Total Water Design Suite Data Processing Addendum

Version 1.0

This Data Processing Addendum ("DPA") supplements the Total Water Design Suite User Agreement between the customer ("Customer") and Total Water Design LLC, a Michigan limited liability company ("Company"). It applies when the Company processes personal information in Customer's User Content on Customer's behalf and a law requires processor terms. It does not change the Company's separate role as controller for account, billing-status, security, and Usage Data described in the Privacy Policy. Capitalized terms not defined here have the meanings in the Agreement.

1. Roles, instructions, and scope

Customer is the controller (or a processor authorized by its controller) of personal information it submits as User Content. Customer determines why and what to submit and is responsible for its lawful basis, notices, consents, accuracy, and instructions. Company is the processor for that Customer Personal Data. Company will process it only on Customer's documented instructions: the Agreement, this DPA, the configuration and lawful actions Customer takes in the Suite, and any further written instruction the parties accept. Company will tell Customer if an instruction appears to violate applicable data-protection law, unless law prohibits notice. If law requires other processing, Company will inform Customer in advance unless prohibited.

The subject matter is the Suite's hosting and processing of customer-submitted engineering files, project inputs, and related Outputs. Processing may include receiving, storing, scanning for malware and prohibited content, structuring, calculation, generation, display, support, security, backup, export, and deletion. It continues while Customer uses the Suite and for the exit and preservation periods described below. Data subjects may include Customer's staff, representatives, clients, and people mentioned in submitted material. Data may include names, business contact details, project information, and any other personal information Customer lawfully submits. The Suite is not designed for payment-card numbers, government identifiers, health data, or export-controlled technical data. Customer must not submit such data without a separately approved arrangement.

Company personnel with access to Customer Personal Data are bound by confidentiality and receive access only as needed for their duties. Company will not sell Customer Personal Data or use it for unrelated advertising. Agreement Sections 7.7–7.11 permit analysis and improvement subject to Section 7.9; where the information is processed for Customer under this DPA, Company may use it for improvement only after de-identification that removes reasonable identifiability, or as Customer's documented instructions and applicable law otherwise permit. Company's separate controller processing of account and Usage Data is explained in the Privacy Policy. Mandatory individual rights, including a valid objection to legitimate-interest processing, are not conditioned on a separate signed exception under Agreement Section 7.11.

2. Security and assistance

Company will maintain measures appropriate to the risk, including encrypted network connections and storage volumes, MFA for sensitive access, role-based access controls, logging and review of privileged activity, malware screening of supported uploads, backup and recovery procedures, security patching, and incident response. Company will review those measures as risks and technology change. Customer remains responsible for its users, MFA devices, endpoint security, lawful uploads, and independent copies of its files and Outputs.

Taking into account the nature of the processing and information available to Company, Company will reasonably assist Customer with data-subject requests, security and breach obligations, data-protection impact assessments, and consultations with authorities where applicable law requires. Customer is responsible for answering requests as controller. Company may verify a request and may charge reasonable documented costs for assistance outside ordinary Suite operation where law permits.

3. Security incidents

After becoming aware of a confirmed personal-data breach affecting Customer Personal Data, Company will notify Customer without undue delay at its account contact or another agreed security address. The initial notice will describe known facts, likely consequences, and containment or remediation steps to the extent then available; Company may provide updates as its investigation develops. Company will take reasonable steps to contain and investigate the breach and help Customer meet its own notification duties. A notice is not an admission of fault. Customer remains responsible for deciding whether and when to notify individuals or regulators, except where law imposes that duty directly on Company.

4. Subprocessors and other recipients

Customer gives general written authorization for the subprocessors needed to provide the Suite. Company will bind each subprocessor to confidentiality, security, and data-protection duties no less protective in substance than this DPA for the processing it performs, and remains responsible for its subprocessors to the extent required by law.

Company will provide at least 30 days' advance notice of a new or replacement subprocessor that will process Customer Personal Data, unless an urgent security or continuity need requires shorter notice. Customer may object within 15 days on reasonable data-protection grounds. The parties will discuss a reasonable alternative; if none is available, Customer may stop the affected processing, subject to mandatory law and the Agreement's payment terms. An objection does not itself change the treatment of payments under Agreement Section 8.2. Company may share information with public authorities or other recipients when required or permitted by law, and will use available legal protections where appropriate.

5. International transfers

The Suite is operated from the United States, and Customer Personal Data may be processed in the United States or in provider locations. Each party will comply with applicable rules for restricted transfers it initiates. Where an adequacy decision or another lawful transfer mechanism does not cover an EU or EEA restricted transfer, the parties incorporate the unmodified Standard Contractual Clauses adopted by European Commission Implementing Decision (EU) 2021/914 ("EU SCCs"). Module Two applies when Customer is a controller and Company a processor; Module Three applies if Customer is a processor and Company a subprocessor. The relevant SCC module and its mandatory provisions prevail over conflicting Agreement or DPA terms. For the SCCs, the exporter is Customer, the importer is Company, the transfer description is Section 1, the technical measures are Section 2, and the authorized subprocessors are Section 4. The competent supervisory authority and any additional annex information are determined under the SCCs and the parties' actual transfer.

For a restricted transfer subject to UK law, the parties will use the UK International Data Transfer Addendum to the EU SCCs (or another valid UK transfer mechanism), with its tables completed for the parties, selected SCC module, transfer description, security measures, and subprocessors above. Where a transfer impact assessment or supplementary safeguards are required, the responsible party will perform that assessment and the parties will cooperate. Neither this DPA nor the Agreement authorizes a transfer that applicable law forbids.

6. Return, deletion, and preservation

Customer can retrieve available User Content and Outputs through Suite features while its account is active and should keep complete originals outside the Suite. At the end of processing, Company will delete or return Customer Personal Data as Customer reasonably instructs, except to the extent law requires retention or a documented legal or security hold applies. For an eligible closed Total RO Design account, access is disabled immediately and the current process schedules in-scope project content for purge 30 days after closure, subject to those holds and safe-deletion checks. Other apps require a reviewed erasure process before release. Protected backups may retain copies until their operational expiry and will remain protected from ordinary use. Company may retain legal acceptance evidence for at least ten years after closure, and billing, tax, security, or dispute records as required by law; those records are handled under Company's controller role and the Privacy Policy.

7. Demonstrating compliance and audits

Company will make information reasonably necessary to demonstrate compliance with this DPA available to Customer, starting with current security documentation, relevant policies, and responses to a reasonable written questionnaire. If that documentation is insufficient and an inspection is required by applicable law, the parties will arrange a proportionate audit by Customer or an independent auditor bound by confidentiality, with reasonable notice and safeguards for other customers and Company secrets. Company may provide an independent assessment instead where it satisfies the legal requirement. No audit permits access to another customer's data or proprietary technical content unrelated to demonstrating compliance.

8. Order of terms and contact

The EU SCCs and any applicable UK transfer addendum prevail for a restricted transfer. This DPA prevails over the Agreement for processing of Customer Personal Data as processor. Otherwise, the Agreement, including its Michigan governing-law and dispute provisions, applies, subject to mandatory privacy law. Questions, instructions, incident notices, and requests for transfer safeguards may be sent to admin@totalrodesign.com or Total Water Design LLC, Attn: Jerry Ross, 3901 Florman, Waterford, Michigan 48329, USA.