1. PARTIES & SCOPE

This Data Processing Addendum ("DPA") supplements, and is incorporated into, the LoadIt AI Inc Terms of Service, Enterprise User Agreement, and Billing & Subscription Agreement (together, the "Agreement") between LoadIt AI Inc, a Delaware corporation ("LoadIt," "Processor"), and the customer identified in the Agreement ("Customer," "Controller").

This DPA applies to LoadIt's processing of Personal Data on Customer's behalf in connection with the cloud software platform offered under the OptimizeIt, JunkIt, StoreIt, SiteIt, and InsureIt product brands, together with all industry packs and trade-specific workflows offered through those products (the "Platform"). In the event of a conflict between this DPA and the Agreement solely with respect to the processing of Personal Data, this DPA controls.

Customer is the "Controller" / "Business" of Personal Data submitted to the Platform. LoadIt acts as the "Processor" / "Service Provider" and processes Personal Data only on Customer's documented instructions, as set out in the Agreement and this DPA.

2. DEFINITIONS

"Personal Data" — information relating to an identified or identifiable natural person processed via the Platform, including end-customer contact details, intake submissions, photos, audio recordings, and transcripts.

"Data Protection Laws" — all laws applicable to processing of Personal Data, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the California Consumer Privacy Act / California Privacy Rights Act ("CCPA/CPRA"), Virginia CDPA, Colorado CPA, Connecticut CTDPA, Texas TDPSA, and similar U.S. state and Canadian PIPEDA / Quebec Law 25 regimes.

"Subprocessor" — any third party engaged by LoadIt that processes Personal Data on LoadIt's behalf to provide the Platform.

"Standard Contractual Clauses" or "SCCs" — the European Commission Module Two (Controller-to-Processor) SCCs (Decision 2021/914) and, where applicable, the UK International Data Transfer Addendum.

3. NATURE & PURPOSE OF PROCESSING

• Subject matter: hosting and operation of a multi-industry SaaS platform for service businesses.
• Duration: the term of the Agreement plus the data-retention window in Section 9.
• Nature of processing: hosting, storing, transmitting, analyzing, indexing, generating AI estimates, sending transactional messages (email/SMS/voice), generating documents and invoices, and providing analytics on Customer Data.
• Categories of data subjects: Customer's employees and authorized users, Customer's end customers (e.g., homeowners and other purchasers of Customer's services), Customer's leads, and Customer's vendors.
• Categories of Personal Data: name, business name, postal address, email, phone, photos and video uploaded for AI estimating, audio recordings and transcripts of inbound/outbound calls, IP address, device/browser metadata, payment metadata (no full PAN — handled by PCI-DSS-validated payment processor), service/job history, and free-text fields the customer chooses to submit.
• Special categories: the Platform is not designed to process special-category data (health, biometric, racial, religious, sexual orientation) or government identifiers. Customer must not submit such data.

4. PROCESSOR OBLIGATIONS

LoadIt will: (a) process Personal Data only on Customer's documented instructions and to provide the Platform; (b) ensure persons authorized to process Personal Data are subject to confidentiality; (c) implement and maintain the technical and organizational security measures in Section 7; (d) engage Subprocessors only under Section 5; (e) assist Customer in responding to data-subject rights requests; (f) assist with security, breach notification, DPIAs, and prior consultations; (g) at termination, return or delete Personal Data per Section 9; and (h) make available information reasonably necessary to demonstrate compliance with this DPA.

5. SUBPROCESSORS

Customer provides general authorization to LoadIt to engage the Subprocessors listed in Section 6 to process Personal Data. LoadIt will: (a) impose written data-protection terms on each Subprocessor that are no less protective than this DPA; (b) remain liable for each Subprocessor's acts and omissions to the same extent as for its own; and (c) give Customer at least thirty (30) days' prior notice (via email to the account's notification address and/or update of this page) before adding or replacing a Subprocessor. Customer may reasonably object on Data Protection grounds within fifteen (15) days of notice; if not resolved, Customer may terminate the affected service for cause with refund of unused prepaid fees for that service.

