Data Processing Addendum

1. Scope and Relationship of the Parties

This Data Processing Addendum (“DPA”) supplements the JE Horizon Terms of Service entered into between J.E. Herizon LLC, a North Carolina limited liability company doing business as JE Horizon (“JE Horizon,” “Processor,” or “Service Provider”), and the subscribing contractor business entity (“Contractor,” “Customer,” or “Controller”).

This DPA applies to the processing of personal data provided by Contractor or collected on Contractor’s behalf through the JE Horizon Line communications platform, including homeowner contact details, voicemail audio and transcripts, SMS message content, and appointment scheduling information.

Under applicable data protection laws (including GDPR Art. 28 and U.S. comprehensive state privacy statutes):

• Contractor acts as the Data Controller (or “Business”), determining the business purposes and means of customer communications.
• JE Horizon acts as the Data Processor (or “Service Provider”), processing personal data strictly on behalf of Contractor and in accordance with Contractor’s documented instructions.

2. Details and Nature of the Processing

• Subject Matter: Contractor desk and inbox management, with customer SMS text-back, missed-call qualification, and voice features only when enabled after carrier approval.
• Duration: The term of Contractor’s active subscription plus any post-termination retention window specified in Section 7.
• Categories of Data Subjects: Contractor’s customers, prospective leads, and callers contacting Contractor’s designated business phone line.
• Types of Personal Data: Caller phone numbers, names, service addresses, voice recordings, voicemail transcripts, SMS conversation text, job problem summaries, and appointment timestamps.
• No Generalized Model Training: Processor shall not use Controller’s personal data or communications content to train generalized public artificial intelligence models.

3. Technical and Organizational Security Measures (GDPR Art. 32)

Processor maintains commercially reasonable technical and organizational safeguards designed to protect personal data against unauthorized access, destruction, loss, or alteration:

• Encryption in Transit: All public web traffic, API interactions, and telemetry utilize modern transport security (TLS 1.2+ mandatory). Plaintext HTTP is permanently disabled and redirected.
• Encryption at Rest: Persistent database volumes and file storage repositories employ industry-standard encryption at rest (AES-256).
• Multi-Tenant Boundary Isolation: Contractor account data, customer records, and communication histories are strictly partitioned by unique tenant identifiers. Cross-tenant access is prohibited at the software and database layers.
• Access Controls: Administrative access to production database clusters and telemetry systems is restricted to authorized personnel via authenticated, audited credentials.

4. Subprocessor Management & Notification

Controller provides general authorization for Processor to engage infrastructure, telephony, and software subprocessors necessary to deliver the Services. Current subprocessor functional categories include:

• Cloud Infrastructure & Database Hosting: Secure application container execution and encrypted relational database hosting (Fly.io).
• Payment Processing & Merchant Billing: PCI-DSS Level 1 certified subscription billing and payment tokenization (Stripe).
• Telephony & Carrier Gateways: Licensed carrier gateways for missed-call forwarding, interactive voice response, and 10DLC transactional SMS routing.
• Cloud Email & Object Storage: Transactional email delivery and encrypted knowledge base storage (Amazon Web Services).
• Edge Security & DNS Routing: Global content delivery, DDoS mitigation, and SSL/TLS edge termination (Cloudflare).
• Automated Speech & Message Generation: Dedicated enterprise AI speech recognition and message draft generation operating under enterprise zero-data-retention terms.

Processor shall provide at least thirty (30) days’ advance notice of any new subprocessor engagements via email or dashboard notification. Controller may object to a new subprocessor on reasonable data protection grounds within fifteen (15) days of notice; if unresolved, Controller may terminate the subscription without penalty.

5. Data Subject Rights and Regulatory Assistance

Taking into account the nature of the processing, Processor provides Controller with self-service tools and technical assistance to fulfill data subject requests under applicable privacy laws:

• Access and Portability: Controller may export customer records, conversation histories, and invoice data in structured formats directly from the dashboard.
• Correction and Erasure: Controller can edit or delete lead records, customer contact details, and conversation threads through the portal.
• Opt-Out and Suppression: Inbound opt-out keywords (STOP, CANCEL, END, QUIT, UNSUBSCRIBE) are processed immediately by our telephony suppression engine, silencing further automated SMS.
• Regulatory Inquiries: If a data subject submits a request directly to Processor, Processor shall promptly direct the individual to submit the inquiry to Controller.

6. Security Incident and Personal Data Breach Notification

Processor shall notify Controller without unreasonable delay—and in any event within forty-eight (48) hours—after confirming a Personal Data Breach affecting personal data processed on Contractor’s behalf.

Such notification shall describe: (a) the nature of the breach, including estimated categories and numbers of data subjects affected; (b) the identity and contact details of our compliance officer; (c) the likely consequences of the breach; and (d) measures taken or proposed to mitigate potential adverse effects. Processor shall cooperate with Controller in fulfilling Controller’s statutory breach notification obligations under state and federal law.

7. Return, Export, and Deletion of Data

Upon termination or expiration of Contractor’s subscription, Processor shall, at Controller’s choice:

• Data Export: Provide a complete, structured export of Controller’s customer records, lead communications, and invoice metadata within twenty-four (24) hours of offboarding request.
• Deletion: Permanently delete all personal data residing in production database stores within thirty (30) days of subscription termination, subject only to operational database backups retained up to ninety (90) days or statutory legal hold obligations.

8. Compliance Verification and Audits

Processor shall make available to Controller all information reasonably necessary to demonstrate compliance with the obligations laid down in this DPA and applicable data protection legislation. In the event of a regulatory audit, Processor agrees to provide compliance attestations and security documentation upon reasonable written notice.