This Data Processing Addendum (“DPA”) is incorporated by reference into, and forms part of, the Agreement between Eolas Inc. (“Processor”) and the customer that accepts the Eolas Customer Terms of Service, available at eolas.co/terms/customer (the “Customer Terms”), or executes an Eolas Master Subscription Agreement signature form or an Order Document (“Controller”) (Processor and Controller, each a “Party” and together the “Parties”). An organization that makes the election in Section 9.3(i)(A) of the Customer Terms under Section 2.3(f) of the Customer Terms accepts the Customer Terms and this DPA as to the Customer Data retained under that election and any suspension it places by making that election, and is “Controller” for those records. “Agreement” has the meaning given in Section 1.3 of the Customer Terms and includes this DPA. This DPA applies automatically and without signature to the extent Customer Data Processed under the Agreement includes Personal Information. This DPA is published in full at eolas.co/trust/dpa and is available there without registration, request, or other condition of access. Processor may update this DPA from time to time, provided that updates will not materially diminish the protections for Personal Information during a then-current Subscription Term or while Processor holds Customer Data under the Data Retention Add-on or records under a suspension for Controller. Any data processing addendum mutually executed by the Parties supersedes this DPA to the extent of any conflict. Capitalized terms not defined in this DPA have the meanings set forth in the Agreement. A reference in this DPA to a numbered Section, without naming a document, is to the correspondingly numbered Section of this DPA.
This DPA sets forth the Parties’ respective obligations with respect to Processor’s Processing of Personal Information on behalf of Controller in connection with the Services.
For purposes of this DPA:
“Applicable Privacy Laws” means the data protection and consumer privacy laws applicable to the Processing of Personal Information under this Agreement, including the California Consumer Privacy Act as amended, the Colorado Privacy Act, the Virginia Consumer Data Protection Act, and other U.S. state consumer privacy laws, U.S. state biometric privacy laws (including the Illinois Biometric Information Privacy Act and Tex. Bus. & Com. Code § 503.001), U.S. state consumer health data laws (including the Washington My Health My Data Act), and federal and state laws governing audio and video recording, together with their implementing regulations and any successor legislation. For purposes of this DPA, and unless expressly agreed in a separate written addendum executed by Processor, “Applicable Privacy Laws” does not include the EU General Data Protection Regulation (EU GDPR), the UK General Data Protection Regulation (UK GDPR), or any other non-U.S. data protection law.
“Personal Information” has the meaning given in Section 1.29 of the Customer Terms.
“Personal Information Breach” means a Breach, as defined in the Customer Terms, involving Personal Information Processed under this DPA.
“Process” or “Processing” means any operation or set of operations performed on Personal Information, whether or not by automated means, including collection, use, storage, disclosure, analysis, deletion, or modification.
References in lowercase to a “service provider,” “processor,” “business,” or “controller” are to those roles as defined under Applicable Privacy Laws.
“Sensitive Personal Information” means any data classified as “sensitive” or similarly elevated under Applicable Privacy Laws, including precise geolocation, biometric identifiers or templates, financial account access credentials, health information outside the scope of HIPAA, and information regarding children under the age of 13 (or 16, where applicable).
“Subprocessor” means any third party engaged by Processor to Process Personal Information in connection with the Services.
Controller is the “business” or “controller” and Processor is the “service provider” or “processor” (as those terms or analogous terms are defined under Applicable Privacy Laws) with respect to Personal Information that Processor Processes on Controller’s behalf under the Agreement and this DPA.
