Data Processing Agreement

Version: 1.3
Effective Date: November 10, 2026
Last Updated: November 12, 2026

This Data Processing Agreement (“DPA”) forms part of, and is incorporated into, the Terms of Service or other written agreement governing the use of the AquaRunner247 services (the “Agreement”) between AquaRunner247 LLC, with its address at 732 S 6th St, Ste N, Las Vegas, NV 89101 (“AquaRunner247”), and the customer identified in the Agreement (“Customer”). This DPA applies when AquaRunner247 Processes Personal Data on Customer’s behalf.

AquaRunner247 and Customer may each be called a “Party” and together the “Parties.” Capitalized terms not defined in this DPA have the meanings given in the Agreement.

1. Definitions

1.1 “Applicable Data Protection Law” means all data protection and privacy laws applicable to the Processing under this DPA, including, where applicable, the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”), other applicable U.S. state privacy laws, the EU GDPR, the UK GDPR, and the UK Data Protection Act 2018.

1.2 “Controller” means the person or entity that determines the purposes and means of Processing Personal Data, or the equivalent term under Applicable Data Protection Law.

1.3 “Data Subject” means an identified or identifiable individual to whom Personal Data relates, or the equivalent term under Applicable Data Protection Law.

1.4 “EU GDPR” means Regulation (EU) 2016/679.

1.5 “Personal Data” means information relating to an identified or identifiable natural person, or the equivalent term under Applicable Data Protection Law.

1.6 “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data Processed under this DPA.

1.7 “Process” or “Processing” means any operation performed on Personal Data, including its collection, recording, storage, use, disclosure, retrieval, alteration, restriction, deletion, or destruction.

1.8 “Processor” means a person or entity that Processes Personal Data on behalf of a Controller, or the equivalent term under Applicable Data Protection Law.

1.9 “Restricted Transfer” means a transfer of Personal Data subject to restrictions on international transfers under Applicable Data Protection Law.

1.10 “Security Incident” means a confirmed breach of AquaRunner247’s security that results in accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data. A failed or unsuccessful attempt that does not compromise Customer Personal Data is not, by itself, a Security Incident.

1.11 “Standard Contractual Clauses” or “SCCs” means the European Commission’s standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914, as amended or replaced, and, where applicable, the UK International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner’s Office.

1.12 “Subprocessor” means a third party engaged by AquaRunner247 to Process Customer Personal Data on AquaRunner247’s behalf in connection with the Services.

1.13 “Supervisory Authority” means an independent public authority responsible for enforcing Applicable Data Protection Law.

1.14 “UK GDPR” means the UK General Data Protection Regulation, as it forms part of the law of the United Kingdom.

2. Scope, Roles, and Term

2.1 Scope. This DPA applies to AquaRunner247’s Processing of Personal Data on behalf of Customer through the Services. The nature, purposes, categories of Personal Data, categories of Data Subjects, and frequency of Processing are described in Annex 1.

2.2 Roles; dual framing. For Personal Data Customer or its authorized users submit to the Services about Customer’s technicians, staff, End Customers, properties, pools, and operations, Customer acts as Controller or business and AquaRunner247 acts as Processor or service provider. This DPA is intended to satisfy both the GDPR Article 28 processor-term requirements and the CCPA service-provider contract-term requirements: AquaRunner247 processes Customer Personal Data only on Customer’s documented instructions, does not sell or share it as those terms are defined under the CCPA, and does not retain, use, or disclose it for any purpose other than providing the Services, except as permitted by Applicable Data Protection Law. The Parties acknowledge that their roles may differ for particular Processing where Applicable Data Protection Law so requires. Nothing in this DPA makes AquaRunner247 the Controller of Personal Data that AquaRunner247 Processes solely on Customer’s documented instructions.

2.3 Term. This DPA takes effect on the date Customer accepts the Agreement or otherwise agrees to use the Services, and continues for as long as AquaRunner247 Processes Personal Data on Customer’s behalf.

2.4 Customer’s customers. Customer is responsible for determining its role and obligations where it Processes Personal Data on behalf of its own customers or other third parties. Customer must ensure that its agreements and instructions authorize the Processing and permit Customer to provide the instructions required under this DPA.

3. Customer Instructions and Responsibilities

3.1 Documented instructions. AquaRunner247 will Process Customer Personal Data only on Customer’s documented instructions, including instructions in the Agreement, this DPA, Customer’s configuration and use of the Services, and subsequent written instructions consistent with the Agreement. AquaRunner247 may Process Personal Data as necessary to provide, secure, maintain, and support the Services, as further described in Annex 1.

3.2 Instructions that may violate law. If AquaRunner247 believes an instruction violates Applicable Data Protection Law, it will inform Customer unless prohibited by law. The Parties will work in good faith to resolve the concern. AquaRunner247 may suspend the affected Processing while the concern is unresolved where reasonably necessary to comply with law.

