How we handle personal information on your behalf.

1. Parties and Definitions

This agreement is between the Operator that accepted the Terms of Service (“you”) and Verinode Inc. (“Verinode,” “we”). Words defined in the Terms have the same meaning here.

Operator Personal Information

Information about an identifiable person that you, or someone on your account, upload, forward, or connect to Verinode, and that Verinode processes to provide the platform to you.

Data Protection Laws

The privacy and data protection laws that apply to the processing, including Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws, and the state privacy laws of the United States, including the California Consumer Privacy Act as amended (CCPA).

Sub-processor

A third party Verinode engages that processes Operator Personal Information to help run the platform.

Security Incident

A breach of security that leads to the accidental or unlawful loss of, or unauthorized access to or disclosure of, Operator Personal Information.

2. Who Is Responsible for What

• ·For Operator Personal Information, you decide and we process. You are the organization accountable for it (the controller, or the “business” under the CCPA). Verinode processes it on your behalf (the processor, or “service provider”).
• ·Anonymized benchmarks are ours, and they hold no personal information. As the Data Use Policy describes, the analytical dimensions of your data are anonymized and combined with other operators’ contributions under a minimum cohort size. That output identifies no person and no operator, and is not Operator Personal Information.
• ·Your account details are ours to protect. The names, emails, and sign-in records of the people who use Verinode are handled by Verinode as its own responsibility, under the Privacy Notice.

3. Processing Only on Your Instructions

Verinode processes Operator Personal Information only on your documented instructions. Your instructions are the Terms of Service, the Data Use Policy, this agreement, and the way you and your team use and configure the platform, including what you forward, upload, or connect. If we believe an instruction breaks a Data Protection Law, we will tell you. As your service provider, Verinode will not:

• ·sell or share Operator Personal Information, as the CCPA defines those terms;
• ·retain, use, or disclose it for any purpose other than providing the platform to you and the purposes the Data Use Policy enumerates, or outside our direct business relationship with you;
• ·combine it with personal information we receive from anyone else, except as the Data Protection Laws permit a service provider to do;
• ·train any AI model on it, or let anyone else do so.

We will tell you if we can no longer meet these obligations, and you may then take reasonable steps to stop and remediate any unauthorized processing.

4. Your Responsibilities

You are responsible for having a lawful basis for the information you send us, for giving the people it concerns any notice the law requires, and for obtaining any consent the law requires, as Section 6 of the Terms says. The platform is built for business records. Do not send us information it does not need, such as health records, government identification numbers, or payment card numbers, beyond what appears incidentally in a business document.

5. Confidentiality and Staff Access

Everyone at Verinode who can process Operator Personal Information is bound by a duty of confidentiality. No Verinode employee can browse or export your encrypted fields through any tool we operate. A person at Verinode can open your account only after you allow it with your password, for a window you set, and each such access is logged by name.

6. Security

Verinode maintains the technical and organizational measures described in Annex 2, appropriate to the risk of the processing. We may improve them over time, but we will not reduce the overall protection they give.

7. Sub-processors

• ·You authorize Verinode to engage the Sub-processors listed at verinode.ai/subprocessors, which is Annex 3.
• ·Verinode binds each Sub-processor by written terms that protect Operator Personal Information at least as well as this agreement, and remains responsible to you for its performance.
• ·Before a new Sub-processor processes Operator Personal Information, we will give you at least 30 days’ notice, by email or on the platform. If you object on reasonable data protection grounds, we will work with you in good faith to resolve it; if we cannot, you may end your membership before the change takes effect.
• ·IQ runs on models from Anthropic and OpenAI. They process your data only to answer your request and are contractually barred from training on it. They keep it for up to 30 days to watch for abuse and misuse, then delete it, and longer only where the law requires it or a request is flagged for misuse. There is no zero-data-retention agreement with either.

8. Where Data Is Processed

Operator Personal Information is stored and processed in the United States and Canada, and our Sub-processors are mostly United States companies. Where the law of your jurisdiction requires a transfer mechanism, Verinode relies on the mechanisms described in the Privacy Notice.

