Acordo de Tratamento de Dados (DPA)

1. Application

This DPA applies where PrediSmart processes personal data on behalf of a Customer in providing the contracted Platform and is incorporated into the applicable Customer agreement when required.

2. Roles

Customer acts as controller or equivalent business entity for Customer-controlled personal data and determines the purposes and means of processing. PrediSmart acts as processor/service provider/contractor to the extent it processes such data on documented Customer instructions. Each party remains independently responsible for processing for which it determines its own purposes and means.

3. Processing Instructions

PrediSmart shall process Customer Personal Data only to provide, secure, support and administer the contracted services; on documented Customer instructions; or as required by applicable law. If an instruction appears to violate applicable data protection law, PrediSmart may notify Customer and suspend the affected instruction pending lawful resolution.

4. Confidentiality

Persons authorized to process Customer Personal Data are subject to appropriate confidentiality obligations.

5. Security

PrediSmart shall maintain technical and organizational measures appropriate to the risk, taking account of the nature, scope, context and purposes of processing and the state of the art, implementation costs, and applicable legal requirements.

6. Subprocessors

Customer authorizes PrediSmart to use subprocessors necessary to provide the services, subject to contractual data protection obligations appropriate to their processing. Current information is maintained under PS-LEGAL-008. Where applicable law or contract requires advance notice or objection rights, those procedures will apply.

7. Assistance

Taking into account the nature of processing and information available to it, PrediSmart shall provide reasonable assistance for data subject requests, security obligations, impact assessments, regulator consultation, and other processor obligations required by applicable law.

8. Security Incidents

PrediSmart shall notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data where processor notification is legally required, and shall provide information reasonably available to support Customer’s obligations.

9. Return and Deletion

Upon termination of relevant services, PrediSmart shall return or delete Customer Personal Data as required by the applicable agreement and law, subject to backups, legal retention, security, dispute, and evidentiary requirements.

10. Audit Information

PrediSmart shall make available information reasonably necessary to demonstrate compliance with processor obligations and shall support audits where required by applicable law or an executed enterprise agreement, subject to reasonable confidentiality, security, scope, frequency and cost controls.

11. International Transfers

Restricted transfers shall use a lawful mechanism applicable to the transfer. Where EU Standard Contractual Clauses or another mandatory transfer instrument is required, the parties shall incorporate the applicable module and complete required annexes. Brazil transfers shall follow applicable LGPD/ANPD mechanisms.

12. Processing Description

Subject matter: provision of the PrediSmart Platform. Duration: subscription plus lawful retention. Nature: collection, recording, organization, storage, consultation, transmission, synchronization, analysis, extraction, support, security and deletion as applicable. Purposes: Customer-configured operational management and contracted services. Data subjects may include Customer personnel, contractors, authorized users, residents, occupants, suppliers, visitors or other persons whose data Customer lawfully processes through the Platform. Categories may include identity, contact, role, operational, technical, device, image, voice/text report, asset-related, meter, access/audit, IoT/sensor and other Customer-submitted information.