three (processor to processor) where Customer is a processor for its own client. Customer is the data exporter and RapidReady the data importer. Options: Clause 7 (docking) applies; Clause 9(a) Option 2 (general written authorisation; notice of new subprocessors as in section 4(d)); the optional wording in Clause 11(a) does not apply; Clause 13: the supervisory authority of Customer's establishment or, if none, of its EU representative; Clause 17 Option 1: the law of Ireland; Clause 18: the courts of Ireland. Annex I.A–B is Annex 1 and the parties' details in the Terms; Annex I.C is the authority under Clause 13; Annex II is Annex 2; Annex III is Annex 3. If RapidReady self-certifies to the EU-U.S. Data Privacy Framework (Decision (EU) 2023/1795), it may rely on that certification instead, and these Clauses remain in place as the fallback if the Framework is suspended or invalidated.
2. United Kingdom — International Data Transfer Addendum. The International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (version B1.0) issued by the Information Commissioner under s.119A of the Data Protection Act 2018 applies. Table 1: the parties as above. Table 2: the Clauses and modules in item 1. Table 3: Annex 1, 2 and 3. Table 4: neither party may end the Addendum under Section 19. A provider certification under the UK Extension to the Data Privacy Framework may be used as in item 1.
3. Switzerland. The Clauses in item 1 apply with the adaptations the Federal Data Protection and Information Commissioner (FDPIC) requires: the FDPIC is the competent supervisory authority for transfers governed by the Federal Act on Data Protection (FADP); references to the GDPR mean the FADP; "Member State" includes Switzerland, so people in Switzerland can bring claims where they habitually reside. The Swiss-U.S. Data Privacy Framework may be used as in item 1.
4. Brazil — ANPD standard contractual clauses. For transfers subject to the LGPD, the standard contractual clauses in Annex II of the Regulation on International Data Transfer (Resolução CD/ANPD nº 19/2024) apply without modification, with Customer as exporter and RapidReady as importer (the processor options). They prevail over any conflicting term. A Portuguese copy is available on request.
5. Canada and Québec. We give Customer Personal Data a level of protection comparable to that required by PIPEDA, and use it only for the purposes in section 3 (PIPEDA Sch. 1, principle 4.1.3). Before Customer communicates personal information outside Québec, Québec law requires Customer to assess the protection it will receive (s.17 of the Act respecting the protection of personal information in the private sector). On request we provide what Customer needs for that assessment: where data is stored, our subprocessors, Annex 2 measures, and how US authorities may obtain access. This DPA is the written agreement s.17 and s.18.3 require. We tell Customer promptly of any confidentiality incident, so Customer can notify the Commission d'accès à l'information and the people concerned and keep its incident register (s.3.5–3.8).
6. Australia. For Customer Personal Data subject to the Privacy Act 1988, we will not breach the Australian Privacy Principles (other than APP 1) in relation to that information, as APP 8.1 requires an overseas recipient to undertake, and we disclose it only to the subprocessors in Annex 3. Customer remains accountable for our handling under s.16C. This applies whether or not Customer has the small business exemption.
7. New Zealand. We hold Customer Personal Data solely as Customer's agent for safe custody and processing, and do not use or disclose it for our own purposes (Privacy Act 2020 s.11).
8. Japan. We take measures equivalent to those required of a business operator handling personal information under Chapter IV of the APPI, and give Customer the information it needs to respond to a person's request under art. 28(3).
9. Singapore. As a data intermediary we protect Customer Personal Data to a standard comparable to the PDPA (s.24, s.26 and the Personal Data Protection Regulations 2021), keep it only as long as needed for the Service (s.25), and notify Customer of a data breach without undue delay (s.26C(3)(a)).
10. South Africa. We act as Customer's operator: we process Customer Personal Data only with Customer's knowledge and authorisation, treat it as confidential, keep the Annex 2 safeguards, and notify Customer immediately where we reasonably believe it has been accessed or acquired by an unauthorised person (POPIA s.20–21). This DPA is the binding agreement for transfers under s.72(1)(b).
11. India. We process Customer Personal Data as Customer's data processor under this valid contract (Digital Personal Data Protection Act 2023 s.8(2)), with the reasonable security safeguards in Annex 2 (s.8(5)), and will follow any restriction the Government of India notifies under s.16.
12. Other countries (including Mexico, the United Arab Emirates and Saudi Arabia). We act only on Customer's instructions, apply Annex 2, and on request sign the standard contractual clauses or other transfer terms an authority in that country has issued, where we can meet them. We do not offer the Service in countries that require personal data to be stored locally (for example Russia and mainland China); Customer must not put personal data subject to such a requirement into the Service.

Faster breach notice. Several of these laws give Customer a short deadline to notify its regulator (for example 72 hours under GDPR Art. 33 and the UK GDPR, 3 business days under ANPD Resolution 15/2024, 3 calendar days under PDPA s.26D). We therefore aim to notify Customer within 48 hours of becoming aware of a personal data breach affecting Customer Personal Data, and in any event without undue delay and within the 72-hour limit in section 7.

