Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Night Lite USA LLC, 25200 Carlos Bee Blvd, Hayward, CA 94542, and the Customer and supplements the Terms with respect to the processing of personal data. Developer312 is a brand (dba) of Night Lite USA LLC. Night Lite USA LLC is the contracting Processor.

This DPA applies where Night Lite USA LLC processes personal data on behalf of the Customer in connection with the Eco-Auditor platform. It is intended to support GDPR-aligned controller-to-processor arrangements.

In the event of a conflict between this DPA and the Terms of Service, this DPA shall prevail with respect to the processing of personal data.

Unless defined otherwise, terms used in this DPA have the meanings given in the General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR"). Key definitions:

• "Customer" means the organization that has entered into a subscription agreement for the Eco-Auditor platform
• "Processor" means Night Lite USA LLC, acting on behalf of the Customer in processing personal data
• "Controller" means the Customer, which determines the purposes and means of processing personal data
• "Personal Data" means any information relating to an identified or identifiable natural person
• "Subprocessor" means any third party engaged by Night Lite USA LLC to process personal data on behalf of the Customer
• "Data Subject" means an identified or identifiable natural person whose personal data is processed

The Customer acts as the Controller of personal data. Night Lite USA LLC acts as the Processor, processing personal data on the Customer's behalf and only in accordance with the Customer's documented instructions.

Where Night Lite USA LLC decides on the purposes and means of processing its own employee or business data separate from the Customer's data, Night Lite USA LLC acts as Controller for that processing.

The subject matter of processing is the hosting, storing, organizing, analyzing, and displaying of customer-submitted business data within the Eco-Auditor platform.

This DPA applies for the duration of the Customer's subscription and a post-termination retention period as specified in the Terms of Service, after which personal data is securely deleted in accordance with Section 12.

Night Lite USA LLC shall process personal data only on documented instructions from the Customer, including:

• Instructions provided through the Eco-Auditor platform interface
• Instructions provided in writing (including email) by authorized Customer representatives
• Processing necessary to comply with applicable legal obligations

Night Lite USA LLC shall not process personal data for its own purposes or for purposes not authorized by the Customer, unless required by applicable law, in which case Night Lite USA LLC shall inform the Customer unless legally prohibited from doing so.

Night Lite USA LLC ensures that all persons authorized to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

Night Lite USA LLC's employees and contractors are bound by confidentiality agreements and receive data protection training appropriate to their role.

Night Lite USA LLC implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as detailed in Annex II. These measures include:

• Role-based access controls and least-privilege access
• Encryption of personal data in transit (TLS 1.2+) and at rest
• Authentication and password controls including multi-factor authentication
• Logging, monitoring, and intrusion detection
• Backup and disaster recovery measures
• Environment segregation between production, staging, and development
• Vulnerability management and security patching
• Incident response procedures
• Employee confidentiality obligations and security training
• Secure deletion procedures

The Customer authorizes Night Lite USA LLC to engage subprocessors to process personal data on the Customer's behalf. Night Lite USA LLC ensures that subprocessors are bound by written agreements that impose data protection obligations no less protective than those in this DPA.

A current list of subprocessors is maintained in Annex III. Night Lite USA LLC will notify the Customer of any addition or replacement of subprocessors, providing the Customer with a reasonable opportunity to object to such changes.

If the Customer objects to a subprocessor change and the parties cannot reach a resolution, the Customer may terminate the affected portion of the service or, if the change affects the entire service, terminate the subscription.

Night Lite USA LLC shall assist the Customer in fulfilling its obligations to respond to data subject requests for exercising their rights under applicable data protection laws, including rights of access, rectification, erasure, portability, restriction, and objection.

Night Lite USA LLC will promptly notify the Customer if it receives a data subject request directly and will not respond to such requests without the Customer's instructions, except as required by applicable law.

Night Lite USA LLC shall notify the Customer without undue delay after becoming aware of a personal data breach, providing:

• The nature of the breach, including the categories and approximate number of data subjects and records affected
• The likely consequences of the breach
• The measures taken or proposed to address the breach and mitigate its effects
• A designated point of contact for further information

Night Lite USA LLC will cooperate with the Customer in investigating breaches and will provide all reasonably available information to assist the Customer in meeting its notification obligations under applicable law.

Personal data is returned and deleted as follows:

• Return: The Customer can export its workspace data at any time from the Service's Settings as a machine-readable JSON download
• Deletion: The Customer can delete its audit data (emissions entries and facilities) at any time from the Service's Settings; deletion takes effect immediately. The account record is deleted by submitting a deletion request to support, which Night Lite USA LLC will process within 30 days of the request

This obligation does not apply where retention of personal data is required by applicable law, in which case Night Lite USA LLC will continue to process such data only for the purpose and duration required by law.

Night Lite USA LLC shall make available to the Customer all information necessary to demonstrate compliance with this DPA and shall allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer.

Such audits shall be conducted during normal business hours with reasonable advance notice, and the Customer shall bear the cost of such audits unless they reveal a material breach of this DPA by Night Lite USA LLC.

Night Lite USA LLC may process or access personal data outside the EEA, UK, or Switzerland depending on hosting, support, or infrastructure operations.

Where required, international transfers shall be governed by the Standard Contractual Clauses described in Section 14 and Annex IV.

Night Lite USA LLC will ensure that any transfer of personal data to a third country is subject to appropriate safeguards as required by applicable data protection law.

Where personal data is transferred from the EEA, the parties agree to incorporate the Standard Contractual Clauses ("SCCs") as adopted by the European Commission, consisting of:

• Module Two (Controller to Processor): Where the Customer acts as Controller and Night Lite USA LLC acts as Processor
• Module Three (Processor to Processor): Where both parties act as Processors in a chain of processing

The specific module(s) applicable will depend on the processing context. Annex IV provides the relevant SCC details and transfer information.

For transfers to the UK, the UK Addendum to the EU SCCs as approved by the UK Information Commissioner's Office shall apply as a supplementary measure.

Liability under this DPA shall be subject to the limitations and exclusions set out in the Terms of Service.

The order of precedence for conflicting terms shall be: (1) this DPA, (2) the Terms of Service, and (3) any other agreement between the parties with respect to the processing of personal data.

This DPA shall be governed by and construed in accordance with the laws specified in the Terms of Service.

Nothing in this DPA shall prejudice the data subject's rights under applicable data protection law.

Night Lite USA LLC may update this DPA to reflect changes in applicable law, regulatory requirements, or data processing practices. Where the update represents a material change, Night Lite USA LLC will provide the Customer with notice and an opportunity to review the updated terms.

Updated subprocessor information will be provided in accordance with Section 8.

Night Lite USA LLC implements the following technical and organizational measures to protect personal data:

This is a summary of key measures. Detailed security documentation is available upon request under NDA. Night Lite USA LLC does not overclaim certifications or controls not currently in place.

The following subprocessors are authorized to process personal data on behalf of the Customer:

Night Lite USA LLC will notify the Customer of changes to this subprocessor list in accordance with Section 8 of this DPA. A current list is available upon request.

Where personal data is transferred outside the EEA/UK/Switzerland, the following applies:

Specific SCC annex details, including data exporter/importer information, competent supervisory authority, and governing law selections, shall be completed upon execution. This DPA does not constitute a signed SCC agreement until countersigned by both parties.