3.3 Customer obligations. Customer is responsible for:

a. complying with Applicable Data Protection Law in its collection, use, disclosure, and other Processing of Personal Data;

b. establishing and documenting a lawful basis for Processing and, where required, obtaining valid consents and providing legally compliant privacy notices to Data Subjects, including its employees, technicians, customers, property contacts, and other individuals whose information Customer enters into the Services;

c. ensuring its instructions to AquaRunner247 are lawful and that it has authority to give those instructions;

d. maintaining the accuracy and quality of Personal Data it submits, including reviewing information extracted by the document scanner and correcting inaccurate or incomplete records;

e. configuring and using customer-facing portals, pump room QR codes, reports, email delivery, and other sharing features appropriately, including determining whether and with whom records may be shared or made accessible;

f. managing user accounts, permissions, device access, and credentials for its users; and

g. determining and verifying the accuracy of chemical readings, dosage decisions, service records, inspection records, and regulatory compliance records entered into or generated through the Services.

3.4 Operational and regulatory decisions. The Services, including the compliance and inspection features, chemical dosage calculator, route optimization, geofenced arrival and departure records, photos, and document scanner, are tools to assist Customer’s operations. They do not constitute legal, medical, health-department, safety, or professional advice and do not replace Customer’s independent judgment or applicable regulatory requirements. Customer remains responsible for deciding how to service each property, verifying dosage calculations and readings, maintaining accurate compliance records, and determining whether its work meets applicable laws, regulations, permits, and health-department requirements. AquaRunner247 does not guarantee that use of the Services will result in passing an inspection or achieving regulatory compliance.

3.5 Prohibited information. Unless the Parties agree otherwise in writing, Customer will not intentionally submit special categories of Personal Data, sensitive Personal Data, payment card data, government identification numbers, or other highly sensitive information to the Services. Customer will avoid including unnecessary personal information in photos, inspection reports, notes, or other uploads.

4. AquaRunner247 Obligations

4.1 Processing and confidentiality. AquaRunner247 will:

a. Process Customer Personal Data only as permitted by Section 3;

b. ensure that persons authorized to Process Customer Personal Data are bound by appropriate confidentiality obligations; and

c. implement and maintain the technical and organizational measures described in Annex 2, taking into account the nature of the Services, the information available to AquaRunner247, and the risks associated with Processing.

4.2 Security measures. AquaRunner247 will maintain appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. The measures in Annex 2 describe the safeguards applicable to the Services. AquaRunner247 may update them from time to time provided that it does not materially reduce the overall level of protection during the term of the Agreement.

4.3 Compliance information. On Customer’s reasonable written request, AquaRunner247 will make available information reasonably necessary to demonstrate its compliance with this DPA, subject to confidentiality, security, and third-party restrictions.

4.4 No independent use. Except as allowed under Section 11 for aggregated and de-identified information, AquaRunner247 will not sell Customer Personal Data or use it for advertising directed to Data Subjects.

5. Subprocessors

5.1 General authorization. Customer provides AquaRunner247 general written authorization to engage Subprocessors to Process Customer Personal Data, subject to this Section. The current Subprocessors are listed by name in Annex 3.

5.2 Subprocessor obligations. AquaRunner247 will impose data protection obligations on each Subprocessor that are no less protective of Customer Personal Data than the applicable obligations in this DPA. AquaRunner247 remains responsible for its Subprocessors’ performance of their data protection obligations to the extent required by Applicable Data Protection Law.

5.2.1 Public mapping services. Three Subprocessors in Annex 3 are an exception to the first sentence of Section 5.2, and are identified as such so that Customer is not told otherwise: the geocoding, driving-route and map-tile services operated by the OpenStreetMap Foundation and FOSSGIS e.V. are public infrastructure offered under published usage policies rather than under a negotiated agreement, and no contract imposing the obligations in this DPA has been or can be concluded with them. AquaRunner247 relies on their published usage policies and privacy notices, and mitigates the gap by limiting what reaches them: those services receive only a property street address or map coordinates, at the moment a Customer geocodes an address, optimizes a route, or views a map, and receive no chemical readings, inspection records, photos, documents, call recordings, names, email addresses or telephone numbers. AquaRunner247 remains responsible to Customer for this Processing under Section 5.2’s second sentence and Section 13. Customer may object under Section 5.4, and on request AquaRunner247 will disable address autocomplete, geocoding and route optimization for Customer’s Account, in which case stops are ordered manually and the Services otherwise operate unchanged.

5.3 Notice of changes. AquaRunner247 will give Customer at least 10 days’ advance notice of the addition or replacement of a Subprocessor that will Process Customer Personal Data, where practicable. Notice may be provided by email to Customer’s admin contact, through the Services, or by posting an updated Subprocessor list at https://aquarunner247.com/subprocessors.

5.4 Objections. Customer may object in writing to a proposed Subprocessor within 15 days after notice, on reasonable, documented data protection grounds. The objection must identify the specific concern and the affected Processing. The Parties will work in good faith to address the concern, which may include additional safeguards, an alternative Subprocessor, or disabling the affected functionality where practicable. If the Parties cannot resolve the objection within a reasonable period, either Party may terminate the affected Services or feature, or, if the affected Processing is material to the Services and no reasonable alternative is available, Customer may terminate the affected portion of the Agreement without penalty, subject to payment for Services already provided. AquaRunner247 may continue to use the Subprocessor for unaffected Processing.

5.5 Subprocessor list. AquaRunner247 will maintain an up-to-date list of its authorized Subprocessors and their processing locations in Annex 3 or at the notice URL specified above.

