Data Processing Addendum

Effective October 28, 2026. Last updated November 3, 2026.

1. About this addendum

This Data Processing Addendum (“DPA”) is between RoadReviveGarage (“FieldSummit”, “we”, “us”) and the business customer that uses the FieldSummit service (“you”). It is part of our Terms of Service and applies automatically whenever FieldSummit processes Customer Personal Data for you. No separate signature is needed. If this DPA conflicts with the Terms on data protection, this DPA controls.

2. Definitions

• Customer Data has the meaning given in the Terms: the content you and your users put into the service.
• Customer Personal Data means personal information within Customer Data, such as details about your customers, their homes and equipment, and your staff.
• Data Protection Laws means United States federal and state privacy and data security laws that apply to the processing, including the California Consumer Privacy Act as amended (“CCPA”), other state consumer privacy laws, and the Illinois Personal Information Protection Act.
• Security Incident means a breach of security involving Customer Personal Data, including circumstances requiring notification under applicable Data Protection Laws.
• Sub-processor means a third party we engage that processes Customer Personal Data to help us provide the service.

3. Roles

You are the business or controller of Customer Personal Data. FieldSummit is your service provider and processor. You decide what Customer Personal Data goes into the service and why. We process it only for you, as described in this DPA.

4. Details of the processing

• Purpose: to provide, secure and support the FieldSummit service for you, including the features you choose to use, such as estimate links, AI features and the GPS add-on.
• Types of data: names, contact details and service addresses of your customers; job notes and history; equipment details; photos, video and voice transcripts; estimates, invoices and payment records; staff account details; and, if you turn on the GPS add-on, the location of your technicians’ devices while they are working.
• People the data is about: your customers and their household members or contacts, and your staff.
• Duration: while your account is active and until deletion as described in section 12.

The service is not designed for, and you agree not to upload, payment card numbers, bank account numbers, Social Security numbers, driver’s license numbers, health information or biometric information. FieldSummit does not collect biometric identifiers or biometric information.

5. Your instructions

We process Customer Personal Data only on your documented instructions. The Terms, this DPA, and your use and settings of the service are your instructions. We will tell you if we believe an instruction breaks Data Protection Laws, and we may decline to follow it. We may also process Customer Personal Data where the law requires us to; where the law allows, we will tell you first.

6. Your responsibilities

• You are responsible for having a lawful basis to collect Customer Personal Data and put it into the service.
• You are responsible for giving your customers and staff any notices, and getting any consents, the law requires, including for photos, video and audio recording, AI processing and location tracking.
• You are responsible for the accuracy of Customer Personal Data and for how your users access and use it.

7. Service provider terms (CCPA and similar laws)

For Customer Personal Data, FieldSummit:

• will not sell or share it, as those terms are defined in the CCPA;
• will not keep, use or disclose it for any purpose other than the business purposes in section 4, including any commercial purpose other than providing the service to you, or outside our direct business relationship with you, except as Data Protection Laws allow;
• will not combine it with personal information we receive from anyone else or collect ourselves, except as Data Protection Laws allow service providers to do;
• will comply with the obligations that apply to us under Data Protection Laws and give Customer Personal Data the same level of privacy protection those laws require of you;
• will tell you if we decide we can no longer meet our obligations under Data Protection Laws; and
• allows you, on reasonable notice, to take reasonable and appropriate steps to stop and fix any unauthorized use of Customer Personal Data.

We may use information about how the service is used and performs, in a form that does not identify you, your users or your customers, to maintain and improve the service, as Data Protection Laws allow.

8. Confidentiality and security

Anyone at FieldSummit who can access Customer Personal Data is bound by a duty of confidentiality and has access only as needed to do their work. We maintain reasonable administrative, technical and physical safeguards appropriate to the nature of the data, including:

• encryption in transit (HTTPS);
• secure sign-in cookies and a separate sign-in for each user;
• logical separation of each company’s data from other companies’ data;
• role-based access controls within each account;
• audit records of important actions;
• verification of signed messages from our payment provider;
• request-size limits and spam and abuse protection;
• limited staff access to production systems; and
• regular database backups for recovery.