Processor will Process Personal Information solely to provide, maintain, support, secure, and improve the Services in accordance with the Agreement, Controller’s documented instructions as described in Section 3, and this DPA. The Agreement, this DPA, and Controller’s configurations and elections in the Services are Controller’s documented instructions for the Processing they describe. Data that Processor has aggregated, deidentified, or anonymized so that it no longer constitutes Personal Information is outside the preceding sentence: its use as permitted by this DPA and the Agreement is not Processing of Personal Information on Controller’s behalf and does not depend on a separate instruction. Processor Processes Personal Information for a Site on the instructions of the Customer of Record for that Site. Customer Data held for a former Customer of Record during the Retrieval Period, Customer Data retained under the Data Retention Add-on (Section 9.3(i)(A) of the Customer Terms), and records under a suspension under Section 6.2 of the Customer Terms placed by a former Customer of Record or by an organization granted that election under Section 2.3(f) of the Customer Terms, are Processed on the instructions of that party as Controller of those records, separately from Personal Information Processed for the current Customer of Record of the same Site, and neither may instruct Processor with respect to the other’s records. With respect to a Site, Controller’s documented instructions are those of the Customer of Record for that Site, and a configuration or election made in the Services by any other organization with access to that Site is a documented instruction of the Customer of Record, which is responsible for it under Section 2.3 of the Customer Terms. Where Controller grants another organization access to a Site under Section 2.3 of the Customer Terms, Controller is responsible for its grant of access to that organization and for the lawful basis for the disclosure to it, and that organization’s access is at Controller’s direction. Nothing in this DPA determines whether that organization is a controller, business, processor, or service provider under Applicable Privacy Laws. The subject matter and duration of processing, the nature and purpose of the processing, the categories of Personal Information, and the categories of data subjects are determined by the Services described in the Agreement and the applicable Order Document(s), and, unless otherwise specified by Controller in writing, extend for the Subscription Term, any data retention period configured by Controller in the Services pursuant to the Agreement, the Retrieval Period, any period during which Customer Data is held under the Data Retention Add-on, and any period during which a suspension under Section 6.2 of the Customer Terms is in effect. Processing includes, as described in the Agreement, Processing by artificial-intelligence and machine-learning features of the Services, including detection and classification, per-Controller configuration, calibration, and tuning, and content generation. Where Controller has authorized a Biometric Feature through the Services in accordance with Section 6.6(f) of the Customer Terms, that authorization is a documented instruction of Controller for purposes of this DPA, and Processing includes Processing of biometric Personal Information as necessary for that Biometric Feature. That instruction does not substitute for the separate affirmative enrollment of an individual User required by Section 6.6(f) of the Customer Terms, and Processor will not Process the biometric identifiers, biometric templates, or biometric information of any individual who has not enrolled through the mechanism Processor provides for that Biometric Feature. Processor will Process biometric Personal Information only for the authorized Biometric Feature and the purposes disclosed for it, and will not use biometric identifiers, biometric templates, or biometric information to develop, train, evaluate, or improve models or services made available to other Controllers.
Any Processing of Personal Information subject to non-U.S. data protection laws resulting from Controller’s failure to comply with Section 4(c) or Section 11 is outside the authorized scope of this DPA unless the Parties execute a separate written addendum governing that Processing, and Processor does not by this DPA assume any obligation of a controller or processor under any non-U.S. data protection law.
Processor will Process Personal Information only on Controller’s documented instructions, which include the Agreement, this DPA, and Controller’s configurations and selections made via the Services, including via the Services’ administrative controls and APIs (to the extent applicable). To the extent required by Applicable Privacy Laws, Controller may take reasonable and appropriate steps to stop and remediate unauthorized use of Personal Information.
Controller represents and warrants that:
(a) its instructions to Processor comply with Applicable Privacy Laws;
(b) it has provided all notices and obtained all consents or permissions required by Applicable Privacy Laws (including (i) any notices and consents relating to the placement and operation of Sensors (including cameras, microphones, speakers, and intercoms), the use of live or recorded voice-announcement features, and the use of any optional AI content-generation features, consistent with Sections 6.5 and 6.6 of the Customer Terms and (ii) any required notices or consents for the collection of Personal Information relating to children or guests of Site Occupants);
(c) it will not transmit, and will not permit transmission of, Personal Information subject to non-U.S. data protection laws (including EU/UK GDPR), absent a separate written addendum executed by Processor;
(d) it will not transmit, and will not permit transmission of, Sensitive Personal Information to Processor unless expressly agreed in writing by the Parties, or unless the Sensitive Personal Information is Processed in connection with a Biometric Feature that Controller has authorized in accordance with Section 6.6(f) of the Customer Terms and in which, where applicable, the individual User has enrolled, or unless submitted to Processor directly by an individual through an upload or submission flow that Processor presents to that individual, in which case Processor presents the notice and records the consent for that flow as Controller’s processor, or unless incidentally included in data captured or received in the ordinary operation of the Services (such as video that may include recognizable individuals), provided that Controller has complied with Sections 6.5 and 6.6 of the Customer Terms; and
(e) it will not knowingly transmit Personal Information of children under the age of 13 (or 16, where applicable) to the Services; provided, however, that incidental collection (e.g., video or photo recordings in common areas, or limited data collected for amenity access management) and content submitted through an upload or submission flow that Processor presents, where Processor has recorded the consent that flow requires, will not constitute a breach of this subsection, so long as Controller has provided all required notices and obtained all required consents under Applicable Privacy Laws.