6. CURRENT SUBPROCESSOR LIST

Last updated: June 6, 2026. Categories appear as customer-facing capability labels in the Platform; vendor names are disclosed below for DPA purposes.

Customer may subscribe to subprocessor change notifications by emailing legal@optimizeit.ai with the subject line "Subprocessor Updates."

7. SECURITY MEASURES

LoadIt implements and maintains the following technical and organizational measures:

• Encryption in transit (TLS 1.2+) and at rest (AES-256) for Personal Data;
• Row-level security (RLS) enforcing multi-tenant isolation at the database layer;
• Role-based access controls, principle of least privilege, and unique credentials for staff;
• Centralized identity and SSO with MFA enforced for all production access;
• Network segmentation, WAF, and DDoS protection at the edge;
• Application and infrastructure logging, monitoring, and alerting;
• Regular automated and manual security testing, dependency scanning, and patching;
• Incident-response plan with defined severity tiers and communication paths;
• Background checks and confidentiality obligations for employees and contractors with production access.

8. PERSONAL DATA BREACH NOTIFICATION

LoadIt will notify Customer without undue delay, and in any event within seventy-two (72) hours after becoming aware of a Personal Data Breach affecting Customer's Personal Data. The notification will include, to the extent then known: nature of the breach, categories and approximate number of data subjects and records concerned, likely consequences, and measures taken or proposed to address and mitigate the breach.

9. RETURN & DELETION OF DATA

Customer may export Customer Data in CSV / JSON during the subscription term and for thirty (30) days after termination. After that 30-day window, LoadIt will perform a hard delete of Customer Data from active systems, except for: (a) routine encrypted backups, which are overwritten on the regular backup cycle (no more than 35 days); and (b) records LoadIt must retain by law. This Section supersedes any inconsistent retention timeline in the Agreement.

10. INTERNATIONAL TRANSFERS

Where Personal Data of EU/EEA, UK, or Swiss data subjects is transferred to a country not subject to an adequacy decision, the parties incorporate the Standard Contractual Clauses by reference. Module Two (Controller-to-Processor) applies, with: Clause 7 (docking) enabled; Clause 9(a) Option 2 (general written authorization, 30-day notice) per Section 5 above; Clause 11 (independent dispute resolution) not used; Clause 17 Option 1 governed by Irish law; Clause 18 forum in Ireland. For UK transfers, the UK Addendum applies with LoadIt as Importer and Customer as Exporter; tables completed using the information in this DPA. For Swiss transfers, references to GDPR are read as references to the Swiss FADP.

11. CCPA / CPRA — SERVICE PROVIDER

With respect to Personal Information of California residents, LoadIt acts as a "Service Provider" and not a "Third Party," and will not: (a) sell or share Personal Information; (b) retain, use, or disclose Personal Information outside of the direct business relationship between LoadIt and Customer; (c) combine Personal Information received from Customer with Personal Information received from any other source, except as permitted by the CCPA. LoadIt will notify Customer if it determines it can no longer meet its obligations under the CCPA.

12. AI / GENERATIVE-AI ACCEPTABLE USE

LoadIt configures all AI Subprocessors (including OpenAI and Google Gemini) to use API endpoints that do not train models on Customer Data. Customer agrees not to submit special-category data, government identifiers, or data of children under 13 (or 16 in the EU) into AI features, and to disclose to its end customers that AI is used to generate estimates, document drafts, and reply messages.

13. AUDITS

Once per calendar year, on at least thirty (30) days' prior written notice and subject to confidentiality, Customer (or an independent auditor bound by confidentiality and not a competitor of LoadIt) may audit LoadIt's compliance with this DPA. LoadIt may satisfy this obligation by providing a current SOC 2 Type II report or equivalent third-party attestation, when available, plus written responses to a reasonable security questionnaire.

14. GOVERNING LAW

This DPA is governed by the law of the State of Delaware, except that for processing subject to GDPR, EU member-state law and the SCCs control where mandatorily applicable.

15. COUNTERSIGNATURE

This page constitutes the standing DPA offered to all LoadIt customers. To request a countersigned copy on LoadIt letterhead bearing both parties' signatures, email legal@optimizeit.ai with your legal entity name and primary account email.