6. Data Subject Requests and Regulatory Assistance

6.1 Data Subject requests. Taking into account the nature of the Processing, AquaRunner247 will provide reasonable assistance to Customer, through appropriate technical and organizational measures where possible, to help Customer respond to requests by Data Subjects to exercise their rights under Applicable Data Protection Law.

6.2 Forwarding requests. If AquaRunner247 receives a request from a Data Subject relating to Customer Personal Data, AquaRunner247 will, where legally permitted, promptly direct the requester to Customer and notify Customer. AquaRunner247 will not respond to the request except to acknowledge receipt or as required by law or as otherwise instructed by Customer.

6.3 Impact assessments and consultations. Taking into account the nature of the Processing and information available to AquaRunner247, AquaRunner247 will provide reasonable assistance to Customer with data protection impact assessments and prior consultations with Supervisory Authorities that are required under Applicable Data Protection Law for the Processing covered by this DPA. Customer will reimburse AquaRunner247 for reasonable costs of assistance beyond ordinary support, if disclosed to Customer in advance.

6.4 Customer cooperation. Customer will provide information reasonably necessary for AquaRunner247 to provide the assistance described in this Section and remains responsible for assessing and responding to Data Subject requests and regulatory obligations.

6.5 Requests touching compliance records retained after termination. Section 9.5 retains a defined set of compliance records without a fixed end date, including after the Agreement ends. Because a Data Subject request may reach those records when there is no longer a Customer to refer it to, the following process applies to them specifically and operates whether or not the Agreement is still in force:

a. Individual assessment. AquaRunner247 will assess each request against the specific records involved. It will not refuse a request on the basis that Section 9.5 exists.

b. Deletion of anything not required. AquaRunner247 will delete any Personal Data that is not necessary to keep a regulatory log intact, including Personal Data retained in error and any category outside Section 9.5(a) to (c).

c. Reasoned response where it cannot delete. Where AquaRunner247 cannot delete, it will identify the record, state the legal or regulatory basis it relies on and the period it expects that basis to apply, and assess whether the record can be reduced or pseudonymized further rather than retained as it stands.

d. Referral while the Agreement is in force. Where Customer is the Controller and remains contactable, AquaRunner247 will refer the request to Customer under Section 6.2 and act on Customer’s instructions, except that it will not act on an instruction to delete a record where retention is required by law.

e. Timing. AquaRunner247 will acknowledge a request of this kind within 10 business days and respond substantively within the period Applicable Data Protection Law requires of Customer, or within 30 days where no period applies.

f. Record of decisions. AquaRunner247 will keep a record of requests of this kind and their outcomes, and will make it available to Customer on request as audit information under Section 10.1.

7. Security Incidents and Personal Data Breaches

7.1 Notification. AquaRunner247 will notify Customer without undue delay, and in any case within 72 hours, after becoming aware of a Security Incident involving Customer Personal Data. Notification will be sent to the contact Customer maintains under Section 12.2. Where Customer has not designated a separate contact, notification will be sent to the email address associated with Customer’s Account — which, consistent with Section 22 of the Terms of Service, is the address of each user on the Account with the administrator role — and, where Customer has configured one, to its billing contact. Customer is responsible for keeping those addresses current; a notice sent to them is effective even if Customer has not designated a security contact.

7.2 Notification contents. To the extent information is reasonably available at the time, AquaRunner247’s notice will include:

a. a description of the nature of the Security Incident, including, where possible, the categories and approximate number of affected Data Subjects and records;

b. the likely consequences of the Security Incident;

c. the measures taken or proposed to address the Security Incident and mitigate possible adverse effects; and

d. a contact point for further information.

If not all information is available at once, AquaRunner247 may provide it in phases without undue further delay.

7.3 Response. AquaRunner247 will take reasonable steps to contain, investigate, and mitigate the Security Incident. AquaRunner247’s notice or response is not an admission of fault or liability.

7.4 Customer obligations. Customer is responsible for determining whether it must notify Data Subjects, a Supervisory Authority, or any other person or authority, and for making any such notification within applicable legal deadlines. Customer will not identify AquaRunner247 in a public statement concerning an incident without first consulting AquaRunner247, unless required by law.

8. International Transfers

8.1 Processing locations; map providers. AquaRunner247 stores Customer Personal Data in the United States, and all of its hosting, database, storage, email, telephony, payment, monitoring, and AI Subprocessors Process it in the United States.

Three map-related Subprocessors identified in Annex 3 operate from Europe: geocoding, driving-route calculation, and street map imagery. When a Customer or its users geocode an address, optimize a route, or view a map, property street addresses and the map coordinates of service stops are transmitted from the United States to those providers in Europe. No other category of Customer Personal Data is sent to them. These are transfers out of the United States rather than Restricted Transfers out of the EEA or the UK, so no Article 46 transfer mechanism is engaged; they are disclosed here because they are material to Customer’s own records of where its data goes.

AquaRunner247 will not make a Restricted Transfer of Customer Personal Data unless the transfer is permitted by Applicable Data Protection Law and subject to an appropriate transfer mechanism. If Processing or Subprocessor arrangements change such that a Restricted Transfer would occur, the Parties will implement a lawful transfer mechanism before the transfer occurs.

