Data Processing Addendum

This DPA is entered into between Customer (the party subscribing to the Crewnyx platform, as identified in the applicable order form or account signup) and Sparky Venture Labs LLC, a Florida limited liability company (206 South Grove Street, Eustis, FL 32726, USA).

This DPA is automatically incorporated into and forms part of the Agreement between the parties. Customer accepts this DPA by (a) accepting the Terms of Service, (b) signing an order form that references this DPA, or (c) using the Service in a way that involves Sparky Venture Labs LLC processing Personal Data on Customer's behalf. No separate signature is required, but Sparky Venture Labs LLC will countersign a written copy on request from a Customer authorized representative.

Capitalized terms not defined here have the meanings given in the Terms of Service. In addition:

• "Applicable Data Protection Law" means all data protection and privacy laws applicable to a party's processing of Personal Data under this DPA, including the EU General Data Protection Regulation (Regulation 2016/679, "GDPR"), the UK GDPR and Data Protection Act 2018 ("UK GDPR"), the Swiss Federal Act on Data Protection ("FADP"), the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), and other U.S. state comprehensive privacy laws.
• "Controller", "Processor", "Data Subject", "Personal Data", "Processing", and "Personal Data Breach" have the meanings given in the GDPR.
• "Business", "Service Provider", and "Sell"/"Share" have the meanings given in the CCPA/CPRA.
• "Customer Personal Data" means Personal Data contained in Customer Data (as defined in the Terms of Service).
• "Standard Contractual Clauses" or "SCCs" means the European Commission's Standard Contractual Clauses set out in Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
• "UK Addendum" means the UK International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner's Office under section 119A of the Data Protection Act 2018 (v. B1.0, in force 21 March 2022).

For Customer Personal Data, Customer is the Controller (or Business) and Sparky Venture Labs LLC is the Processor (or Service Provider). Each party will comply with its own obligations under Applicable Data Protection Law.

Customer is responsible for the lawfulness of the processing it instructs, including giving every notice to, and obtaining every consent or acknowledgment from, its personnel that applicable law requires before using location, geofencing, vehicle-tracking, clock-photo, and similar features.

For Personal Data that Sparky Venture Labs LLC determines the means and purposes of — for example, account, billing, and website-usage data — Sparky Venture Labs LLC acts as an independent Controller under its Privacy Policy. That processing is outside the scope of this DPA.

Sparky Venture Labs LLC will process Customer Personal Data only on documented instructions from Customer, including with regard to transfers to a third country or an international organization, unless required to do otherwise by Union, Member State, UK, or U.S. law to which Sparky Venture Labs LLC is subject. In such a case, Sparky Venture Labs LLC will inform Customer of that legal requirement before processing, unless the law prohibits such information on important grounds of public interest.

Customer's instructions are: (a) the Agreement (including the Terms of Service, this DPA, and any order form); (b) Customer's use of the Service and its administrative configuration options; and (c) any additional documented instructions Customer sends to support@crewnyx.com that are consistent with the Service.

Sparky Venture Labs LLC will inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Law.

The subject matter, nature, purpose, duration, categories of Data Subjects, and types of Personal Data are set out in Annex 1.

Sparky Venture Labs LLC ensures that persons authorized to process Customer Personal Data are bound by contractual or statutory confidentiality obligations and are trained on their responsibilities. Sparky Venture Labs LLC follows the principle of least-privilege access: personnel are granted only the access necessary to perform their duties, and administrative access is logged and reviewed.

Sparky Venture Labs LLC has implemented appropriate technical and organizational measures to protect Customer Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, damage, alteration, or disclosure. Those measures are described in Annex 2 and take into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the processing, as well as the risk of varying likelihood and severity for the rights and freedoms of Data Subjects.

Customer provides Sparky Venture Labs LLC with a general authorization to engage Subprocessors, provided that Sparky Venture Labs LLC:

• maintains an up-to-date list of Subprocessors, including the name, purpose, and processing location of each, and provides it to Customer administrators on written request to support@crewnyx.com under customary confidentiality terms;
• imposes on each Subprocessor data-protection obligations that are substantively equivalent to those in this DPA, in particular providing sufficient guarantees to implement appropriate technical and organizational measures;
• remains fully liable to Customer for the acts and omissions of its Subprocessors; and
• gives Customer at least thirty (30) days' advance notice of any new Subprocessor via the Subprocessor-notice email list (subscribe by emailing support@crewnyx.com with the subject line "Subprocessor Notice — Subscribe") and, on request from Customer, directly to Customer's designated privacy contact.

Customer may object in writing to a new Subprocessor within fifteen (15) days after notice on reasonable data-protection grounds. If Customer objects, Sparky Venture Labs LLC will use commercially reasonable efforts to make the Service available without the objected-to Subprocessor. If Sparky Venture Labs LLC is unable to do so, Customer may terminate the affected portion of the Service and receive a prorated refund of prepaid, unused fees for that portion.

