Data Processing Addendum (DPA)

This Data Processing Addendum (“DPA”) forms part of the agreement between Aptora Corporation (“Aptora,” “Processor,” “Service Provider,” “we,” or “us”) and the customer (“Customer,” “Controller,” “Business,” or “you”) governing Aptora’s processing of personal information while providing its products and services.

This DPA applies only to the extent Aptora processes personal information on behalf of the Customer.

1. Purpose

Aptora provides software and related services that allow customers to collect, store, manage, and process business information.

When Customer Data contains personal information, Aptora acts as a service provider or data processor and processes that information only as instructed by the Customer and as necessary to provide the Services.

2. Roles of the Parties

For purposes of applicable privacy laws:

• The Customer determines what personal information is collected and how it is used.
• Aptora processes personal information only to provide the Services requested by the Customer.

Nothing in this DPA transfers ownership of Customer Data to Aptora.

3. Customer Data

Customer Data may include information entered into Aptora products and services, including:

• Names
• Business contact information
• Customer records
• Employee information
• Vendor information
• Scheduling information
• Accounting records
• Financial information
• Documents
• Images
• Attachments
• Communications
• Other business information submitted by the Customer

The specific information processed depends entirely on how the Customer uses the Services.

4. Processing of Personal Information

Aptora will process Customer Data only to:

• Provide the Services.
• Host Customer Data.
• Maintain system functionality.
• Perform customer-requested support.
• Maintain backups.
• Detect and prevent security incidents.
• Troubleshoot technical issues.
• Comply with applicable law.
• Fulfill other written instructions provided by the Customer.

Aptora does not sell Customer Data.

Aptora does not use Customer Data for advertising.

Aptora does not use Customer Data to create marketing profiles.

5. Customer Responsibilities

The Customer is responsible for:

• Determining the lawful basis for collecting personal information.
• Providing any required privacy notices.
• Obtaining required consents.
• Responding to requests from individuals regarding their personal information.
• Ensuring that information entered into the Services complies with applicable law.

The Customer is responsible for the accuracy of the information submitted to the Services.

6. Confidentiality

Aptora limits access to Customer Data to authorized personnel who require access to perform their assigned responsibilities.

Employees and contractors with access to Customer Data are expected to maintain the confidentiality of that information.

7. Security

Aptora maintains administrative, technical, and physical safeguards designed to protect Customer Data against unauthorized access, disclosure, alteration, or destruction.

Information regarding Aptora’s security practices is available in our:

• Information Security Policy
• Data Security & Incident Response Commitment

No method of storage or transmission can guarantee absolute security.

8. Subprocessors

Aptora may use third-party service providers to support the delivery of its Services, including providers of:

• Cloud infrastructure
• Data hosting
• Payment processing
• Email delivery
• Customer support
• Monitoring and security services

Where appropriate, Aptora requires these providers to protect Customer Data consistent with their contractual obligations.

9. Security Incidents

If Aptora determines that Customer Data has been accessed, acquired, or disclosed without authorization and notification is required by applicable law or contractual obligation, Aptora will notify affected Customers without unreasonable delay after completing an appropriate investigation.

Notifications may include:

• A description of the incident.
• The categories of information involved, if known.
• Corrective actions taken by Aptora.
• Recommended actions for the Customer.
• Contact information for additional assistance.

10. Assistance

Upon reasonable request and where appropriate, Aptora will assist Customers by providing information reasonably necessary for the Customer to:

• Respond to requests from individuals regarding their personal information.
• Comply with applicable privacy laws.
• Investigate security incidents involving Customer Data.

Such assistance may be subject to reasonable charges when significant effort is required.

11. Data Retention and Deletion

Customer Data remains the property of the Customer.

Upon termination of the Services, Customers are responsible for exporting or retrieving their information before access ends.

Aptora may retain Customer Data for a reasonable period as necessary to:

• Complete requested exports.
• Meet legal obligations.
• Resolve disputes.
• Enforce agreements.
• Complete routine backup retention cycles.

After applicable retention periods expire, Customer Data may be securely deleted in accordance with Aptora’s data retention practices.

12. Compliance Reviews

Aptora periodically reviews its privacy and security practices to help maintain compliance with applicable legal and contractual obligations.

Information regarding Aptora’s security program is available through our published security documentation.

13. Changes to this DPA

Aptora may update this DPA from time to time to reflect changes in applicable law, technology, or business operations.

Material changes will be posted on our website together with an updated Effective Date.

14. Order of Precedence

This DPA supplements the applicable Terms of Service or other written agreement between Aptora and the Customer.

If there is a conflict between this DPA and a separately executed written agreement that specifically addresses data processing, the written agreement will control to the extent of the conflict.

15. Contact Information

Questions regarding this Data Processing Addendum may be directed to:

Aptora Corporation
Attn: Privacy Officer
8877 Bourgade Avenue
Lenexa, Kansas 66219

Email: helpdesk@aptora.com

Phone: (913) 492-9930