8.2 EU transfers. Where the EU GDPR applies and a Restricted Transfer is made from the European Economic Area to a country not recognized as providing an adequate level of protection, the Parties incorporate the EU Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 by reference. The Parties select Module Two: Controller to Processor. The SCCs apply as follows:

a. the data exporter is Customer, acting as Controller, and the data importer is AquaRunner247, acting as Processor;

b. the optional docking clause in Clause 7 is included;

c. the competent supervisory authority, governing law, and courts are as stated in Section 2 of Annex 3, which resolves each of them by reference to the data exporter’s place of establishment rather than leaving it open, in accordance with the SCCs and Applicable Data Protection Law;

d. Annex I of the SCCs is completed using the Parties’ details and the Processing details in Annex 1 to this DPA; and

e. Annex II of the SCCs is completed using the security measures in Annex 2 to this DPA.

The SCCs are incorporated without modification, except for completing the appendices and selections permitted by the SCCs. If this DPA conflicts with the SCCs, the SCCs prevail to the extent of the conflict.

8.3 UK transfers. Where the UK GDPR applies and a Restricted Transfer is made from the United Kingdom, the Parties incorporate the UK International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (“UK Addendum”) by reference, completed using the information in this DPA and Annexes 1–3. The UK Addendum is to be used with the EU SCCs described in Section 8.2, with Module Two selected. The UK Addendum’s mandatory text will not be modified, and its tables and required selections will be completed before the transfer. If the UK Addendum conflicts with this DPA, the UK Addendum prevails to the extent of the conflict.

8.4 Transfer assessments and supplementary measures. The Parties will cooperate in good faith, as required by Applicable Data Protection Law, to assess Restricted Transfers and implement any supplementary measures reasonably necessary for the transfer. Customer will provide relevant information about the transfer and its regulatory context; AquaRunner247 will provide reasonably available information about its Processing and security measures.

8.5 Other transfer mechanisms. Where another lawful transfer mechanism applies, the Parties may rely on that mechanism instead of the SCCs or UK Addendum. If a transfer mechanism is invalidated or ceases to be available, the Parties will cooperate to implement a lawful alternative.

9. Return and Deletion of Personal Data

9.1 Export and deletion. On termination or expiration of the Agreement, Customer may export Customer Personal Data using available Service functionality or request a copy where reasonably available. Customer Personal Data will remain available for export for 30 days after termination or expiration. Subject to Sections 9.2 and 9.5, AquaRunner247 will delete or return Customer Personal Data, at Customer’s choice and to the extent technically feasible, within 30 days after termination or expiration.

AquaRunner247 also takes an automatic archive of Customer Personal Data when it detects termination, as a safeguard against Customer losing records it has not yet exported. That archive is held in encrypted storage, is not used for any other purpose, and is deleted on the same schedule as the data it copies.

9.2 Backups and legal retention. Copies retained in routine backups will be deleted or overwritten in accordance with AquaRunner247’s ordinary backup cycle, which will not exceed 90 days after the applicable deletion date, unless retention for a longer period is required by law. Any retained data will remain protected under this DPA and will not be Processed except as required by law or for secure backup, restoration, or compliance purposes.

9.3 Certification. On Customer’s written request, AquaRunner247 will provide written confirmation of deletion or return of Customer Personal Data, subject to any retention permitted under Section 9.2.

9.4 Customer’s responsibility. Customer is responsible for exporting data it needs before access to the Services ends and for ensuring that its own copies, exports, and records are deleted or retained lawfully.

9.5 Compliance records retained after termination. Health-department compliance logging for a body of water attaches to that body of water rather than to the service company recording it, and the Services publish those logs at a QR code posted at the pool. So notwithstanding Section 9.1, AquaRunner247 retains the following after termination, without a fixed end date:

a. water-reading logs, contamination incident records, incident monitoring readings, and inspection reports;

b. the customer name, property, body-of-water, and service-visit records needed to identify and display those logs; and

c. customer portal accounts (an end customer’s name and email address), which are blocked from signing in but not deleted, so that an end customer can retain their own identity and records if they later contract with AquaRunner247 or another Organization directly.

Minimization of the retained set. The records retained under (b) are reduced to what the compliance log requires, and AquaRunner247 erases the following on termination:

• every contact person recorded against a property — the property manager, the on-site maintenance contact, the HOA manager, and, for a residential property, the owner — in each case their name, telephone numbers, and email address;
• the access directions for the property, including any gate or access code, and Customer’s free-text notes on the property;
• Customer’s notes and billing reference for a customer; and
• on every service visit, the technician assigned to it, technician notes, and the arrival GPS coordinates and accuracy.

What remains in (b) is the property’s name, type, postal address and map coordinates, the body of water’s own details, the customer’s name as the heading the log is published under, and each visit’s date and recorded times. The effect is that a retained compliance log identifies a property and the servicing business, and does not identify an individual. AquaRunner247 will not materially expand the categories retained under (a) to (c) without Customer’s agreement or a change notified under Section 14. Everything outside (a) to (c) is deleted on the Section 9.1 schedule.

