Data Processing Addendum

1. Parties and application

This Data Processing Addendum (“DPA”) forms part of the service agreement or order that incorporates it (“Agreement”) between Good Ground Serves LLC, the legal provider of its flagship SiteHeros product and service (“SiteHeros”), and the business customer or Elite Management client identified in that Agreement (“Customer”). It applies only to personal data that SiteHeros processes on Customer’s behalf in providing the ordered Services (“Customer Personal Data”). The individual who accepts this DPA represents that they are authorized to bind Customer.

“Applicable Data Protection Law” means privacy and data-protection law applicable to the particular processing, including the EU GDPR, UK GDPR, Swiss data-protection law and applicable United States state privacy law where their requirements apply. References to controller, processor, business, service provider, contractor, personal data, sale, sharing and processing carry their applicable statutory meanings.

This DPA does not make a law applicable where its territorial, substantive or threshold requirements are not met. Customer’s contractual rights under this DPA apply independently of whether a particular statute grants equivalent rights.

2. Roles and relationship

Customer determines the purposes and essential means of processing Customer Personal Data. SiteHeros acts as processor or service provider for the processing described in Annex 1. Where Customer acts for another controller, Customer must have authority to appoint SiteHeros and issue instructions consistent with the upstream controller’s requirements.

SiteHeros acts separately as controller for its own account administration, sales, invoicing, business records, legal compliance and security activities to the extent it independently determines those purposes and the law permits that role. Such processing is described in the Privacy Policy. A role label does not override the actual processing or permit Customer Personal Data to be repurposed.

3. Instructions and permitted purposes

SiteHeros shall process Customer Personal Data only on documented Customer instructions for the limited purposes identified in Annex 1 and the applicable Order. Instructions include the Agreement, this DPA, the approved service configuration and authorized written service requests. General instructions to “improve services” do not authorize unrelated processing.

If SiteHeros reasonably believes an instruction infringes Applicable Data Protection Law, it shall promptly inform Customer and may suspend the affected instruction while the parties resolve the issue. Where law requires other processing, SiteHeros shall notify Customer before processing unless legally prohibited.

SiteHeros shall not sell or share Customer Personal Data, use it for cross-context behavioral advertising, or use it to train a general-purpose AI model. Use of an AI provider to process Customer Personal Data requires documented authorization, a defined purpose, appropriate contractual protection and inclusion in the applicable subprocessor schedule.

SiteHeros shall not retain, use or disclose Customer Personal Data outside the direct business relationship or for purposes other than the specified business purposes, except as permitted by Applicable Data Protection Law. It shall not combine it with personal data obtained from another person or collected through SiteHeros’s own interactions except where that law expressly permits the combination.

4. Customer responsibilities

Customer shall provide required notices, establish a lawful basis, obtain necessary consents and permissions, and ensure that instructions and supplied data are lawful. Customer is responsible for the content and configuration it controls and for promptly communicating access, correction, deletion and consent changes that SiteHeros must implement.

Customer shall identify regulated or sensitive processing before service acceptance. The ordinary Services are not authorization to submit health records, payment-card authentication data, government identifiers, biometric templates, children’s private records, or other specially regulated data. Such processing requires a separately accepted scope, appropriate safeguards and any required sector-specific agreement. This restriction does not excuse either party from duties arising if such data is actually received.

Customer shall use approved secure access channels. Passwords, private keys and recovery codes must not be placed in ordinary intake fields or unsecured email.

5. Personnel and security

SiteHeros shall limit access to personnel who need it for the instructed processing, bind them to confidentiality, and ensure appropriate training and access removal.

SiteHeros shall implement and maintain technical and organizational measures appropriate to risk, taking account of the state of the art, implementation costs, nature and context of processing and potential harm to individuals. The service-specific measures must be recorded in Annex 2 before Customer Personal Data is accepted.

Measures shall address identity and access management, privileged access, encryption where appropriate, system maintenance, vulnerability handling, secure configuration, logging, incident response, availability, restoration and verification of controls. SiteHeros shall not materially reduce the overall protection during the applicable service term. This provision is not a certification or an absolute guarantee against incidents.

6. Subprocessors

Customer authorizes only the subprocessors identified in the completed Annex 3 for the specified processing. Subject to that schedule, Customer gives general written authorization for later additions or replacements under this section.

SiteHeros shall give at least 30 days’ advance written notice of a proposed new subprocessor, identifying its function, location and material data-protection implications. Customer may object within that period on reasonable, documented data-protection grounds. The parties shall work in good faith on a suitable alternative. SiteHeros shall not route affected data to the proposed provider while a timely objection remains unresolved. If no suitable solution is available, either party may terminate only the affected service before the new processing begins; prepaid fees for the unused terminated portion shall be returned.

SiteHeros shall impose written obligations providing the protection required by this DPA and applicable law, assess sufficient guarantees and remain responsible for the subprocessor’s performance as required by law. Customer-selected independent services are not SiteHeros subprocessors merely because they integrate with a website; their actual role and any SiteHeros access must still be documented.

7. Individual rights and regulatory assistance

Taking account of the processing and information available, SiteHeros shall assist Customer with individual rights requests, security obligations, breach notifications, impact assessments and prior regulator consultation.

SiteHeros shall promptly forward requests concerning Customer Personal Data to Customer and shall not independently determine the substantive response unless Customer authorizes it or law requires it. Customer shall supply sufficient instructions and an appropriate deadline. Assistance must not frustrate a statutory response period.

Reasonable charges for exceptional assistance require advance written agreement and may not condition assistance that SiteHeros must provide because of its own breach or a non-waivable legal duty.