Sparky Venture Labs LLC processes Customer Personal Data primarily in the United States. To show the approximate street address of a clock punch, the punch's coordinates may be sent to address-lookup providers in the European Union and Australia (see the Subprocessors in the Privacy Policy). Where Applicable Data Protection Law requires an approved transfer mechanism for transfers out of the EEA, the UK, or Switzerland to the United States, the parties agree as follows:

• EEA transfers. The SCCs are incorporated by reference and form part of this DPA. Module Two (Controller to Processor) applies between Customer as data exporter and Sparky Venture Labs LLC as data importer. In the SCCs: (a) Clause 7 (docking clause) is included; (b) the option in Clause 9(a) is Option 2 (general written authorization), with the notice period set out in Section 8 above; (c) the optional redress clause in Clause 11(a) is not selected; (d) Clause 17 (governing law) is the law of Ireland; (e) Clause 18 (forum and jurisdiction) is Ireland; and (f) the information in Annexes I, II, and III of the SCCs is provided in Annexes 1 and 2 to this DPA and on the Subprocessor page.
• UK transfers. The UK Addendum is incorporated by reference. Tables 1–3 are completed using the information in this DPA and its Annexes; in Table 4, both parties may end the UK Addendum as permitted by section 19.
• Swiss transfers. Where the FADP applies, references in the SCCs to the GDPR are read as references to the FADP as necessary, and references to EU member-state supervisory authorities include the Swiss Federal Data Protection and Information Commissioner.

Sparky Venture Labs LLC maintains supplementary measures (encryption in transit and at rest, strict access controls, and internal policies for handling government access requests) so that the level of protection provided by Applicable Data Protection Law is not undermined by the transfer.

Taking into account the nature of the processing, Sparky Venture Labs LLC will assist Customer by appropriate technical and organizational measures, insofar as possible, so Customer can fulfill its obligations to respond to requests from Data Subjects to exercise their rights (access, rectification, erasure, restriction, objection, portability, and rights relating to automated decision-making).

If Sparky Venture Labs LLC receives a request directly from a Data Subject that concerns Customer Personal Data, Sparky Venture Labs LLC will not respond substantively and will promptly forward the request to Customer. Customer is responsible for handling the request. In-product self-service tools are provided so Customer can access, export, and delete Customer Personal Data.

Sparky Venture Labs LLC will notify Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notice will describe, to the extent then known, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures Sparky Venture Labs LLC has taken or proposes to take to address the breach and mitigate its adverse effects.

Sparky Venture Labs LLC will cooperate with Customer's reasonable investigation, take steps to mitigate and remediate, and provide follow-up information as it becomes available. Sparky Venture Labs LLC's notification of a breach is not an admission of fault or liability.

Sparky Venture Labs LLC will provide reasonable assistance to Customer with any data protection impact assessments and prior consultations with supervisory authorities that Customer is required to carry out under Applicable Data Protection Law, taking into account the nature of the processing and the information available to Sparky Venture Labs LLC.

On termination or expiration of the Agreement, and at Customer's choice, Sparky Venture Labs LLC will delete or return all Customer Personal Data to Customer, and delete existing copies, unless Union, Member State, UK, or U.S. law requires storage of the Personal Data. In practice, Customer has thirty (30) days after termination to export Customer Personal Data; after that, Sparky Venture Labs LLC will delete Customer Personal Data from active systems within thirty (30) days after Customer's written request (and in any case within twelve (12) months after termination), and from any backups within ninety (90) days after that.

Sparky Venture Labs LLC will make available to Customer all information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR (and equivalent obligations under other Applicable Data Protection Law), and will allow for and contribute to audits, including inspections, conducted by Customer or an auditor mandated by Customer.

To satisfy audit obligations, Sparky Venture Labs LLC will provide, on written request and no more than once per twelve-month period (unless required by a supervisory authority or triggered by a Personal Data Breach), summary attestations, third-party audit reports (such as SOC 2 Type II reports of its Subprocessors), penetration-test executive summaries (redacted as reasonably necessary), and reasonable responses to written security questionnaires. On-site audits will be scheduled with at least thirty (30) days' advance notice, conducted during business hours, and structured to avoid unreasonable disruption. Auditors must sign confidentiality agreements and may not be direct competitors of Sparky Venture Labs LLC.

For Personal Information (as defined in the CCPA/CPRA) that Sparky Venture Labs LLC processes on Customer's behalf, Sparky Venture Labs LLC is a Service Provider and Customer is a Business. Sparky Venture Labs LLC will:

• process Personal Information only for the specific business purposes set out in the Agreement, and not for any other purpose;
• not "sell" or "share" Personal Information as those terms are defined in the CCPA/CPRA;
• not retain, use, or disclose Personal Information outside the direct business relationship between the parties, or for any commercial purpose other than the business purposes specified in the Agreement;
• not combine Personal Information received from Customer with Personal Information received from or on behalf of another person or collected from Sparky Venture Labs LLC's own interactions with a consumer, except as permitted by the CCPA/CPRA;
• comply with applicable CCPA/CPRA obligations and provide the same level of privacy protection as required by the CCPA/CPRA; and
• notify Customer if Sparky Venture Labs LLC determines it can no longer meet its obligations under the CCPA/CPRA, and allow Customer to take reasonable and appropriate steps to stop and remediate unauthorized use of Personal Information.