Customer instruction. Customer, as Controller, instructs AquaRunner247 to carry out the retention described in this Section as part of the Services, and acknowledges that:

a. the retention is a documented instruction under Section 3 and under Clause 8.1 of the SCCs where they apply, and AquaRunner247 Processes the retained records only to make the compliance log available and to meet a legal or regulatory obligation — never to provide the Services to another customer, and never for AquaRunner247’s own commercial purposes;

b. Customer has determined that the retention is necessary and proportionate for the regulatory purpose described above, and is responsible for its own legal basis for it, for any notice or disclosure its own privacy notice must carry, and for informing the individuals whose Personal Data it concerns;

c. AquaRunner247 relies on this instruction, together with the legal-obligation ground available to it, when responding to a Data Subject or a Supervisory Authority about a retained record; and

d. Customer will notify AquaRunner247 if it determines that the retention is no longer lawful for a particular record or category, in which case the Parties will address it under Section 9.6.

9.6 Deleting a retained record. A Party may ask the other to delete a specific record retained under Section 9.5, and AquaRunner247 will comply unless retention is required by law or necessary to keep a regulatory log intact. A request originating from a Data Subject is handled under Section 6.5, which applies whether or not the Agreement is still in force. Where AquaRunner247 declines, it will identify the record, state the basis and expected duration, and assess whether the record can be reduced or pseudonymized further instead.

9.7 Residential properties. The public compliance log is published only for commercial bodies of water. Where a property is recorded as residential, the regulatory basis for Section 9.5 will usually not apply to it, and AquaRunner247 will delete its records on the Section 9.1 schedule on Customer’s or a Data Subject’s request.

10. Audits and Inspections

10.1 Audit information. Customer may request information reasonably necessary to demonstrate AquaRunner247’s compliance with this DPA, which AquaRunner247 may satisfy by providing this DPA, a summary of its security measures, relevant third-party certifications or audit reports, or responses to a reasonable written questionnaire, rather than an on-site audit, unless required by Applicable Data Protection Law. Where such information is insufficient, Customer may conduct or appoint an independent auditor to conduct an audit of relevant Processing, subject to this Section.

10.2 Audit conditions. An audit must:

a. be limited to the systems, facilities, and records relevant to the Processing of Customer Personal Data;

b. be conducted during normal business hours on at least 30 days’ prior written notice, except where a shorter period is required by a Supervisory Authority or following a Security Incident;

c. be conducted no more than once in any 12-month period, unless required by a Supervisory Authority, Applicable Data Protection Law, or a material Security Incident;

d. be conducted by an independent auditor bound by written confidentiality obligations and not reasonably considered a competitor of AquaRunner247;

e. avoid unreasonable disruption to AquaRunner247’s business and protect the confidentiality and security of other customers’ information; and

f. be at Customer’s expense, unless the audit identifies a material breach of this DPA by AquaRunner247, in which case AquaRunner247 will bear its reasonable audit costs.

10.3 Reports. Customer will provide AquaRunner247 with a copy of any audit report that relates to AquaRunner247’s compliance. Customer may use the report solely to assess compliance with this DPA and may not disclose it except to its professional advisers, a Supervisory Authority, or as required by law, subject to confidentiality obligations where legally permitted.

10.4 Alternative evidence. AquaRunner247 may satisfy an audit request by providing relevant independent audit reports, certifications, or other reasonable evidence of its security practices, to the extent available and sufficient to address the request.

11. Aggregated and De-Identified Data

AquaRunner247 may create and use data derived from the operation of the Services that has been aggregated or de-identified so that it does not reasonably identify Customer or any Data Subject (“Aggregated Data”) to analyze, improve, secure, and develop the Services and for other lawful business purposes. AquaRunner247 will not attempt to re-identify Aggregated Data and will maintain it in a form that does not reasonably identify Customer or any Data Subject. This Section does not authorize AquaRunner247 to use identifiable Customer Personal Data for those purposes.

12. Data Protection Contact

12.1 AquaRunner247 contact. Customer may direct privacy and data protection inquiries to:

Email: privacy@aquarunner247.com
Address: 732 S 6th St, Ste N, Las Vegas, NV 89101
Website: https://aquarunner247.com/privacy

12.2 Customer contact. Customer will maintain a contact for privacy and security notices. Because this DPA is ordinarily accepted electronically rather than executed, that contact defaults to Customer’s Account rather than to a field filled in here: unless Customer designates a different contact in writing or in an Order, the contact is each user on Customer’s Account holding the administrator role, at the email address recorded for them in the Services, and Customer’s notice address is the business address on its Account.

Customer may designate a dedicated privacy or security contact at any time by writing to privacy@aquarunner247.com, and should do so if notices of a Security Incident need to reach someone other than its account administrators. Customer is responsible for keeping these details current, and a notice sent to the defaulted contact is effective under Section 7.1 where Customer has designated no other.

Where the Parties execute this DPA rather than accepting it electronically, Customer may state its contact on the lines below. These are fields to be completed on execution rather than terms left unresolved: a blank line leaves the default in this Section 12.2 in place, and the DPA is complete either way.