Requests from public authorities. If a public authority (in the United States or elsewhere) asks us for Customer Personal Data, we will tell Customer promptly unless the law forbids it, ask the authority to go to Customer, review whether the request is lawful and challenge it where there are reasonable grounds, and disclose only the minimum required (consistent with Clause 15 of the EU Standard Contractual Clauses).

Transfer and impact assessments. On request we give Customer the information it reasonably needs for a transfer impact assessment, a data protection impact assessment (for example for officer location tracking) or a Québec s.17 assessment.

Local representatives. Where a law requires us to have a representative in a country (for example GDPR Art. 27 or UK GDPR Art. 27), we will appoint one before offering the Service there and list it in our Privacy Policy.

Scope. This section applies to the Service's features that score, rank, predict or suggest something about an individual worker or applicant: retention risk, termination-risk readout, missed-shift risk, officer and supervisor predictions, AI categorisation of coaching explanations ("Workforce AI indicators"), and the always-on open-shift ranking, attendance-event detection and coaching-case detection. Customer is the controller (and, under the EU AI Act, the deployer); RapidReady is the processor / service provider (and the provider). The full description, intended purpose, limitations and prohibited uses are in our Instructions for Use, available from nick@rapidreadycommand.com, which form part of Customer's instructions under section 2.

RapidReady commits to:

1. Off by default. Workforce AI indicators are off for every company until a Customer owner turns them on after reading a notice of the employer's obligations for the regions Customer selects; who turned them on, when, and the notice version are recorded and audit-logged. Customer may turn them off at any time.
2. No automated decisions. The Service does not hire, reject, discipline, demote, change pay or end anyone's employment on its own. Each indicator is labelled "Indicator — a person decides". Direct shift assignment without an offer happens only if Customer selects "management" scheduling mode.
3. No sensitive inputs or prohibited practices. The indicators do not use special-category or protected-characteristic data, and the Service does not perform emotion recognition or biometric categorisation (EU AI Act Art. 5(1)(f)–(g)).
4. Logging. Each indicator row records the engine, its version, the time and a summary of its inputs; switching and review requests are recorded in Customer's audit log. These records are Customer Personal Data and follow section 8 and Annex 1.
5. Worker transparency tools. When the indicators are on, officers see a notice in their app describing them and can send Customer a request for human review; Customer is notified and answers in the Service.
6. Information for Customer's assessments. On request we provide what Customer reasonably needs for a data protection impact assessment (GDPR Art. 35; EU AI Act Art. 26(9)), a CCPA risk assessment (11 CCR §7150 ff.), a works-council consultation, a bias audit or an adverse-impact review, and for answering a worker's request for an explanation (GDPR Art. 15(1)(h); EU AI Act Art. 86; 11 CCR §7222).
7. Changes. We give Customer notice before a material change to an indicator's logic, inputs or purpose, and record the new version on each row.
8. EU AI Act. We are working toward the provider obligations for Annex III high-risk systems that apply from 2 December 2027 (risk management, data governance, technical documentation, conformity assessment under Annex VI, registration, and an authorised representative in the Union). Until those steps are complete, the indicators have not been through an EU AI Act conformity assessment; the in-product notice says so before an owner who selects the EU/EEA can turn them on.

Customer (as employer and deployer) is responsible for:

1. Deciding whether to use each indicator, having a lawful basis, and giving workers and applicants every notice the law requires before use (for example GDPR Art. 13–14; EU AI Act Art. 26(7) and 26(11); 11 CCR §7220; Colorado SB 26-189; 775 ILCS 5/2-102(L)).
2. Informing and consulting workers' representatives, and obtaining works-council agreement where national law requires it (for example Germany BetrVG §87(1) no. 6), before turning the indicators on.
3. Assigning trained people to review indicators, making every employment decision by a person who can overrule the indicator, and offering human review, opt-out or appeal where the law requires (GDPR Art. 22; UK GDPR Art. 22C; 11 CCR §7221).
4. Not using the indicators on, or to infer, protected characteristics or union activity; checking outcomes for adverse impact; and not using any feature to screen candidates or employees for hiring or promotion in New York City without the bias audit and notices Local Law 144 requires.
5. Keeping records of indicator outputs and the decisions taken for the periods the law requires (for example four years under California's FEHA automated-decision rules; at least six months of logs under EU AI Act Art. 26(6)).
6. Telling us promptly if Customer believes an indicator presents a risk to workers' health, safety or rights, or after a serious incident (EU AI Act Art. 26(5)).

If this section conflicts with the rest of this DPA on these features, this section prevails. Nothing here limits Customer's or workers' rights under applicable law.