Processor certifies that it understands the restrictions in this Section and will comply with them, and will notify Controller promptly, and in any event within five (5) business days, if it determines that it can no longer meet its obligations under Applicable Privacy Laws. Processor will not:
(a) retain, use, disclose, sell, or share Personal Information other than to provide the Services and as permitted by Applicable Privacy Laws;
(b) retain, use, or disclose Personal Information outside the direct business relationship between Controller and Processor; or
(c) combine Personal Information received from Controller with Personal Information received from another person or collected from Processor’s own interactions, except as permitted by Applicable Privacy Laws, including to detect data security incidents or protect against malicious or illegal activity, or to comply with law. For clarity, Processor does not “sell” or “share” Personal Information Processed under this DPA as those terms are defined under Applicable Privacy Laws.
As permitted by Applicable Privacy Laws and the Agreement, Processor may aggregate, deidentify, or anonymize Personal Information so that it no longer constitutes Personal Information and may use such aggregated, deidentified, or anonymized data for its internal business purposes, including research and development, analytics, benchmarking, and improvement of the Services. Processor will not attempt to re-identify data that it has deidentified or anonymized. Where Controller or a User associates an Event or Incident with a named individual, or with a Site Occupant, unit or space, Occupancy Agreement, or other record, whether that record is imported from Controller’s own systems or created by Controller or a User in the Services, Processor holds that association and any such record solely to provide the Services to Controller and its Sites. Processor does not include that association or record in Feedback Data, does not place either in a training queue, and excludes both from the aggregated, deidentified, or anonymized data used for the internal business purposes described in this Section and from Usage Data. Except where a Biometric Feature is authorized and enabled under Section 6.6(f) of the Customer Terms, associations between detections in different Events or Incidents are made by Controller or a User and not by the Services. For clarity, Processor’s internal business purposes include the development, training, evaluation, and improvement of artificial-intelligence and machine-learning models using aggregated, deidentified, or anonymized data, including Feedback Data that has been aggregated, deidentified, or anonymized so that it no longer constitutes Personal Information. This does not authorize the use of biometric identifiers, biometric templates, or biometric information, or of data derived from them, for the development, training, evaluation, or improvement of models or services made available to other Controllers. Feedback Data awaiting a training run remains identifiable and associated with Controller, remains Personal Information subject to this DPA, and is handled in accordance with Controller’s data-governance settings until it is deidentified at the point it is drawn into a training run. Section 6.1 of the Customer Terms requires Processor to delete such Feedback Data, and not to use it in any training run, if the applicable Subscription terminates or expires or Controller makes a deletion election before it is drawn into a run. Processor’s Processing of Personal Information to provide the Services includes per-Controller configuration, calibration, and tuning of such models and use of Feedback Data for that Controller, in each case as described in Sections 6.1 and 6.6 of the Customer Terms.
