Data Processing Agreement

This Data Processing Agreement ("DPA") is entered into between Auxi Services, LLC ("Processor") and the client entity ("Controller") that uses the Auxi platform for property maintenance, preservation, or facility management services. This DPA supplements the Master Services Agreement or Terms of Service between the parties and applies to all personal data processed on behalf of the Controller in connection with the Auxi platform, including: • Tenant contact information provided in work orders • Property access credentials (gate codes, lockbox codes) • Vendor and subcontractor personal data • Client employee and team member data stored in the portal • Billing and payment information

The Controller determines the purposes and means of processing personal data. The Processor processes data only on documented instructions from the Controller, including this DPA and the platform's configuration. Processor responsibilities: • Process personal data only to deliver the agreed services • Implement appropriate technical and organizational security measures • Assist the Controller in responding to data subject requests • Notify the Controller of any data breach without undue delay (within 72 hours) • Delete or return all personal data upon termination of services Controller responsibilities: • Ensure lawful basis for all data provided to the Processor • Maintain accurate records of data subject consents • Define data retention requirements applicable to their records • Notify the Processor of any data subject requests received directly

The Processor maintains the following security safeguards: • TLS 1.2+ encryption for all data in transit • AES-256 encryption for data at rest • Role-based access control (RBAC) with least-privilege principles • Multi-factor authentication for administrative access • Regular vulnerability scanning and penetration testing • Audit logging of all data access and modifications • Secure payment processing via Stripe (PCI DSS Level 1) • Vendor banking details restricted to authorized finance personnel Security measures are reviewed annually and updated in response to emerging threats.

In the event of a personal data breach, the Processor will: 1. Identify and contain the breach immediately upon discovery 2. Assess the scope and potential impact on data subjects 3. Notify the Controller without undue delay and no later than 72 hours after becoming aware of the breach 4. Provide the Controller with all relevant information to fulfill their own breach notification obligations under applicable law 5. Take reasonable steps to mitigate the effects of the breach 6. Conduct a post-incident review and implement corrective measures "Breach" means a security incident leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data.

The Processor engages the following categories of sub-processors to deliver its services: • Cloud hosting and infrastructure providers • Payment processing (Stripe) • Email delivery services • Analytics and monitoring tools • AI/ML processing services for work order triage and insights The Controller grants general authorization for these sub-processors. The Processor remains liable for the performance of all sub-processors and ensures they are bound by written agreements providing at least the same level of data protection as this DPA. The Processor will notify the Controller of any intended changes to sub-processors, giving the Controller the opportunity to object.

The Processor will assist the Controller in fulfilling its obligations to respond to data subject requests, including: • Right to access personal data • Right to rectification of inaccurate data • Right to erasure ("right to be forgotten") • Right to restrict processing • Right to data portability • Right to object to processing Requests are processed within 30 days of receipt. The Processor will not respond directly to data subject requests without the Controller's authorization, except to confirm whether personal data is being processed.

Upon termination of services, the Processor will: • Delete all personal data within 90 days, unless retention is required by law • Provide a written certificate of deletion upon request • Retain only anonymized, aggregated data for analytics purposes Mandatory retention periods override deletion requests: • Financial/tax records: 7 years (IRS) • Vendor compliance documents: 7 years • Audit logs: 5 years • Litigation-hold data: until released by legal counsel

The Controller has the right to audit the Processor's compliance with this DPA, subject to: • 30 days' prior written notice • Conducted during normal business hours • No more than once per calendar year • Non-disclosure of Processor's confidential information Alternatively, the Processor will provide an annual independent security audit report (e.g., SOC 2 Type II) upon reasonable request.