We may update these measures over time, as long as the overall level of protection does not go down.

9. Sub-processors

• You authorize us to use the Sub-processors listed on our Sub-processors page.
• We will have a written agreement with each Sub-processor that protects Customer Personal Data at least as well as this DPA. We remain responsible for our Sub-processors’ work.
• Before we add or replace a Sub-processor that will process Customer Personal Data, we will update the Sub-processors page and tell account holders by email or in the app at least 30 days in advance, unless an urgent change is needed to keep the service running or secure, in which case we will tell you as soon as we can.
• You may object on reasonable data protection grounds within that notice period. We will try to find a reasonable solution. If we cannot, you may cancel the affected service, and we will refund any fees you prepaid for the period after cancellation.
• Independent recipients. Google Maps Platform processes information under its own controller terms, as disclosed in our Privacy Policy and Sub-processors page. It is not represented as our sub-processor for that processing. Services you choose to connect, such as QuickBooks Online, operate under your agreement with their providers. We transmit Customer Personal Data to these recipients only as necessary to carry out your lawful instructions and as permitted by applicable Data Protection Laws. This distinction does not reduce our obligations for our own processing or authorize otherwise prohibited disclosures.

10. Helping you meet your obligations

• Requests from people. If someone asks us directly to access, correct or delete their information in your Customer Data, we will send the request to you and will not respond to it ourselves except to tell them to contact you. The service lets you view and correct Customer Personal Data, and we will give reasonable help with exports, deletions and other requests you need to answer.
• Assessments. We will give reasonable information you need for a data protection or risk assessment about the service.
• Information about our practices. Once a year, or after a Security Incident, we will answer a reasonable written security questionnaire about the service. Information we give you is confidential.
• Verifying our processing. You may take reasonable and appropriate steps to verify that our processing complies with your obligations under applicable Data Protection Laws. We will provide reasonably necessary information and cooperate with proportionate assessments or audits, subject to safeguards for security, confidentiality and other customers’ data. The annual questionnaire does not limit these rights or our legally required cooperation.

11. Security incidents

We will notify the affected contractor without undue delay after becoming aware of a Security Incident, and sooner whenever applicable law requires. Where 815 ILCS 530/10(b) applies, we will notify the owner or licensee immediately following discovery if covered personal information was, or is reasonably believed to have been, acquired by an unauthorized person. We will provide the information then available and supplement it as our investigation continues; we will not delay a legally required notice pending confirmation or completion of the investigation. We will tell you what we know about what happened, the data and people affected, and the steps we are taking, and we will update you as we learn more. We will take reasonable steps to contain the incident and limit harm, and we will give reasonable help so you can meet any duty you have to notify your customers, staff or authorities, including under the Illinois Personal Information Protection Act. Telling you about a Security Incident is not an admission of fault.

12. Return and deletion

• You can request an export of Customer Data at any time while your account is active and for 30 days after your account ends.
• We delete Customer Data, including Customer Personal Data, within 90 days after your account ends.
• Copies in our backups are removed as older backups are deleted, and are protected under this DPA until they are.
• We may keep information we are required to keep by law, and we will continue to protect it under this DPA for as long as we keep it.

13. Where data is processed

We currently host and process Customer Personal Data with Railway in its US East (Virginia, United States) region. Some Sub-processors operate global networks and may process data in other countries, as shown on our Sub-processors page. We require them to protect it as this DPA requires.

14. Liability and term

Each party’s liability under this DPA is subject to the limitation of liability in the Terms. This DPA lasts as long as we process Customer Personal Data for you.

15. Changes and contact

We may update this DPA as described in the Terms. We will not make a change that materially reduces the protection of Customer Personal Data unless the law requires it. Questions: RoadReviveGarage, support@fieldsummitapp.com.