Controller grants Processor general authorization to engage Subprocessors to Process Personal Information in connection with the Services. Processor will impose on Subprocessors data protection and security obligations that provide at least the same level of protection for Personal Information as set out in this DPA. Processor remains responsible for Subprocessors’ performance of obligations consistent with this DPA. Processor will maintain a current list of its Subprocessors (including any third-party artificial-intelligence service providers) at the Eolas Trust Center, eolas.co/trust, where Controller may subscribe to notifications of additions or replacements. Processor will provide at least thirty (30) days’ notice, via portal notification or other written means, before a new Subprocessor Processes Personal Information. If Controller objects on reasonable data-protection grounds within the notice period, the Parties will discuss the objection in good faith. Processor may, at its option, elect not to use the Subprocessor for Controller, offer a commercially reasonable alternative, or take commercially reasonable steps to address the objection. If Processor determines that it cannot reasonably accommodate the objection, either Party may terminate the Services affected by the Subprocessor on written notice, and Processor will refund prepaid fees for the unexpired portion of the then-current Subscription Term for those Services. Termination under this Section extends only to the Services affected by the Subprocessor. Absent a timely objection, Controller’s continued use of the Services after the notice period constitutes approval of the new Subprocessor. Processor will impose on any Subprocessor engaged to provide artificial-intelligence services contractual restrictions prohibiting such Subprocessor from using Personal Information (including biometric Personal Information) to train the Subprocessor’s own or any third party’s models or for the benefit of any third party.
Processor will ensure that each person it authorizes to Process Personal Information is subject to a written obligation of confidentiality, or an appropriate statutory obligation of confidentiality, that survives the termination of that person’s engagement, and will limit access to those persons who require it to perform the Services. Processor will implement and maintain appropriate administrative, technical, and physical safeguards designed to protect Personal Information against unauthorized or unlawful destruction, loss, alteration, disclosure, or access, consistent with Section 6.4 of the Customer Terms, including access controls, encryption in transit and at rest, physical security, and incident response procedures. Processor maintains a description of its then-current technical and organizational security measures, which it makes available through the Eolas Trust Center, eolas.co/trust, and updates from time to time in accordance with this Section. Processor will make available information reasonably necessary to demonstrate compliance with this Section upon Controller’s written request no more than once annually, subject to reasonable confidentiality protections. Processor may update its security measures from time to time provided the overall level of protection is not materially decreased.
Processor will notify Controller without undue delay after becoming aware of a Personal Information Breach impacting Personal Information Processed under this DPA, consistent with Section 6.4.3 of the Customer Terms. Such notice may be provided in phases as information becomes available, and will include, to the extent known at the time of notice, a description of the nature of the breach, the categories of data affected, the number of affected records and individuals, likely consequences, and the measures taken or proposed to address the breach. Processor may delay such notification at the request of law enforcement if notification would impede an investigation, and will notify Controller promptly thereafter. Processor’s obligations under this Section will be reasonable and commensurate with its role as Processor, and will not require disclosure of information unrelated to the Services, other customers’ data, or Processor’s trade secrets.
To the extent Controller is required under Applicable Privacy Laws to respond to requests from individuals to exercise their privacy rights in Personal Information, Processor will, taking into account the nature of Processing, notify Controller of requests it receives directly and provide reasonable assistance to Controller, at Controller’s expense, to enable Controller to fulfill such requests within the timeframes required by Applicable Privacy Laws. Where more than one Controller has records for a Site under Section 2, Processor will notify each Controller whose records the request concerns. Processor will not respond to a request directly except to advise the requester to contact Controller or as required by law; a request received through an upload or submission flow that Processor presents is passed to Controller and Processor assists Controller in acting on it. Processor will, taking into account the nature of Processing and available technical means, provide reasonable assistance to Controller to fulfill data subject requests and regulatory inquiries related to Personal Information Processed under this DPA, in each case at Controller’s expense. Processor’s assistance will be limited to systems and data within its possession or control and will not require Processor to create new tools or functionality beyond what is commercially reasonable. Where Controller requests assistance with privacy risk assessments or data protection risk assessments relating to the Services, such assistance will be limited to existing documentation and reasonable inquiries and will be at Controller’s expense. Notwithstanding the foregoing, Processor may, in its sole discretion, make available functionality within the Subscription Service that enables data subjects to exercise certain rights under Applicable Privacy Laws (such as access or deletion of Personal Information) through a self-service interface; provided, however, that Controller remains solely responsible for enabling, configuring, and managing such functionality, and for determining whether and how to respond to any data subject requests received through such means.
