AsDrawn Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the AsDrawn Platform Terms of Service (the "Agreement") between AsDrawn LLC, a Missouri limited liability company ("AsDrawn," "we," "us"), and the customer party to the Agreement ("Customer," "you").

Customer's acceptance of the Agreement constitutes Customer's acceptance and signature of this DPA. No separate signature is required.

This DPA applies where AsDrawn Processes Customer Personal Data on behalf of Customer in connection with providing the Service. Capitalized terms not defined here have the meanings given in the Agreement.

1. Definitions

"Customer Personal Data" means personal information contained within Customer Data that AsDrawn Processes on Customer's behalf in providing the Service.

"Data Protection Laws" means all privacy and data protection laws applicable to the Processing of Customer Personal Data, including the California Consumer Privacy Act as amended ("CCPA") and comparable U.S. state privacy laws, and, where and if they become applicable under Section 9, the EU General Data Protection Regulation ("GDPR"), the UK GDPR and Data Protection Act 2018, and the Swiss Federal Act on Data Protection.

"Data Subject," "Controller," "Processor," "Processing," and "Personal Data Breach" have the meanings given under applicable Data Protection Laws.

"Security Incident" means a Personal Data Breach affecting Customer Personal Data.

"Subprocessor" means a third party engaged by AsDrawn to Process Customer Personal Data.

2. Roles of the Parties

2.1 Roles. Customer is the Controller of Customer Personal Data (or a Processor acting on behalf of a third-party Controller). AsDrawn is the Processor. Where Customer acts as a Processor, Customer warrants that it has the authority of the relevant Controller to enter into this DPA.

2.2 CCPA. For purposes of the CCPA, AsDrawn is a "service provider." AsDrawn will not sell or share Customer Personal Data, will not retain, use, or disclose it for any purpose other than performing the Service, will not combine it with personal information received from other sources except as permitted by the CCPA, and will not retain, use, or disclose it outside the direct business relationship between the Parties. AsDrawn certifies that it understands and will comply with these restrictions.

2.3 AsDrawn as Controller. AsDrawn acts as an independent Controller with respect to account and billing contact information for Customer's authorized representatives, and operational telemetry described in Section 7.3 of the Agreement. AsDrawn Processes that data to administer the customer relationship, conduct billing and accounting, detect and prevent fraud and security incidents, comply with legal obligations, and maintain and improve the Service. That Processing is described in AsDrawn's Privacy Policy.

3. Processing of Customer Personal Data

3.1 Instructions. AsDrawn will Process Customer Personal Data only (a) in accordance with Customer's documented instructions, (b) as necessary to provide, secure, maintain, and support the Service, and (c) as required by applicable law. The Agreement, this DPA, and Customer's configuration and use of the Service constitute Customer's complete documented instructions.

3.2 Notification of Unlawful Instructions. AsDrawn will notify Customer if it becomes aware that an instruction infringes Data Protection Laws, or that it can no longer meet its obligations under this DPA.

3.3 Restrictions on Use — No Training, No Data Products. AsDrawn will not use Customer Personal Data to train, fine-tune, or improve any machine learning or artificial intelligence model, to create benchmarking, industry, or comparative data products, or for advertising, and will not sell, rent, or license Customer Personal Data or any derivative of it. AsDrawn will impose the same restrictions on every Subprocessor, including any artificial intelligence provider. These restrictions correspond to Section 7.3 of the Agreement and are subject to the same limits on amendment stated in that Section.

3.4 Confidentiality of Personnel. AsDrawn will ensure that persons authorized to Process Customer Personal Data are subject to binding confidentiality obligations and receive appropriate training.

3.5 Customer Responsibilities. Customer is solely responsible for the accuracy and legality of Customer Personal Data, the means by which it was acquired, and for providing all notices and obtaining all consents required under Data Protection Laws, including with respect to Customer's personnel and Customer's own clients.

4. Security

4.1 Measures. AsDrawn will implement and maintain the technical and organizational measures described in Exhibit C, appropriate to the risk presented by the Processing.

4.2 Security Incidents. AsDrawn will notify Customer without undue delay after becoming aware of a Security Incident, and in any event within the timeframe required by applicable Data Protection Laws. The notice will describe the nature of the incident, the categories and approximate volume of Customer Personal Data affected, the likely consequences, and the measures taken or proposed, to the extent that information is reasonably available at the time. AsDrawn will supplement the notice as further information becomes available, take reasonable steps to mitigate the effects, and provide reasonable assistance with Customer's own notification obligations. AsDrawn's notification is not an acknowledgment of fault or liability.