9. Requests from the People in Your Records

If a person asks Verinode directly to access, correct, or delete information about them that is in your records, we will tell you and will not answer the request ourselves unless you ask us to or the law requires it. The platform lets you find, export, correct, and delete records yourself, and we will help you respond to any such request. The process for individuals is at verinode.ai/data-subject-request.

10. Security Incidents

If Verinode becomes aware of a Security Incident affecting your Operator Personal Information, we will notify you without undue delay, and within 72 hours of discovery. The notice will say what we know at that time: what happened, what information and which people are likely affected, what we are doing about it, and who to contact. We will update you as we learn more, and help you meet any obligation you have to notify a regulator or the people affected.

11. Assessments and Regulators

We will give you the information you reasonably need to carry out a privacy impact assessment of your use of Verinode, and to respond to a regulator about it.

12. Return and Deletion

You can export your data at any time, in CSV or JSON, at no charge. When you close your account, your records and everything that links your contributions to you are deleted. Deletion runs at once; if any part fails, it is finished by hand within 72 hours, every deletion completes within 30 days, and copies in backup systems are gone within 90 days. Live benchmarks are recounted without you. Anonymized benchmarks already published stay as they were; they contain no personal information. We keep only what the law requires us to keep, for as long as it requires.

13. Demonstrating Compliance

On request, once a year or after a Security Incident, Verinode will answer a reasonable written security and privacy questionnaire and give you the information reasonably necessary to show that we meet this agreement, including summaries of independent assessments as they become available. Anything we share is our confidential information. Where a Data Protection Law or a regulator requires an audit beyond that, we will cooperate with one on reasonable notice, during business hours, at your cost, and in a way that protects other operators’ information.

14. Term, Liability, Precedence, and Law

Term.

This agreement applies for as long as Verinode processes Operator Personal Information for you, and survives the end of your membership until the deletion in Section 12 is complete.

Liability.

Each party’s liability under this agreement is subject to the limitations and exclusions in the Terms of Service, except where a Data Protection Law does not permit them.

Precedence.

On the processing of personal information, this agreement prevails over the Terms of Service and the Data Use Policy if they conflict.

Changes.

We may update this agreement as the law or the platform changes. Material changes are announced at least 30 days before they take effect, and never reduce the protection this agreement gives without your agreement.

Governing law.

The same as the Terms of Service: the laws of the Province of Ontario and the federal laws of Canada applicable there.

Annex 1. Details of the Processing

Subject matter and duration.

Providing the Verinode platform to you, for the term in Section 14.

Nature and purpose.

Receiving what you forward, upload, or connect; extracting structured data from it; storing it encrypted; analyzing it to produce your benchmarks, process insights, and IQ’s answers and recommendations; and anonymizing the analytical dimensions for peer benchmarks, as the Data Use Policy describes.

People the information is about.

Your owners, staff, and contractors; your customers, including property owners, tenants, and policyholders; insurance adjusters and carrier, third-party administrator, and program contacts; vendors and subcontractors; and anyone else named in the records you send.

Kinds of information.

Names and contact details; property and job addresses; claim, policy, and job identifiers; details of the work, estimates, invoices, and payments; employment details such as roles, hours, and pay; vehicle and equipment identifiers; the content of emails and documents you send or connect; and photos and recordings you submit.

Annex 2. Security Measures

• ·Encryption. All data is encrypted in transit and at rest. The identifying parts of your data are additionally encrypted, column by column, under a key scoped to you. No other operator or carrier can read them, and Verinode’s automated systems decrypt them only to run the product.
• ·Logged decryption. Every decryption of your encrypted fields is written to an audit log.
• ·Isolation between operators. Row-level security is enabled on every table that holds your business data, and every access is scoped to your account.
• ·Staff access. Limited to people who need it, protected by multi-factor authentication, logged, and possible inside your account only with your permission, as Section 5 describes.
• ·Backups. Encrypted backups are kept separately from the production databases.
• ·Monitoring and response. The platform is monitored, and Verinode keeps a written incident response and breach notification procedure.
• ·Sub-processors. Reviewed before they are engaged and bound by written data protection terms.

More detail is published at verinode.ai/security.

Annex 3. Sub-processors

The current list, with what each one does and where it processes data, is at verinode.ai/subprocessors.