Data Processing Addendum
US business customers | DPA 2026-11-06.1
1. Parties, scope and instructions
This DPA forms part of the Customer Subscription and Services Agreement between Trussted Roofing LLC, operating Pro Studio CRM (Provider), and the Customer identified in the accepted Order Summary, when that version of this DPA is expressly included in the acceptance record. Customer is ordinarily the controller/business for Customer Personal Data; Provider acts as processor/service provider to the extent those roles apply under applicable US privacy law. If Customer acts for another controller, Customer must have authority to give the instructions here. Provider's own billing, account-security and legal-administration information is addressed in the Privacy Notice to the extent Provider determines its processing purposes independently.
Customer Personal Data means personal information submitted to or processed through the CRM on Customer's behalf. Provider will process it only to supply, secure and support the agreed service, on Customer's documented lawful instructions, or as legally required. The Agreement, accepted Order Summary, authorized product settings and written service requests are instructions. Provider will inform Customer if it reasonably believes an instruction violates applicable privacy law, and may suspend the affected processing while the issue is resolved. No term requires unlawful processing.
2. Processing description
Subject matter and nature: hosting and retrieving business records; contact and job management; estimating and report extraction; generation and storage of proposals and job cards; customer-directed email, scheduling, payment references and shared links; optional AI assistance; setup, troubleshooting, security and support. Operations include collection, storage, organization, retrieval, analysis for an authorized feature, disclosure to authorized recipients, correction, export and deletion.
Duration and frequency: recurring during the service term, setup and support as requested, and limited return/deletion or legally necessary retention afterward. People: Customer's users, employees, homeowner customers/prospects, crew members, supplier contacts and other business contacts. Data: identity/contact and property details; job, estimate, pricing and scheduling records; photos/reports and documents; communications; account/user identifiers; payment references; and AI prompts/context needed for an enabled feature. Sensitive regulated data identified as prohibited in the Agreement is outside the intended scope. Customer determines the lawful basis, required notices, permissions, and accuracy of submitted information.
3. Restricted use and confidentiality
Provider will not sell or share Customer Personal Data for cross-context behavioral advertising, retain/use/disclose it outside the specified business purposes or direct business relationship except as legally permitted, or combine it with data from other customers or its own unrelated activities except as permitted for a lawful service-provider purpose. Provider certifies that it understands these restrictions and will comply with them where applicable. Provider will not use it to solicit roofing work, build unrelated marketing lists, or authorize general-purpose AI model training on identifiable Customer content without a separate lawful instruction and required consent.
Personnel may access data only as reasonably necessary for their duties and must be bound by confidentiality obligations. Provider remains responsible for authorized personnel and its appointed subprocessors in performing its obligations. Customer will restrict account access, promptly remove former users, protect credentials, and avoid unnecessary personal data in tickets and prompts.
4. Safeguards and incidents
Provider will maintain reasonable, risk-appropriate safeguards addressing access control, authentication, tenant separation, protected transmission, credential/secret handling, change management, logging, vulnerability response, data minimization, deletion and recovery. Annex B describes the safeguards and responsibilities for the service; no certification, particular encryption coverage, uptime level, or recovery objective is represented unless expressly documented and verified.
Provider will notify Customer without undue delay after becoming aware of a confirmed breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data in Provider's control. A failed attack without compromise is not by itself a reportable breach under this clause. Notice will include available information about the nature, affected data/people, likely consequences, contact point and response measures; missing details may follow in stages. Provider will investigate, mitigate and reasonably cooperate, preserve relevant evidence where appropriate, and meet any shorter legally applicable deadline. Customer determines its own notices to individuals or authorities unless law requires Provider to notify directly. Notice is not an admission of fault.
5. Subprocessors and integrations
Customer authorizes the subprocessors listed in Annex A for the features Customer uses at acceptance. Before appointing a new or replacement subprocessor with access to Customer Personal Data, Provider will give at least 30 days' notice identifying its role and relevant locations, subject to urgent changes needed for security or continuity, for which notice will be given as soon as practicable. Customer may object within that period on reasonable, specific data-protection grounds. The parties will seek an alternative or mitigation. If unresolved, Customer may end the affected service before the new processing begins and receive a refund of prepaid unused affected service fees. For an urgent change, the parties will promptly address any reasonable objection and the same termination/refund option applies if no resolution is available.
Provider will impose written confidentiality, purpose-limitation and data-protection obligations appropriate to each subprocessor and remain responsible for its performance of the processing obligations assigned to it. A customer-selected integration acting under Customer's direct account is not automatically a Provider-appointed subprocessor. The register must identify that distinction. US-only customer eligibility is not a data-residency guarantee. No international transfer mechanism is represented by this DPA; if a transaction requires additional transfer terms, they must be completed before the affected transfer.
