ER Tech Pros LLC
Data Processing Addendum

For purposes of this DPA:

Capitalized terms not defined herein shall have the meanings set forth in the Agreement.

2.1. The parties acknowledge and agree that, with respect to the Processing of Personal Data under the Agreement, Customer acts as the Controller (or equivalent legal role under Applicable Data Protection Laws), and ER Tech acts solely as a Processor or service provider processing Personal Data on behalf of Customer and in accordance with Customer's documented instructions.

2.2. Customer acknowledges and agrees that Customer solely determines the nature, scope, purposes, legality, and means of Processing conducted through the Service, including determining which individuals, devices, systems, communications, or activities are monitored or tracked through the Service. ER Tech does not control, supervise, or direct Customer's monitoring activities with respect to Customer Data and does not independently determine whether Customer's use of the Service complies with Applicable Data Protection Laws in any jurisdiction.

2.3. Customer further acknowledges that laws governing employee monitoring, workplace analytics, surveillance, interception of communications, biometric processing, and electronic activity tracking vary significantly across jurisdictions, and Customer bears sole responsibility for determining whether its use of the Service is lawful in each jurisdiction in which the Service is used or where monitored individuals are located.

2.4. Customer acknowledges that no system or Service can be guaranteed to be completely secure and that ER Tech does not warrant that the Service will be free from all vulnerabilities, interruptions, or unauthorized access attempts.

3.1. ER Tech shall Process Personal Data solely: (a) to provide the Service in accordance with the Agreement; (b) in accordance with Customer's documented instructions as reflected through Customer's configuration and use of the Service; and (c) as otherwise required by applicable law.

3.2. Customer represents and warrants that: (i) it has all necessary rights, permissions, notices, and consents required to provide Personal Data to ER Tech and authorize ER Tech to Process such Personal Data in connection with the Service; (ii) Customer's instructions and use of the Service comply with Applicable Data Protection Laws; and (iii) Customer shall not instruct ER Tech to Process Personal Data in violation of applicable law.

3.3. ER Tech shall have no obligation to independently verify the legality, validity, or sufficiency of Customer's instructions or monitoring activities.

4.1. Customer acknowledges and agrees that Customer is solely responsible for: (a) determining the legal basis for Processing Personal Data; (b) providing legally sufficient notices to individuals; (c) obtaining all required consents and authorizations; (d) responding to requests from Data Subject(s), employees, regulators, or supervisory authorities; (e) ensuring that monitoring activities are proportionate, lawful, and properly disclosed; (f) configuring the Service in a manner consistent with applicable law; and (g) ensuring that Customer does not use the Service for unlawful interception, unauthorized monitoring, collection of privileged communications, unlawful biometric surveillance, or any other prohibited activity.

4.2. Customer further acknowledges that the Service is a configurable technology platform and that ER Tech neither controls nor supervises the categories of data collected through Customer's use of the Service.

5.1. In the event ER Tech becomes aware of a confirmed Security Incident affecting Personal Data, ER Tech shall notify Customer without undue delay and shall provide information reasonably available to ER Tech regarding the nature of the Security Incident.

5.2. ER Tech's obligation to notify Customer under this Section shall not constitute an admission of fault or liability.

5.3. Customer shall be solely responsible for determining whether notification to affected individuals, regulators, governmental authorities, or other third parties is required under Applicable Data Protection Laws.

6.1. Customer acknowledges and agrees that ER Tech may engage third-party subprocessors in connection with the provision of the Service, including cloud hosting providers, infrastructure providers, analytics providers, and support providers.

6.2. Customer hereby authorizes ER Tech to engage such subprocessors. ER Tech shall impose contractual obligations on subprocessors that are commercially reasonable and appropriate to the nature of the Processing performed.

6.3. ER Tech shall not be liable for acts or omissions of subprocessors except to the extent required under applicable law.

7.1. Customer acknowledges and agrees that Personal Data may be processed and stored in the United States and other jurisdictions where ER Tech or its subprocessors operate.

7.2. Customer is solely responsible for determining whether such transfers are permissible under Applicable Data Protection Laws and for implementing any required transfer mechanisms, consents, or authorizations.

8.1. To the extent legally permitted, ER Tech shall notify Customer if ER Tech directly receives a request from a Data Subject relating to Personal Data processed on behalf of Customer.

8.2. Customer shall be solely responsible for responding to such requests and for fulfilling any obligations relating to access, correction, deletion, portability, restriction, objection, or other rights under Applicable Data Protection Laws.

8.3. ER Tech shall provide reasonable assistance to Customer in responding to such requests to the extent required by applicable law and subject to Customer's payment of any applicable fees for such assistance.

9.1. To the extent required under Applicable Data Protection Laws, ER Tech shall make available to Customer information reasonably necessary to demonstrate ER Tech's compliance with this DPA.

9.2. Any audit rights exercised by Customer shall: (a) be limited to no more than once annually unless required by law; (b) occur during normal business hours; (c) not unreasonably interfere with ER Tech's operations; (d) be subject to appropriate confidentiality obligations; and (e) be conducted at Customer's sole cost and expense.

9.3. ER Tech may satisfy audit obligations through provision of third-party audit reports, certifications, summaries, or similar documentation in lieu of permitting direct access to systems or facilities.

10.1. Upon expiration or termination of the Agreement, ER Tech may delete Personal Data in accordance with its standard retention policies unless otherwise required by applicable law or agreed in writing.

10.2. Customer acknowledges that it is solely responsible for exporting any Personal Data it wishes to retain prior to termination of the Service.

10.3. Any requests for extended retention, restoration, migration assistance, or custom exports may be subject to additional fees.

This DPA shall remain in effect for so long as ER Tech Processes Personal Data on behalf of Customer pursuant to the Agreement.

This DPA is subject to the 'Limitation Of Liability' and exclusions set forth in the Agreement, which shall apply in full to all claims arising under or related to this DPA. ER Tech's total liability for all claims arising out of or related to the Agreement or this DPA shall apply in aggregate, and not individually and severally to the Customer.

In the event of a conflict between this DPA and the Agreement, this DPA shall control solely with respect to matters relating to the Processing of Personal Data.

The provisions of this DPA which by their nature are intended to survive expiration or termination of the Agreement or this DPA shall survive and continue in full force and effect following such expiration or termination for so long as ER Tech retains or Processes Personal Data on behalf of Customer, including without limitation provisions relating to confidentiality, limitation of liability, indemnification, audit rights, data deletion, cross-border transfers, and Customer's compliance obligations. Termination or expiration of the Agreement or this DPA shall not relieve either party of any obligations or liabilities accrued prior to such termination or expiration.