Customer Contact (name or role):  __________________________________
Email:  __________________________________
Address:  __________________________________

13. Liability and Relationship to Agreement

13.1 Agreement liability terms. Except as provided in Section 13.2, liability arising under or in connection with this DPA is subject to the limitations, exclusions, and procedures set out in the Agreement, including its liability cap. For purposes of applying any cap in the Agreement to this DPA, claims arising under this DPA will be treated as claims arising under the Agreement.

13.2 Mandatory law. Nothing in this DPA limits a Party’s liability to the extent such limitation is prohibited by Applicable Data Protection Law. Nothing in this DPA limits or prejudices the rights or obligations of Data Subjects, Supervisory Authorities, or other persons under Applicable Data Protection Law, including rights and liabilities under the SCCs or UK Addendum.

14. Precedence and Amendment

14.1 Precedence. If there is a conflict between this DPA and the Agreement concerning the Processing of Personal Data, this DPA prevails and supersedes the Agreement on data-protection matters. If there is a conflict between this DPA and the SCCs or UK Addendum, the applicable SCCs or UK Addendum prevails for the relevant Restricted Transfer.

14.2 Amendments. Amendments to this DPA must be in writing or made through an electronic acceptance mechanism permitted by the Agreement. AquaRunner247 may update this DPA as reasonably necessary to reflect changes in Applicable Data Protection Law, the Services, or its Processing practices. If an update materially reduces Customer’s protections, AquaRunner247 will provide advance notice where practicable and Customer may terminate the affected Services before the update takes effect.

15. General

15.1 Notices. Notices under this DPA must be sent to the notice addresses or email contacts identified in the Agreement or this DPA. Subprocessor notices may be provided as specified in Section 5.3.

15.2 Severability. If any provision of this DPA is held unenforceable, the remaining provisions remain in effect, and the unenforceable provision will be modified to the minimum extent necessary to make it enforceable while preserving its intent.

15.3 No waiver. A failure or delay in exercising any right under this DPA does not waive that right.

15.4 Assignment. A Party may assign this DPA only as permitted under the Agreement, provided that any assignee agrees to be bound by it. Any assignment remains subject to applicable requirements under the SCCs or UK Addendum.

15.5 Entire agreement. This DPA, together with the Agreement and any applicable SCCs or UK Addendum, is the entire agreement between the Parties concerning the Processing of Customer Personal Data through the Services.

15.6 Electronic acceptance. This DPA may be accepted electronically, including through acceptance of the Agreement or use of an electronic signature process, and may be executed in counterparts.

Annex 1 — Details of Processing

1. Subject Matter

AquaRunner247’s provision of an all-in-one pool service route management and compliance mobile application and related portals, reporting, and support services to Customer.

2. Duration

For the term of the Agreement and any period during which AquaRunner247 retains Customer Personal Data in accordance with Section 9 of this DPA or as required by law.

3. Nature and Purpose of Processing

AquaRunner247 Processes Customer Personal Data as needed to provide, maintain, secure, and support the Services, including to:

• create and administer user accounts and permissions;
• manage route schedules, service visits, properties, and bodies of water;
• record and display arrival, departure, and visit information, including the geolocation fix captured at the moment of logged arrival at a service visit, timestamps, and photos taken during service visits. While a technician has an unfinished route open in the mobile app, the app reads device location continuously — including in the background, with background location permission — in order to detect arrival at a stop and departure from a stop that was not finished; only the fix that records an arrival is transmitted to AquaRunner247 and stored, a departure is transmitted as a time with no position attached, and the intervening positions are evaluated on the device and discarded;
• record water chemistry readings, dosage information, inspection checklists, and compliance records;
• display records through the customer portal for End Customers, inspector portals, reports, and pump room QR codes as configured or directed by Customer;
• provide route optimization and mobile app functionality, including offline data queuing and synchronization;
• extract structured equipment and inspection information from uploaded inspection reports;
• handle, record, and transcribe inbound calls to a Customer’s configured phone number and process call transcripts into structured service requests using the subprocessors listed in Annex 3;
• provide customer support, troubleshoot, and secure the Services; and
• perform other Processing documented in Customer’s use and configuration of the Services.

AquaRunner247 does not determine Customer’s purposes for the Personal Data Customer enters into the Services.

4. Categories of Personal Data

Depending on Customer’s use and configuration of the Services, Personal Data may include:

• technician and staff account details, such as names, work contact details, usernames, roles, and account activity;
• property, business, and individual contact details;
• location and geolocation information, including geofenced arrival records, departure times, and visit locations;
• geotagged and timestamped photos of pools, equipment, properties, and service visits;
• chemical readings, dosage records, service notes, and visit histories;
• state or local compliance inspection records, checklists, and related service documentation;
• equipment make, model, and serial number information extracted from uploaded reports, where associated with an identifiable person or property;
• call recordings and transcripts for inbound calls to a Customer’s configured phone number, including caller phone numbers and call content;
• technician GPS location captured at the moment of logged arrival at a service visit (AquaRunner247 stores the arrival fix only; a departure is stored as a time without a position, as described in Section 3 of this Annex);
• photos taken during service visits, including geotagged and timestamped images;
• gate codes, entry details, and access instructions;
• records shared with or made available to customers, inspectors, property managers, or others through customer portals, reports, QR codes, or email; and
• technical and usage information associated with accounts and use of the Services.