Customer certifies that it understands the restrictions in this section and will comply with its own obligations under the CCPA/CPRA.

Each party's liability arising out of or related to this DPA, whether in contract, tort, or otherwise, is subject to the limitations and exclusions of liability set out in the Terms of Service. Nothing in this DPA affects liabilities that cannot be limited under Applicable Data Protection Law (including, in the EEA and UK, Data Subjects' rights to compensation under Article 82 GDPR).

This DPA is effective for as long as Sparky Venture Labs LLC processes Customer Personal Data on Customer's behalf. In the event of any conflict between this DPA and the Terms of Service regarding the processing of Personal Data, this DPA prevails. In the event of any conflict between this DPA and the SCCs or UK Addendum, the SCCs or UK Addendum prevail.

Notices under this DPA must be sent to support@crewnyx.com and to Sparky Venture Labs LLC, Attn: Legal, 206 South Grove Street, Eustis, FL 32726, USA.

Data exporter (Controller): Customer, as identified in the Agreement.

Data importer (Processor): Sparky Venture Labs LLC, 206 South Grove Street, Eustis, FL 32726, USA. Contact: support@crewnyx.com.

Categories of Data Subjects: Customer's employees, contractors, administrators, and — to the extent Customer chooses to store them — Customer's own end customers (for example, homeowners at whose sites field work is performed).

Categories of Personal Data: name, work email, work phone, role, team, profile photo (optional), hashed authentication credentials, time-entry records (clock-in / clock-out, job type, lunch, overtime), approximate device geolocation at clock events (if enabled), best-effort audit GPS coordinates, job-note content, internal-message content, receipt metadata (merchant, amount, payment type, card last four, purchase date), Slack channel identifiers, calendar-event metadata, IP address, device and log data.

Sensitive categories: none intentionally collected. Hashed passwords and, where enabled, precise clock-event coordinates are treated as sensitive under CCPA/CPRA and are used only for their stated purposes.

Frequency of transfer: continuous, for the duration of the Subscription Term.

Nature and purpose of processing: provision of the Crewnyx field-operations Service, including hosting, authentication, storage, notifications, scheduling, integrations, support, and billing.

Retention: as described in Sections 11 and 13, and in the Privacy Policy.

Subprocessors: the current specific list is provided to Customer administrators on written request to support@crewnyx.com under customary confidentiality terms.

Competent supervisory authority: where the SCCs apply, the supervisory authority of the EU member state in which the data exporter is established or, where it is not established in the EU, the supervisory authority determined by Clause 13 of the SCCs. Where the UK Addendum applies, the UK Information Commissioner's Office.

Sparky Venture Labs LLC implements the following measures. Specific controls may evolve over time; the parties agree that Sparky Venture Labs LLC may substitute measures that provide at least an equivalent level of security.

• Encryption. TLS 1.2+ for all data in transit; encryption at rest by the hosting and database providers; third-party integration credentials additionally encrypted with AES-256-GCM; passwords hashed with a modern, salted algorithm.
• Access control. Two-factor authentication required for every User account and for Sparky Venture Labs LLC's administrative console, with lockouts after repeated failed sign-in and code attempts; role-based access within each Organization; least-privilege access for anyone at Sparky Venture Labs LLC.
• Multi-tenancy. Logical separation between Organizations enforced inside the database, with an automated test run every night that checks one Organization cannot read another's data.
• Network security. Managed cloud hosting behind a DDoS-mitigated edge network, and rate limits on sign-in and two-factor attempts.
• Application security. Automated correctness and security checks on every production build, regular dependency updates, and monitoring of security advisories.
• Vulnerability management. Reported and discovered vulnerabilities are prioritized by severity and fixed as quickly as practicable.
• Logging and monitoring. Logs of security-relevant events (sign-in, two-factor, administrative actions, integration errors), with alerts to Sparky Venture Labs LLC's administrators.
• Backups. Customer Personal Data is stored with a managed database provider. Sparky Venture Labs LLC may also keep off-site backup copies, which are encrypted before they leave Sparky Venture Labs LLC's systems with keys only Sparky Venture Labs LLC holds. Every backup is encrypted and deleted within ninety (90) days.
• Personnel. Confidentiality obligations for anyone given access, and access removed when it is no longer needed.
• Vendor management. Sparky Venture Labs LLC's core infrastructure providers (hosting, database, payments, email) maintain SOC 2 Type II or equivalent attestations; other Subprocessors are chosen for the limited data they receive.
• Incident response. Sparky Venture Labs LLC investigates and contains security incidents and notifies Customer as Section 11 requires, including within 72 hours where that obligation applies.
• Physical security. All production infrastructure is hosted in facilities operated by cloud providers with SOC 2 Type II (and typically ISO 27001) certifications; Sparky Venture Labs LLC does not operate its own data centers.