• Subject matter and nature: hosting, storing, organizing, displaying, transmitting and analyzing data to provide security-operations software (scheduling, time and attendance, patrol and checkpoints, incident reporting, dispatch, client portal, payroll and billing tools, alerts).
• Purpose: providing the Service to Customer under the Terms (section 3, item 2), and, only when Customer turns them on, workforce AI indicators described in section 13.
• Duration: the subscription, plus the periods in section 8.
• People: Customer's officers, supervisors, office staff and applicants; Customer's clients and their contacts; members of the public named in reports, dispatch calls or visitor logs.
• Types of data:
  • Identifiers and contact details: Officer, staff, applicant and client-contact names, emails, phone numbers.
  • Employment information: Schedules, clock-in/out records, timesheets, pay rates, training, certifications, coaching and leave records, hire and separation dates.
  • Precise geolocation (sensitive): Device location at clock-in/out, while clocked in on patrol or checkpoint rounds, and at moments the officer starts (On my way, incident, lone-worker check, SOS).
  • Government-issued numbers (sensitive): State security-guard licence / registration numbers and expiry dates; ID numbers (driver's licence or passport) that a customer chooses to record in its site visitor log.
  • Account log-in credentials (sensitive): Site-phone PINs (salted hashes), two-step login secrets.
  • Personal details kept by the employer: Home address, date of birth, emergency contact, photo.
  • Health information (sensitive): Only if a customer records it — for example injuries described in an incident report or injury documentation.
  • Audio, electronic, visual information: Photos and videos attached to reports.
  • Information about members of the public: Names and descriptions in incident reports, dispatch callers, visitors signed in at a site.
  • Background check records (sensitive): The conditional job offer, the applicant's signed authorization (name, time, network address), background reports the employer uploads or orders from its screening company, pre-adverse and adverse action notices, the employer's written assessment and the applicant's response. Only the employer's owners and HR can open a report; the applicant sees every step on a private page.
  • Social Security numbers for employment (sensitive): The SSN a new hire enters on Form W-4, stored encrypted and shown only as the last 4 digits; only the employer's payroll file contains the full number. Not collected until encryption is set up.
  • Bank details for payroll (sensitive): Routing and account numbers a new hire gives for direct deposit (optional — a paper check is always offered), stored encrypted and shown only as the last 4 digits.
  • Tax withholding and new-hire forms: Form W-4 and state withholding choices, emergency contact, signed acknowledgments (handbook, post orders, pay notice), and the date the new hire completed Form I-9 Section 1 on the official form. No I-9 answers, immigration documents or document images are stored.
• Sensitive data: precise geolocation of officers on duty; government-issued numbers if Customer records them; log-in credentials (stored as salted hashes); any health information Customer records. Protected by the measures in Annex 2, including restricted access to personal files.

• Separation between customers: every record carries its company, and database access rules limit reads and writes to the signed-in person's own company and role. An automated isolation test probes every company-scoped table from real customer logins.
• Server-side authorization: every server function checks who is calling before it runs (an access register classifies each function as automation-only, signed-in role, or public by design), takes the company from the caller rather than from the request, and applies per-caller rate limits.
• Role-based access: people see only the screens and records their role allows; client logins see only their own sites.
• Encryption in transit: all traffic uses HTTPS/TLS. Storage encryption at rest is provided by our hosting provider.
• Credentials: site-phone PINs are stored only as salted hashes; secrets and API keys are kept in the hosting platform's secret store, not in code; credentials are stripped from every data export.
• Two-step login: required for the platform owner and available to customers; automatic sign-out after inactivity; suspicious sign-in detection (new device, repeated failures).
• Private files: incident photos, injury documentation, IDs and certificates are stored privately and opened only through links that expire after one hour, issued to people of the same company (personal files: only the uploader, the person concerned, or a manager).
• Tamper-evident audit trail: security-relevant actions (exports, privacy requests, role changes and others) are written to a hash-chained audit log that is checked for gaps or edits.
• Abuse protection: bot checks (Cloudflare Turnstile) and limits that hold across servers on public forms.
• Data minimization and retention: credentials are excluded from exports; a retention schedule blanks personal and location details after set periods (switched on after legal review; until then previewed weekly).
• Backups and continuity: data is hosted on Base44's infrastructure. We do not run separate scheduled backups of our own; Customer can download a full export of its data at any time.
• People and process: access to production data is limited to people who need it and are bound by confidentiality; a written incident-response procedure covers detection, containment, and notice to customers and authorities.

We use these subprocessors to provide the Service. We will give at least 30 days' notice of a new subprocessor by updating this list and emailing account owners (see section 4(d)).

Resources loaded by the browser. These are not given Customer Personal Data by us; the visitor's browser contacts them directly and they receive its IP address and browser details:

• OpenStreetMap tile servers — Map images (United Kingdom / global CDN)
• CARTO basemaps — Map images on the demo dispatch map (Global CDN)