The Service is not designed to collect Social Security numbers, government ID numbers, health information, or similarly sensitive categories, and Customer agrees not to input such data into the Service. Customer will not intentionally submit special categories of Personal Data or highly sensitive Personal Data unless the Parties agree otherwise in writing.

5. Categories of Data Subjects

• Customer’s employees, technicians, contractors, and other authorized users;
• Customer’s residential customers and their household or property contacts;
• employees, agents, residents, tenants, guests, or other contacts associated with commercial properties serviced by Customer;
• property managers, inspectors, and other individuals whose information Customer enters into or makes available through the Services; and
• other individuals whose Personal Data Customer or its users submit to the Services.

6. Frequency of Processing and Transfers

Processing and transfers occur on a continuous, recurring, or event-driven basis as Customer and its users access and use the Services, including when they enter, upload, view, disclose, synchronize, or export information.

7. Processing Locations

Customer Personal Data is stored in the United States and Processed there by AquaRunner247 and by all of its authorized Subprocessors except the three map-related providers identified in Annex 3, which operate from Europe and receive only property street addresses and the map coordinates of service stops. See Section 8.1.

Annex 2 — Technical and Organizational Security Measures

AquaRunner247 will maintain technical and organizational measures designed to protect Customer Personal Data. The measures applicable to the Services include the following, as appropriate to the Processing and risks:

1. Encryption in Transit and at Rest

• Use encryption in transit for Personal Data transmitted between users’ devices, the Services, and applicable Subprocessors.
• Use encryption at rest for Personal Data stored in systems where available and appropriate.
• Restrict access to encryption keys and related secrets to authorized personnel and systems.

2. Access Controls and Least Privilege

• Limit access to Customer Personal Data to personnel and systems that require access for authorized business purposes.
• Use role-based permissions and authentication controls for administrative access.
• Review access rights periodically and revoke access when no longer required.
• Protect credentials and secrets through appropriate handling and storage practices.

3. Device and Session Management

• Use reasonable controls for administrative devices and user sessions, including session expiration or revocation where supported.
• Apply access controls to devices used by authorized personnel to administer or support the Services.
• Provide customers with account and user management features where available; Customer remains responsible for managing its users’ access.

4. Logging and Monitoring

• Collect server request logs, application error reports, and performance traces through the monitoring Subprocessors identified in Annex 3, and retain them under a rolling window of 90 days or less.
• Rely on the authentication, database, and platform logs maintained by the hosting and authentication Subprocessors identified in Annex 3 for records of administrative and infrastructure events.
• Restrict access to those logs to authorized personnel through the relevant provider’s access controls.
• Use monitoring and alerting designed to surface errors and anomalies and to support investigation of security events.

AquaRunner247 does not currently maintain an in-application audit trail of end-user actions within a Customer’s account, and does not represent that one exists. Where Customer requires such a trail, the Parties will address it in an Order.

5. Geofence and Photo Integrity

• Use application functionality to associate supported visit records and photos with relevant timestamps and location information.
• Apply reasonable controls to preserve the integrity of records as captured or synchronized through the Services.
• Use blur detection or similar functionality where available to flag potentially unclear photos; such functionality does not guarantee that a photo is accurate, complete, or acceptable for regulatory purposes.

6. Offline Queue Protections

• Use reasonable safeguards for Personal Data temporarily queued on a device while offline, including protections available through the mobile operating system and application.
• Synchronize queued records when connectivity returns, subject to normal technical limitations.
• Customer will instruct its users to protect devices, enable appropriate device security, and report lost or compromised devices promptly.

7. Backup and Disaster Recovery

• Maintain backups and recovery procedures designed to support restoration of the Services and Customer Personal Data.
• Restrict access to backups and apply appropriate security protections.
• Periodically assess backup and recovery processes, as appropriate to the Services.

8. Vulnerability and Patch Management

• Maintain processes designed to identify, assess, and address material vulnerabilities in systems used to provide the Services.
• Apply security updates and patches within a timeframe appropriate to the severity of the issue and operational risk.
• Use reasonable development and deployment practices to reduce security risks.

9. Personnel Training and Confidentiality

• Require personnel authorized to access Customer Personal Data to be subject to confidentiality obligations.
• Provide personnel with security and privacy training appropriate to their roles.
• Maintain procedures for reporting and responding to suspected security incidents.

10. Physical Security and Hosting

• Use hosting and infrastructure providers that maintain physical security measures appropriate to their role, including controls designed to restrict physical access to facilities and systems where Customer Personal Data is stored.
• Review Subprocessors in a manner appropriate to the nature of the services they provide and the Personal Data they Process.

11. Security Program Review

AquaRunner247 will periodically review the measures described in this Annex and may update them to reflect changes in technology and industry practices, provided that it does not materially reduce the overall protection of Customer Personal Data.

Annex 3 — Approved Subprocessors and Transfer Clauses

1. Approved Subprocessors

Customer authorizes AquaRunner247 to engage the Subprocessors listed below, subject to Section 5 of this DPA. This list is stated as of the effective date of this DPA and will be maintained and updated as set out in Section 5.3.