5. Subprocessors

5.1 Authorization. Customer authorizes AsDrawn to engage the Subprocessors listed in Exhibit B.

5.2 New Subprocessors. AsDrawn will notify Customer at least thirty (30) days before adding or replacing a Subprocessor, by email to Customer's account contact or by notice within the Service.

5.3 Objection. Customer may object in writing within thirty (30) days of notice on reasonable data-protection grounds. The Parties will work in good faith to resolve the objection. If no reasonable alternative is available, Customer may terminate the affected subscription without penalty and receive a prorated refund of prepaid, unused Subscription Fees.

5.4 Liability. AsDrawn will impose data protection obligations on each Subprocessor no less protective than those in this DPA and remains fully liable to Customer for each Subprocessor's performance and compliance.

5.5 Conditional Subprocessors. Certain Subprocessors are engaged only if Customer enables an optional integration. Enabling such an integration constitutes Customer's instruction to transmit the associated Customer Personal Data to that Subprocessor. These are identified in Exhibit B.

6. Data Subject Rights

AsDrawn will, to the extent legally permitted, promptly notify Customer if it receives a request from a Data Subject relating to Customer Personal Data, and will direct that Data Subject to Customer. Customer is responsible for responding. Taking into account the nature of the Processing, AsDrawn will provide reasonable technical and organizational assistance to enable Customer to respond, at Customer's cost where the assistance requires non-trivial effort. The Service provides self-serve tools enabling Customer to access, correct, export, and delete Customer Personal Data.

7. Assessments and Audits

7.1 DPIAs. AsDrawn will provide reasonable assistance with data protection impact assessments and consultations with supervisory authorities where required by Data Protection Laws, at Customer's cost where legally permitted.

7.2 Audit. On written request no more than once per twelve (12) month period, AsDrawn will make available information reasonably necessary to demonstrate compliance with this DPA, including responses to a reasonable security questionnaire and copies of any then-current third-party certifications or assessment reports. Where that information is insufficient and Data Protection Laws afford Customer an audit right, Customer may conduct an audit of AsDrawn's relevant policies and records on thirty (30) days' advance notice, during business hours, at Customer's cost, subject to confidentiality. This limit does not apply following a Security Incident or where required by a supervisory authority.

7.3 Confidentiality. Audit findings and any reports provided under this Section are AsDrawn's Confidential Information.

8. Deletion and Return

Section 15.5 of the Agreement governs export and deletion of Customer Data on termination. At Customer's election, AsDrawn will delete or return Customer Personal Data following expiration or termination, except where retention is required by applicable law and except for backup copies, which are deleted or overwritten in the ordinary course of AsDrawn's backup rotation. Customer may request earlier deletion in writing at any time, and AsDrawn will comply within thirty (30) days. Customer is directed to Section 15.6 of the Agreement regarding its own professional records-retention obligations.

9. International Transfers

AsDrawn's Processing operations occur in the United States. Customer authorizes AsDrawn and its Subprocessors to Process and store Customer Personal Data in the United States.

The Service is currently offered to customers established in the United States. If Customer becomes subject to the GDPR, the UK GDPR, or Swiss data protection law with respect to Customer Personal Data, Customer will notify AsDrawn, and the Parties will execute the European Commission's Standard Contractual Clauses approved under Decision 2021/914, together with the UK International Data Transfer Addendum or Swiss adaptations as applicable, before any such transfer occurs. Exhibits A, B, and C to this DPA are intended to populate Annexes I, II, and III of those clauses.

10. Liability and Precedence

10.1 Liability. Each Party's liability under this DPA is subject to the limitations and exclusions in Section 22 of the Agreement.

10.2 Order of Precedence. In the event of a conflict, the following order applies: (1) the Standard Contractual Clauses, where applicable; (2) this DPA; (3) the Agreement.

10.3 Amendment. This DPA may not be modified except in writing, and Section 3.3 is subject to the limits on amendment stated in Section 7.3 of the Agreement.

Exhibit A — Details of Processing

Subject Matter and Duration: Provision of practice and project management software to architecture and engineering firms, for the duration of the Agreement plus the export and deletion periods described in Section 8.