No more than once in any twelve (12) month period, upon written request, Processor will provide Controller with a summary of its then-current independent third-party audit report (e.g., SOC 2 Type II or comparable) and a written description of its security controls, subject to confidentiality obligations. Processor may satisfy its obligations under this Section by making such documentation available through the Eolas Trust Center, eolas.co/trust, subject to reasonable access-request and confidentiality workflows. Those workflows apply to security documentation only and do not apply to this DPA, which remains publicly available and ungated at eolas.co/trust/dpa. Except to the extent additional verification rights are required by Applicable Privacy Laws, such documentation is Controller’s exclusive contractual means of verifying Processor’s compliance with this DPA, and Processor will have no obligation to permit on-site audits or inspections.
Unless expressly agreed in a separate written addendum executed by Processor, the Services are not intended for use with Personal Information subject to EU GDPR, UK GDPR, or other non-U.S. data protection laws imposing cross-border transfer requirements, and Controller represents and warrants that it will not transmit such Personal Information to the Services or to Processor. If the Parties mutually agree to Process such Personal Information, they will execute the necessary transfer instruments and additional terms required by applicable law.
The Parties acknowledge that Controller’s personnel or Users may remotely access the Services from locations outside the United States. Such incidental remote access does not by itself expand the authorized scope of Processing under this DPA or constitute Processor’s agreement to provide the Services subject to non-U.S. data protection laws or cross-border transfer mechanisms. Controller remains responsible for ensuring that any such access complies with Applicable Privacy Laws, the Agreement, and this DPA.
Consistent with Section 6.2 of the Customer Terms, Controller is responsible for configuring data retention settings within the Services and for archival and retention beyond the applicable retention period. Upon termination or expiration of the Agreement or of the Subscription for a Site, or on a change of Customer of Record under Section 2.3(g) of the Customer Terms, Controller may retrieve Personal Information during the Retrieval Period. Upon expiry of that period, or upon Controller’s earlier written request where feasible, and except to the extent Controller has elected the Data Retention Add-on or directed a transfer under Section 6.8.2 of the Customer Terms or a suspension under Section 6.2 of the Customer Terms applies, Processor will delete or return Personal Information in its possession or control, except to the extent retention is required by Applicable Law or reasonably necessary for recordkeeping, dispute resolution, security, logging, backup, disaster recovery, or compliance purposes. Where deletion is not feasible (including for data maintained in archival or backup systems that are not reasonably accessible in the ordinary course), Processor will continue to protect such Personal Information in accordance with this DPA and will effect deletion in the ordinary course of its data lifecycle. Processor deletes biometric identifiers, biometric templates, and biometric information Processed for a Biometric Feature when the individual withdraws enrollment, when the purpose for which they were collected has been satisfied, at the end of the Retrieval Period for the applicable Site, or three (3) years after the individual’s last interaction with the Biometric Feature, whichever occurs first, unless a valid warrant or subpoena, or a suspension under Section 6.2 of the Customer Terms, requires otherwise; biometric data is never retained under the Data Retention Add-on.
As set forth in Sections 6.5 and 6.6 of the Customer Terms, Controller is solely responsible for obtaining and maintaining all notices, consents, authorizations, permissions, and other requirements applicable to Controller in its capacity as controller, business, property owner, property manager, operator, or deployer of the applicable technology, including those required from Site Occupants and other individuals under Applicable Law in connection with the placement and operation of Sensors, cameras, microphones, and speakers and the collection and processing of any data captured thereby, and for lawful use of AI features of the Services (including content-generation features and Alarm Sound Recognition under Section 3.14 of the Customer Terms), including any required notices or consents, in each case including where such features route data to third-party providers at Controller’s direction. Processor disclaims liability for Controller’s failure to comply with such requirements, and Controller will indemnify Processor as provided in Sections 6.5 and 14.2 of the Customer Terms. For clarity, the foregoing does not limit Processor’s independent obligations under this DPA, Section 6.6(f) of the Customer Terms, applicable feature-specific terms, or Applicable Privacy Laws, including any notice, consent, enrollment, retention, deletion, or other requirement applicable directly to Processor; nothing in this Section creates joint responsibility where Applicable Privacy Laws do not impose it. To the extent Controller is required under Applicable Privacy Laws to provide notices, conduct risk assessments, or honor opt-out, access, or human-review rights in connection with automated decision-making technology, Processor will provide reasonable cooperation and assistance consistent with Section 9, at Controller’s expense.