6. Assistance, verification and legal requests
Provider will reasonably assist Customer with lawful access, correction, deletion, portability, opt-out, security, risk-assessment and regulator requests, taking account of the processing and information available. If an individual's request concerns data controlled by Customer, Provider will refer it to Customer or notify Customer unless legally prohibited. Provider will not make an independent substantive decision on Customer's behalf without instructions or legal obligation.
Provider will make reasonably necessary information available to demonstrate compliance and permit reasonable assessments or audits by Customer or a qualified independent assessor bound to confidentiality, with advance notice, proportionate scope and safeguards for other customers' data. Existing documentation or a suitable independent report may satisfy a request where adequate. Routine audits may be coordinated to avoid unnecessary disruption; restrictions do not prevent legally required oversight or a justified review after a material incident. Customer may take reasonable steps to verify, stop and remediate unauthorized processing. Provider will notify Customer if it can no longer meet applicable obligations.
Ordinary assistance included in service and work required to remedy Provider's own breach are not subject to a new service fee. Unusual, optional assistance may be quoted in advance and requires approval; a fee dispute must not delay nonwaivable legal duties. Provider will notify Customer of binding third-party disclosure demands where legally permitted, disclose only what is required, and reasonably cooperate with lawful protective measures.
7. Return, deletion, priority and execution
At termination, Customer may request a standard available export within 30 days, without an additional standard-export fee. Provider will retain data for that window unless lawful deletion instructions require otherwise, then delete operational copies within a further 30 days. Customer may instruct earlier deletion after export. Residual backups are isolated from ordinary use and deleted within 90 days after operational deletion; restored data must remain subject to prior deletion instructions. Retention legally required for records, disputes or security is limited to that purpose, protected and deleted when no longer needed. Provider will confirm completion on reasonable request.
This DPA controls a conflict about processing Customer Personal Data; the main Agreement governs other matters, including lawful liability limitations, which this DPA neither expands nor overrides except as required by law. Obligations continue while Provider retains Customer Personal Data. Acceptance of the identified DPA, Annex A and Annex B can occur in the same electronic signature as the main Agreement; no separate handwritten signature is required. A generic link to a future-changing annex is not a substitute for retaining the accepted version.
Annex A. Service providers and optional integrations
Cloudflare, Inc.: application execution, database, network security and file storage; processes CRM content and technical/session information needed for hosting. Its global network and support operations may process data in the United States and other countries; no dedicated geographic residency is promised. See cloudflare.com/privacypolicy and cloudflare.com/cloudflare-customer-dpa.
OpenAI: AI assistance and enabled report-processing features; processes prompts, supplied conversation/form context, and files or extracted content needed for the selected feature. Processing and support can occur in the United States and other countries used by the service. OpenAI's applicable business terms and DPA govern the service-provider relationship; no zero-retention commitment is made. See openai.com/policies/business-terms and openai.com/policies/data-processing-addendum.
Plus Five Five, Inc. (Resend): service, billing and support email; processes recipient/sender details, message content, attachments and delivery records. Its published subprocessors principally operate in the United States; international access and onward processing remain subject to its terms. See resend.com/legal/privacy-policy and resend.com/legal/dpa.
Stripe, Inc.: billing identity, payment details entered at checkout, transaction and fraud information. Stripe has independent legal, security and regulatory purposes as well as processing roles under its applicable terms; it is not solely Provider's subprocessor. See stripe.com/privacy and stripe.com/legal/dpa. Customer-connected Google Calendar/Apps Script and Square accounts process the selected appointment, contact or payment information under Customer's direct agreements; they are optional integrations, not blanket authorization to access other Customer records.
Optional public inquiry delivery: Web3Forms can receive public consultation-form information when enabled. It does not receive CRM job records through that form feature. It is used for Provider's own website inquiries, outside the Customer-content processor role described in this DPA. Provider does not engage other businesses to market with Customer content. Newly appointed subprocessors remain subject to Section 5 notice and objection rights.
Annex B. Security responsibilities
Provider restricts service administration to authorized personnel, uses authenticated sessions and role/workspace controls, hashes user passwords, protects saved integration credentials with server-side encryption, and uses HTTPS for the public service and provider connections. Support access is limited to service duties. Provider maintains reasonable procedures for updates, incident response, export/deletion requests and restricted record retention. Customer must use individual accounts, protect devices and credentials, remove former users, review sharing links and keep independent copies of records it must retain. No certification, end-to-end encryption guarantee, particular recovery time or uninterrupted service is represented. Infrastructure safeguards supplement these duties and do not eliminate Provider's responsibility under this DPA.