Nature and Purpose: Hosting, storage, organization, retrieval, display, transmission, and deletion of Customer Personal Data as necessary to provide the Service, including project tracking, fee and budget management, time tracking, staffing allocation, invoicing, and reporting.

Categories of Data Subjects:

• Customer's employees, principals, and contractors
• Customer's clients and client contacts
• Customer's project consultants and other project participants

Categories of Personal Data:

• Identity and contact data: name, email address, telephone number, job title, employer
• Employment-related data: hours worked, billable and non-billable time entries, project and phase allocations, staffing assignments, hourly billing rates and, where Customer enters it, salary-derived cost rates
• Account data: login credentials (stored in hashed form), role assignments, authentication metadata
• Client and financial data: client names and contacts, contract fees, invoices, payments, budget and profitability figures
• Technical data: IP addresses, device and browser information, application logs, session data

Special Categories of Personal Data: None. Customer must not submit special categories of personal data, government identification numbers, financial account numbers, or health information to the Service.

Frequency of Transfer: Continuous.

Retention: For the duration of the Agreement, plus the export window in Section 15.5 of the Agreement, subject to backup rotation and legal retention requirements.

Exhibit B — Subprocessor List

Last Updated: August 2026

Conditional Subprocessors — engaged only where Customer enables the integration:

Artificial intelligence providers. No artificial intelligence provider is currently engaged as a Subprocessor, and no Customer Personal Data is transmitted to any AI provider. AsDrawn uses AI-assisted tools internally in developing and operating the Service; Customer Personal Data is not provided to those tools. If AsDrawn introduces an AI Feature that processes Customer Personal Data, the provider will be added to this list with at least thirty (30) days' advance notice under Section 5, and will be engaged only under terms prohibiting the use of Customer Personal Data to train, fine-tune, or improve any model.

Sub-subprocessors. Our Subprocessors engage their own infrastructure providers — for example, Supabase's Processing occurs on Amazon Web Services infrastructure. Those relationships are governed by each Subprocessor's own data processing terms, and AsDrawn remains responsible for its Subprocessors' performance under Section 5.4.

Subscribing to updates. To receive notice of Subprocessor changes, contact info@asdrawn.net.

Exhibit C — Technical and Organizational Measures

Encryption in transit. All connections between Users and the Service, and between the Service and its Subprocessors, use HTTPS/TLS.

Encryption at rest. Customer Personal Data is stored in an encrypted database managed by our database Subprocessor. Authentication credentials are stored in hashed form and are not recoverable in plaintext.

Access control. Access to production systems is limited to personnel with a business need. Each individual with production access uses unique credentials. Access is reviewed periodically and revoked promptly on role change or departure.

Application-level access control. The Service implements role-based permissions and logical separation of Customer accounts in a multi-tenant architecture, so that a User of one Customer cannot access another Customer's data.

Authentication. Password-based authentication with hashed credential storage for the Service. Multi-factor authentication is enabled on all administrative accounts used to access production infrastructure, including our database, hosting, and payment processing providers.

Backup and recovery. Our database Subprocessor takes an automated daily snapshot of the production database. Backups are retained for seven (7) days and are stored within the same AWS region as the production database (us-west-2). Backups are not replicated outside that region.

Logging and monitoring. Application and infrastructure logs are generated and retained in accordance with our hosting and database providers' standard configurations, and are available for investigation of security and operational events.

Secure development. Changes to the Service are reviewed before deployment. Production credentials are not stored in source control. Customer Personal Data from production systems is not used in development or testing, and is not provided to any third-party development tool, including AI-assisted coding tools.

Physical security. AsDrawn operates no physical servers. Physical security of infrastructure is provided by our hosting Subprocessors and their underlying cloud providers.

Personnel. Personnel with access to Customer Personal Data are bound by written confidentiality obligations.

Data minimization. The Service collects only the categories of personal data described in Exhibit A.

Portability and erasure. Customer may export all Customer Data in CSV format through self-serve tools at any time during the Subscription Term, and may request deletion at any time.

Vendor oversight. Subprocessor security posture and data protection terms are reviewed before engagement and periodically thereafter.

AsDrawn LLC
117 S Lexington Street, Suite 100
Harrisonville, MO 64701, USA
info@asdrawn.net