Data Processing Addendum

1.Roles and scope

Customer is the controller of personal data in the Customer Data, or a processor acting for its own clients, such as an owner a consultant represents. ATALI ELECTRIC is Customer's processor, or subprocessor in the second case, and a "service provider" under US state privacy laws.

Customer Data is mainly commercial property records. Personal data in it is limited to names and business contact details of Customer's users, tenants, owners and signatories, plus lease terms tied to named tenants. Customer will not upload special categories of personal data or government identification numbers, other than an owner tax identification number that a county form requires.

2.Details of processing

The processing is described here.

• Subject matter and purpose: providing the ATALI ELECTRIC platform, including notice ingestion, valuation analysis, comparable grids, petition preparation, deadline tracking, billing records and support.
• Duration: the term of the agreement plus the export and deletion period in section 8.
• Nature: hosting, storage, OCR, normalization, calculation, form population, export and support access.
• Data subjects: Customer's personnel and clients, tenants, property owners and signatories named in uploaded records.
• Personal data: names, business email addresses and phone numbers, job titles, tenant names and lease terms, and parcel owner names and mailing addresses.
• Frequency: continuous while the account is active.

3.Customer instructions

ATALI ELECTRIC processes personal data only on Customer's documented instructions, which are the agreement, this DPA, Customer's use of the platform's features and Customer's written support requests, unless the law requires otherwise. ATALI ELECTRIC will tell Customer if it believes an instruction violates law.

4.Confidentiality and personnel

Everyone with access to Customer Data is bound by written confidentiality obligations, completes security training at hire and annually, and, where the law allows, passes a background check before receiving production access.

5.Security measures

ATALI ELECTRIC applies the measures in its Security Policy, including AES-256 encryption at rest, TLS 1.3 in transit, per-tenant isolation of rent rolls and operating statements, multi-factor authentication, role-based access control, 13 months of audit logs, an annual independent penetration test and an annual SOC 2 Type II examination. ATALI ELECTRIC may update these measures but will not materially reduce the protection they give.

6.Subprocessors

Customer authorizes the subprocessors listed at /subprocessors. ATALI ELECTRIC will give 30 days' notice before adding or replacing one. Customer may object in writing within that period on reasonable data protection grounds, and the parties will work in good faith to resolve it. If they cannot, either party may terminate the affected service and ATALI ELECTRIC will refund prepaid fees for the unused term. ATALI ELECTRIC binds each subprocessor to written terms no less protective than this DPA and remains responsible for its performance.

7.Data location and remote access

Customer Data is hosted on Amazon Web Services in us-east-2 (Ohio), with failover to us-west-2 (Oregon). ATALI ELECTRIC personnel in Faridabad, India, reach it only through role-based, time-limited, logged remote access with multi-factor authentication, for support and engineering purposes. Customer Data is not stored on personnel devices or in infrastructure outside the United States.

8.Return and deletion

Customer may export Customer Data at any time and for 30 days after termination. ATALI ELECTRIC then deletes it from production systems within 30 days and from encrypted backups within 90 days of termination, and confirms deletion in writing on request. Records the law requires ATALI ELECTRIC to keep, such as billing records, stay protected and are used only for that purpose.

9.Data subject requests and assistance

ATALI ELECTRIC gives Customer self-service tools to access, correct, export and delete personal data. If ATALI ELECTRIC receives a request directly from a person whose data is in Customer Data, it will send the request to Customer within 10 business days and will not respond on the substance unless Customer instructs it to. ATALI ELECTRIC will give reasonable help with data protection assessments and regulator inquiries about the processing.

10.Personal data breach

ATALI ELECTRIC will notify Customer without undue delay, and within 72 hours, after confirming a breach of security that leads to the accidental or unlawful destruction, loss, alteration or unauthorized disclosure of Customer Data. The notice will describe what is known about the nature of the incident, the data affected, the steps taken and a contact for follow-up. ATALI ELECTRIC will cooperate with Customer's investigation and any notice Customer must give.

11.Audits

ATALI ELECTRIC makes its SOC 2 Type II report available to Customer each year under confidentiality, and will answer one reasonable security questionnaire a year. If the report and answers do not satisfy a legal requirement, or after a breach, Customer may audit ATALI ELECTRIC's relevant controls on 30 days' notice, during business hours, at Customer's cost and without access to other customers' data.

12.US state privacy law terms

For the purposes of the California Consumer Privacy Act as amended by the CPRA and similar state laws, ATALI ELECTRIC will not sell or share personal data; will not retain, use or disclose it outside its direct business relationship with Customer or for any purpose other than the business purposes in this DPA; will not combine it with personal data from other sources except as the law permits; and will provide the same level of privacy protection the law requires of Customer.

ATALI ELECTRIC will tell Customer within five business days if it can no longer meet these obligations, and Customer may take reasonable steps to stop and remediate unauthorized use. To the extent India's Digital Personal Data Protection Act, 2023 applies, ATALI ELECTRIC acts as a data processor under this contract and applies reasonable security safeguards.

13.Liability and order of precedence

Each party's liability under this DPA is subject to the limitations in the Terms of Service. If this DPA conflicts with the Terms of Service on the processing of personal data, this DPA controls.