Information lawfully made available from federal, state, or local government records is publicly available information and is therefore not Personal Information under this DPA. Where such information is made available through the Services, it is Public Data under the Agreement and is subject to the Agreement’s Public Data ownership and licensing framework. Nothing in this DPA converts Public Data into Customer Data or restricts Processor’s ownership or licensing rights to Public Data under the Agreement.
If Processor receives a legally binding request from a governmental or regulatory authority for disclosure of Personal Information, Processor will, to the extent permitted by law, notify Controller of the request and reasonably cooperate with Controller’s lawful efforts to resist or narrow the disclosure. Processor may disclose Personal Information to the extent required by law, court order, or legal process. Processor will not be required to challenge requests where doing so would be unlawful or commercially unreasonable.
The limitations and exclusions set forth in Section 13 of the Customer Terms apply to this DPA and any Personal Information Breach or other claim arising from Processor’s Processing of Personal Information.
This DPA does not create any additional indemnification obligations beyond those set forth in the Agreement. For clarity, Controller’s indemnity under the Agreement (including for notices and consents, Sensor and AI features, and Customer Data) applies to Controller’s obligations referenced in this DPA.
This DPA is an addendum to the Agreement and is incorporated therein. Sections 6.3 and 18.1 of the Customer Terms govern which document controls on a conflict. All other terms of the Agreement remain in full force and effect.
This DPA becomes effective when the Agreement becomes binding on the Parties or when Processor first Processes Personal Information on Controller’s behalf, whichever occurs first, and will remain in effect for so long as Processor Processes Personal Information for Controller under the Agreement. Every provision of this DPA survives expiration or termination of the Agreement for so long as Processor holds Personal Information for Controller, including Customer Data under the Data Retention Add-on and records under a suspension.
The Personal Information Processed, and the Processing performed, depend on how Controller uses and configures the Services under the Agreement and applicable Order Documents. A category listed below is in scope only to the extent Controller’s use or configuration brings it into scope. Subject to that:
Categories of data subjects: Site Occupants; visitors, guests, and other individuals present at a Site; employees and personnel of Controller and of Sites; service providers and contractors; and any other individual whose information Controller elects to Process through the Services.
Categories of Personal Information: (a) identifiers and contact details; (b) device, system, and usage data; (c) Site-specific operational data, Incident records, and Events; (d) environmental and condition readings from Sensors, such as water, temperature, humidity, and occupancy; (e) video and image recordings; (f) audio, where Controller enables audio capture or voice announcement features; (g) biometric identifiers, biometric templates, biometric information, and related enrollment information, where a Biometric Feature is authorized and enabled in accordance with the Agreement; and (h) other data submitted by or on behalf of Controller, as further described in the Agreement.
Categories of recipients: Processor’s personnel and its Subprocessors, including cloud infrastructure providers, third-party artificial-intelligence providers, and data annotation and labeling vendors; and, where Controller elects remote monitoring services, the licensed Monitoring Provider identified under the Remote Monitoring Addendum, to which data is disclosed at Controller’s direction and which is not a Subprocessor. Processor identifies its current Subprocessors at the Eolas Trust Center, eolas.co/trust.
Nature and purpose of Processing: to provide, operate, support, secure, maintain, configure, and improve the Services; to monitor their technical performance and security; to deliver analytics and reporting; and for any other purpose permitted by the Agreement and this DPA.
Duration of Processing: the Subscription Term, plus any additional retention period Controller configures or Applicable Law requires, the Retrieval Period, any period during which Customer Data is held under the Data Retention Add-on, and any period during which a suspension under Section 6.2 of the Customer Terms is in effect.
This DPA is intended to align with and complement the Agreement’s structure and risk allocation, including Sections 6 (Customer Data; Technologies), 12 (Confidentiality), 14 (Indemnification), and 18 (Miscellaneous) of the Customer Terms. Notices under this DPA will follow Section 18.7 of the Customer Terms.
.svg)