8. Personal data breaches

SiteHeros shall notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. SiteHeros shall provide available information concerning the incident, affected records and individuals, likely consequences, mitigation and a contact point, and shall supplement the notice as information becomes available.

SiteHeros shall contain and investigate the incident, preserve relevant evidence and cooperate with Customer. An initial notice need not await a completed investigation. SiteHeros shall not notify Customer’s affected individuals or make a statement on Customer’s behalf without coordination unless law requires it.

Customer remains responsible for its own legal notification assessment. A regulator’s 72-hour deadline, where applicable, must not be treated as SiteHeros’s permitted waiting period to notify Customer.

9. Information, reviews and audits

SiteHeros shall make available information reasonably necessary to demonstrate compliance and allow and contribute to audits, including inspections, by Customer or an authorized independent auditor.

The parties shall ordinarily begin with current documentation and relevant independent assurance. Reasonable notice, confidentiality, security and scheduling arrangements may protect systems and other customers, but shall not prevent a necessary audit, a competent authority’s access, investigation of a material incident or verification of a substantiated compliance concern.

Customer may take reasonable and appropriate steps to confirm that SiteHeros uses Customer Personal Data consistently with this DPA, stop and remediate unauthorized use, and request corrective evidence. SiteHeros shall promptly notify Customer if it can no longer meet the applicable obligations.

10. International transfers

Neither the execution of this DPA nor a provider’s public certification alone authorizes a restricted international transfer. Before such a transfer, the parties shall complete Annex 4, identify exporters, importers, locations and onward recipients, and put the applicable mechanism into effect.

For EU transfers requiring standard contractual clauses, the parties shall execute the applicable unmodified modules of Commission Decision (EU) 2021/914 with completed annexes and selections. Module Two ordinarily addresses controller-to-processor transfers; Module Three ordinarily addresses processor-to-processor transfers. The actual roles control.

UK restricted transfers require the applicable UK Addendum or IDTA; Swiss transfers require the appropriate Swiss adaptations. Where adequacy or a Data Privacy Framework certification is used, the specific recipient, covered data, applicable framework and current certification must be verified. Supplementary measures and transfer assessments shall be documented when required.

Mandatory transfer terms prevail over conflicting commercial terms. If a lawful mechanism ceases to be available, affected transfers shall be suspended or an effective replacement implemented before they continue.

11. Return, deletion and retention

At the end of the relevant processing services, SiteHeros shall, at Customer’s choice, return or delete Customer Personal Data and delete existing copies unless applicable law requires retention. Annex 1 shall specify the export format, return window, active-system deletion timetable, backup lifecycle and confirmation method.

While a permitted backup copy awaits scheduled deletion, it shall remain protected, isolated from ordinary use and restored only for continuity or legal necessity. Any restored data shall again be subject to outstanding deletion instructions. Backup retention is not permission to retain data indefinitely.

Where law requires retention, SiteHeros shall identify the basis and duration to Customer unless prohibited, restrict processing to that purpose and delete when the requirement ends. Separate controller records must be minimized and must not be used to conceal continued retention of Customer-controlled content.

12. California and other state terms

For personal information covered by the CCPA, Customer discloses it only for the specific business purposes listed in Annex 1. SiteHeros shall comply with the applicable CCPA provisions, provide the same level of privacy protection required by that law, and observe the use, combination, sale and sharing restrictions above.

If SiteHeros is classified as a contractor, it certifies that it understands and will comply with those restrictions. The parties shall assist with consumer requests and downstream notifications as applicable. These terms do not convert an independent third party’s unrestricted use into service-provider processing.

Other applicable state processor requirements concerning instructions, confidentiality, security, assistance, deletion, subcontractors and assessment information supplement this DPA. No general business exemption may be assumed to remove a separately applicable processor or sensitive-data duty.

13. Conflicts, liability and term

Mandatory law and executed transfer clauses take priority, followed by this DPA for data-processing matters and then the Agreement. The Agreement’s liability allocation applies only to the extent lawful and consistent with mandatory transfer clauses and individuals’ non-waivable rights. This DPA creates no exemption from regulatory liability.

It remains effective for as long as SiteHeros or its subprocessors retain Customer Personal Data. Amendments require the Agreement’s valid change process and may not retroactively authorize unlawful processing.

Annex 1. Processing particulars

Complete for each Order before processing: Customer legal name and role; SiteHeros legal notice details; authorized instruction contacts; services and system boundaries; subject matter; duration; exact business purposes; data subjects; personal-data fields; sensitive-data exclusions or approved exceptions; processing operations; frequency; storage and support locations; retention; export and deletion particulars.

Hosting+ scope ordinarily concerns storing and serving Customer-directed website files/databases and performing agreed hosting support, backups, security and recovery. Elite scope may additionally include instructed website administration, approved forms, content handling, service requests and authorized integrations. These descriptions are not permission for every data type or optional integration.

Annex 2. Technical and organizational measures

The service-specific technical and organizational measures schedule identifies the responsible party, access roles and multifactor-authentication coverage, transmission and storage protection, secret handling, patch and vulnerability management, logging, environment separation, backup and restore controls, incident escalation, personnel confidentiality, deletion, legal holds and supplier assurance. Only verified applicable controls belong in that schedule.

Annex 3. Authorized subprocessor schedule

For every authorized recipient record legal entity, service, data categories, purpose, locations, onward-processing reference, contract/DPA, transfer mechanism and notice contact. Attach the approved service-specific list. A generic technology inventory or an incomplete public list is not this authorization schedule.

Annex 4. Transfer schedule

The service-specific transfer schedule identifies whether a restricted transfer occurs and, if so, the selected legal mechanism, parties, roles, competent authority, governing law, forum, annexes, measures and any required transfer assessment. No transfer mechanism is activated by publication of this DPA alone.