Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Clevra Terms of Service (the "Terms") between Clevra Inc., doing business as Clevra ("Clevra", "we", "us"), a Delaware company with its address at 2810 North Church Street, Wilmington, DE 19802, United States, and the business that uses the Clevra service ("Customer", "you").

It applies automatically, on every plan, whenever Clevra processes Personal Data on your behalf. You do not need to sign anything. If your business needs a countersigned copy, email hi@clevra.ai.

1. Definitions

• Personal Data means any information relating to an identified or identifiable person that is contained in Customer Data (as defined in the Terms) and that Clevra processes on your behalf.
• Data Protection Laws means the privacy and data protection laws that apply to that processing, which may include Canada's PIPEDA and provincial laws such as Quebec's Act respecting the protection of personal information in the private sector, the California Consumer Privacy Act as amended (CCPA) and other US state privacy laws, and, where they apply, the GDPR and UK GDPR.
• Subprocessor means a third party Clevra engages to process Personal Data on your behalf.
• Security Incident means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data.

Other capitalized terms have the meaning given in the Terms.

2. Roles

You decide what Personal Data goes into Clevra and why. For that data you are the controller (or "business" under US state laws), and Clevra is your processor (or "service provider" or "processor" under US state laws). Clevra is a separate controller only for the account, billing and usage information described in our Privacy Policy, which this DPA does not cover.

3. Your instructions

Clevra processes Personal Data only to provide, secure and support the Service, and otherwise on your documented instructions. The Terms, this DPA and your use and configuration of the Service are your instructions. If we believe an instruction breaks Data Protection Laws, we will tell you. Annex 1 describes the processing.

You are responsible for having a lawful basis and any notices and consents required to put Personal Data into Clevra, including consent to send text messages to your clients.

4. Confidentiality

Clevra limits access to Personal Data to staff and contractors who need it to run the Service, and binds them to confidentiality obligations.

5. Security

Clevra maintains administrative, technical and physical safeguards designed to protect Personal Data, as described in Annex 2. We may update these measures as long as the overall level of protection does not go down.

6. Subprocessors

You authorize Clevra to use the Subprocessors listed in Annex 3. Clevra puts a written agreement in place with each Subprocessor that protects Personal Data at least as well as this DPA, and remains responsible for its Subprocessors' performance.

Before adding or replacing a Subprocessor, Clevra will update Annex 3 on this page and give notice by email to the Account Owner at least 15 days in advance. If you have a reasonable data protection objection, tell us within that period. We will work with you in good faith on a solution. If we cannot find one, you may cancel the affected paid subscription and we will refund any prepaid fees for the period after the cancellation takes effect.

7. Help with requests from individuals

If a person asks Clevra to access, correct, delete or export Personal Data that belongs to your account, we will pass the request to you and will not answer it ourselves unless you tell us to or the law requires it. The Service lets you view, edit, export and delete most records yourself. Where you cannot do something in the Service, we will help as reasonably needed for you to meet your obligations.

8. Security Incidents

Clevra will notify you without undue delay, and within 72 hours, after confirming a Security Incident affecting your Personal Data. We will share what we know about the incident, the data and people likely affected, and the steps we are taking, and will update you as we learn more. Notice will go to the Account Owner's email address. Notifying you is not an admission of fault.

9. Impact assessments and consultations

Where Data Protection Laws require it, Clevra will give you reasonable information about the Service to help you complete a privacy impact assessment or consult a regulator.

10. Return and deletion

You can export key records at any time during your subscription. For 30 days after your account is cancelled or terminated, we will make an export available on request, as set out in the Terms. After that, Clevra deletes Personal Data in the ordinary course, unless the law requires us to keep it. Copies in encrypted backups are deleted as those backups roll off.

11. Information and audits

On written request, and no more than once a year unless a regulator requires it or a Security Incident has occurred, Clevra will answer reasonable written questions about its compliance with this DPA. Any information we share is our Confidential Information under the Terms.

12. Where data is processed

Clevra is a US company. Personal Data is stored and processed in the United States and in other places where our Subprocessors operate. Where Data Protection Laws require a transfer mechanism, such as the EU Standard Contractual Clauses or the UK Addendum for data from the EEA or UK, those clauses are incorporated by reference, with you as data exporter and Clevra as data importer. For Canadian Personal Data, Clevra protects it to a standard comparable to Canadian law wherever it is processed.

13. US state privacy law terms

For Personal Data covered by the CCPA or a similar US state law, Clevra:

• does not sell or share it, as those terms are defined in the CCPA;
• does not keep, use or disclose it for any purpose other than the business purposes set out in the Terms and this DPA, or outside our direct business relationship with you;
• does not combine it with personal information we receive from other sources, except as the law allows a service provider to do;
• will give it the same level of privacy protection the law requires of you, and will tell you if we can no longer meet our obligations; and
• lets you take reasonable steps to stop and fix any unauthorized use.

Clevra may create de-identified or aggregated data as described in the Terms, and will not try to re-identify it.

14. Liability and order of precedence

Each party's liability under this DPA is subject to the limitations in the Terms. If this DPA and the Terms conflict about the processing of Personal Data, this DPA wins. Where the Standard Contractual Clauses apply, they win over both.

15. Term and changes

This DPA lasts as long as Clevra processes Personal Data on your behalf. We may update it to reflect changes in law or in the Service. Material changes follow the notice process in the Terms, and no update will reduce the protection given to Personal Data. The "Last Update" date at the top shows the current version.

Annex 1: Details of processing

• Purpose: providing the Clevra field service software, including requests, estimates, scheduling, jobs, checklists, invoicing, payments, client portal, messaging, reports and AI features, plus support and security.
• People concerned: your clients and their contacts, people who submit your request forms, and your team members.
• Types of data: names, email addresses, phone numbers, service and billing addresses, job and visit records, estimates, invoices and payment records, checklist answers, photos, signatures and files, notes, messages sent through the Service, timesheets and labour costs for team members, and anything else you choose to store.
• Sensitive data: the Service is not designed for special categories of data. Please do not store health, financial account or government ID numbers in free-text fields.
• Duration: for the life of your account, then as described in section 10.

Annex 2: Security measures

• Encryption of data in transit.
• Tenant-level isolation so each company's data is kept separate.
• Role-based, deny-by-default permissions inside each account.
• Multi-factor authentication and Google sign-in available to users.
• Secure session management and expiring client portal login links.
• An audit log of changes within each account.
• Access to production systems limited to staff who need it.
• Error monitoring and regular backups.
• Card details handled by Stripe, so Clevra never stores full card numbers.

Annex 3: Subprocessors

If you connect Clevra to a third-party product, such as QuickBooks Online, a calendar app or an AI assistant through the Clevra connector, that provider receives data at your direction under its own terms. It is not a Clevra Subprocessor.

Contact

Questions about this DPA: Privacy Officer, hi@clevra.ai
Clevra Inc. (dba Clevra), 2810 North Church Street, Wilmington, DE 19802, United States