The three providers marked Europe receive only street addresses and map coordinates, and receive them only when a Customer or its users geocode an address, optimize a route, or view a map. They receive no chemistry readings, inspection records, photos, documents, call recordings, contact names, email addresses, or telephone numbers. AquaRunner247 relies on the publicly published usage policies and privacy notices of those providers rather than on a negotiated data processing agreement, and Section 5.2 is qualified accordingly for them. Customer may object to any of the three under Section 5.4; the affected feature can be disabled for Customer’s account.

Intuit is not a Subprocessor. The Services generate accounting files in a QuickBooks-compatible format that a Customer administrator downloads. Nothing is transmitted to Intuit or to a QuickBooks account by the Services.

AquaRunner247 will provide notice of additions or replacements as set out in Section 5.3 and will maintain the current approved list at https://aquarunner247.com/subprocessors.

2. EU Standard Contractual Clauses — Module Two

Where required under Section 8.2:

• Module selected: Module Two — Controller to Processor.
• Data exporter: Customer, as identified in the Agreement.
• Data importer: AquaRunner247 LLC, 732 S 6th St, Ste N, Las Vegas, NV 89101.
• Processing details: Annex 1 to this DPA.
• Security measures: Annex 2 to this DPA.
• Approved Subprocessors: This Annex 3, subject to the general authorization and notice provisions in Section 5.
• Competent Supervisory Authority (Clause 13): The supervisory authority of the EU Member State in which the data exporter is established. Where the data exporter is not established in an EU Member State but has appointed a representative under Article 27 GDPR, the authority of the Member State in which that representative is established. Where neither applies, the authority of the Member State in which the Data Subjects whose Personal Data is transferred are located.
• Governing law (Clause 17): Option 2 — the law of the EU Member State in which the data exporter is established. Where that Member State’s law does not allow for third-party beneficiary rights, the law of Ireland.
• Courts (Clause 18): The courts of the EU Member State in which the data exporter is established. Where the data exporter is not established in an EU Member State, the courts of Ireland.
• Optional docking clause (Clause 7): Included.
• Clause 9 (Subprocessors): Option 2 — general written authorization, with the notice period in Section 5.3 of this DPA.
• Clause 11 (Redress): The optional independent dispute resolution body is not selected.
• Annex I.A (Parties): The Parties’ details in the Agreement and in this Annex. Annex I.B (Processing): Annex 1 to this DPA. Annex I.C (Supervisory authority): as stated above. Annex II: Annex 2 to this DPA. Annex III: Section 1 of this Annex.

These selections are the defaults that apply where no Order or separately executed data transfer agreement states otherwise, so that no selection is left open. They are stated here rather than left blank because an unselected Clause 17 or 18 leaves the SCCs incomplete and unusable.

The Parties incorporate by reference the unmodified text of the EU Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914.

AquaRunner247 does not currently make Restricted Transfers. The Services are offered for use in the United States, Customer Personal Data is stored in the United States, and the three Europe-based map providers in Section 1 above receive data travelling out of the United States rather than out of the EEA or the UK (see Section 8.1). This Section and Section 3 below therefore operate only if that changes — a Customer established in the EEA or the UK should agree the Annex I and Table entries for its own transfer in writing before the transfer begins.

3. UK International Data Transfer Addendum

Where required under Section 8.3, the Parties incorporate by reference the UK International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner’s Office, completed as follows:

• Parties and key information: As set out in the Agreement, this DPA, and Section 2 of this Annex.
• Selected EU SCC module: Module Two — Controller to Processor.
• Tables and required details: To be completed using the Parties’ details and Annexes 1–3 of this DPA.
• UK Addendum version: Template Addendum B.1.0, in force 21 March 2022, issued by the Information Commissioner under section 119A(1) of the Data Protection Act 2018.
• Table 1 (Parties): The Parties’ details in the Agreement and in Section 2 of this Annex. Table 2 (Selected SCCs): the EU SCCs in Section 2 of this Annex, Module Two, as amended by the UK Addendum. Table 3 (Appendix information): Annexes 1 and 2 to this DPA, and Section 1 of this Annex.
• Table 4 (Ending the Addendum when the Approved Addendum changes): Importer.
• Start date: The Effective Date of this DPA, or the date the relevant Restricted Transfer begins if later.

The UK Addendum’s mandatory text is incorporated without modification. As with Section 2, these entries are stated so that nothing is left blank; AquaRunner247 does not currently make Restricted Transfers from the United Kingdom.

4. Signature and Acceptance

This DPA forms part of the Agreement and is ordinarily accepted electronically, at the same time and in the same act as the Terms of Service, the End User License Agreement and the Privacy Policy — AquaRunner247 records the accepting user, the date and time, and the version accepted. No signature is required for this DPA to bind the Parties, and the blocks below are for a Customer that requires a countersigned copy; leaving them blank does not affect the DPA’s effect.

Customer

Legal name:  __________________________________
Signature:  __________________________________
Name:  __________________________________
Title:  __________________________________
Date:  __________________________________

AquaRunner247

Legal name: AquaRunner247 LLC
Signature:  __________________________________
Name:  __________________________________
Title:  __________________________________
Date:  __________________________________

Version History

This document is for informational purposes only and should be reviewed by a licensed attorney before execution.