Data Processing Addendum

A legal disclaimer

**Last Updated:** August 5, 2026
**Version:** ODPA-2026-08-05-v1

This Data Processing Addendum (the **“DPA”**) is part of the [Ophir Client Agreement](https://www.ophir.solutions/client-agreement) between Ophir LLC, an Idaho limited liability company (**“Ophir”**), and the business identified in the accepted Order Summary (**“Client”**). It applies when Ophir processes Client Personal Data on Client’s behalf. Capitalized terms not defined in this DPA have the meanings given in the Client Agreement.

Definitions and roles

**“Applicable Data Protection Law”** means U.S. federal and state privacy, data-protection, breach-notification, and data-security laws applicable to a party’s processing under the Agreement.

**“Client Personal Data”** means personal information that Ophir processes on Client’s behalf through Client’s Estimator or related Services. It includes equivalent terms such as “personal data” and “personal information” under Applicable Data Protection Law.

**“Security Incident”** means unauthorized acquisition of or access to Client Personal Data in Ophir’s control. It does not include unsuccessful activity that does not compromise Client Personal Data, such as blocked scans, pings, unsuccessful login attempts, or denial-of-service attempts.

For Client Personal Data submitted through Client’s Estimator, Client is the controller or business and Ophir is Client’s processor or service provider. Ophir may separately act as a controller or business for account administration, billing, security, fraud prevention, legal compliance, support, and service operations as described in Ophir’s [Privacy Notice](https://www.ophir.solutions/privacy).

Client’s instructions and responsibilities

Client instructs Ophir to process Client Personal Data only as reasonably necessary to:

- host, configure, operate, maintain, and secure Client’s Estimator;
- calculate and deliver requested planning estimates;
- send configured customer recap and Client lead-alert emails;
- transmit a request to the specific Client whose Estimator the customer used;
- provide support, troubleshooting, fraud prevention, and service administration;
- follow Client’s lawful documented instructions; and
- comply with applicable law.

Client is responsible for determining whether its instructions and intended processing are lawful. Client will provide required notices, establish any required lawful basis, obtain required consent, and respond to individuals and regulators. Ophir may decline or suspend an instruction that it reasonably believes violates applicable law or the Agreement while the parties attempt to resolve the concern.

Client will not instruct Ophir to collect or process Social Security numbers, government identification numbers, full payment credentials, credit applications or reports, account passwords, diagnoses or health information, precise geolocation, or information known to concern a child under 13 through the Estimator.

Processing details

Subject matter

Operating Client-branded HVAC planning estimators and delivering resulting customer requests

Duration

The active Agreement plus the return, deletion, backup, and lawful-retention periods described below

Nature and purpose

Collection, organization, calculation, limited storage, retrieval, transmission to Client, email delivery, support, security, return, and deletion

Data subjects

Homeowners, property representatives, prospective customers, and Client personnel

Personal-data categories

Name, email, telephone number, ZIP code or service address if enabled, property and HVAC-system answers, project preferences, estimate selections and results, communications, device or log data, and consent evidence

Sensitive or prohibited data

Social Security numbers, government IDs, account passwords, full card data, credit applications or reports, diagnoses or health data, precise geolocation, and data known to concern children under 13

Authorized recipients

Ophir personnel and service providers with a need for access, and the specific Client whose Estimator the individual used

Special restrictions

No sale of customer leads, cross-context behavioral advertising, unrelated lead resale, or disclosure to an unrelated contractor without separate documented authority and the individual’s specific consent

Ophir’s processing obligations

Ophir will:

- process Client Personal Data only on Client’s documented instructions, to provide the Services, or as required by law;
- notify Client before legally required processing outside Client’s instructions unless law prohibits notice;
- ensure personnel with access are subject to appropriate confidentiality obligations;
- implement and maintain safeguards appropriate to the nature of the data and processing risk;
- not sell Client Personal Data or use or disclose it outside the direct business relationship and purposes described in this DPA;
- not combine Client Personal Data with personal information received from another source except as permitted by applicable law and reasonably necessary to provide or secure the Services;
- notify Client if Ophir determines it can no longer meet an applicable privacy-law obligation;
- allow Client to take reasonable and appropriate steps to stop and remediate unauthorized processing;
- provide reasonably available information needed to demonstrate compliance with this DPA;
- assist Client, considering the nature of processing and information available to Ophir, with individual-rights requests, risk assessments, regulator inquiries, Security Incidents, and consultations required by law; and
- maintain records of processing and consent evidence to the extent included in the Services or reasonably available to Ophir.

Ophir certifies that it understands and will comply with the restrictions in this Section.

Individual privacy requests

If Ophir receives a request concerning Client Personal Data, Ophir will not provide a substantive response except as authorized by Client or required by law. Ophir will notify Client and provide reasonably available assistance. Client is responsible for verifying the requester’s identity and responding within the required period.

If a request concerns personal information for which Ophir acts as an independent controller or business, Ophir may respond directly under its Privacy Notice.

Security

Ophir will maintain a written security program appropriate to the Services and processing risk. Measures will include, as appropriate:

- access limited according to job responsibilities and least-privilege principles;
- unique administrative accounts and multi-factor authentication where supported;
- prompt removal of access that is no longer required;
- encryption in transit using current HTTPS/TLS protections;
- protected backend storage for privileged credentials and service secrets;
- validation of submission size, required fields, Client identity, consent, and authorized delivery recipients;
- separation of Client configurations and restrictions designed to prevent one Client from accessing another Client’s data;
- vendor access controls, contractual privacy and security obligations, and reasonable vendor review;
- logging and monitoring appropriate to authentication, administrative actions, changes, delivery, and security events;
- vulnerability, dependency, and change-management practices appropriate to the Services;
- backup and recovery measures where data is stored by Ophir or its providers; and
- incident-response procedures addressing containment, investigation, preservation, notification analysis, remediation, and lessons learned.

Client is responsible for protecting its own accounts, email systems, devices, credentials, downloaded information, and copies of lead-alert emails.

Security Incidents

Ophir will notify Client without undue delay after confirming a Security Incident and, when feasible, within 48 hours after confirmation. Notice will include information then reasonably available concerning the nature of the incident, affected data and individuals, likely consequences, containment and remediation, and an Ophir contact.

Ophir may provide information in phases as its investigation continues. Notice is not an admission of fault. Client determines whether notification to individuals, regulators, or others is legally required and is responsible for making those notifications unless applicable law requires Ophir to do so.

Client will promptly notify Ophir of a credential compromise, unauthorized disclosure, or incident in Client’s systems that affects the Services or Client Personal Data. Where lawful, neither party will identify the other publicly in connection with an incident without reasonable advance consultation.

Service providers and subprocessors

Client generally authorizes Ophir to use subprocessors reasonably necessary to provide and secure the Services. Ophir will require a subprocessor that processes Client Personal Data to accept written data-protection obligations appropriate to its services, and Ophir remains responsible for the subprocessor’s performance to the extent required by applicable law and this DPA.

At the Last Updated date, the principal services expected to process Client Personal Data are:

Stripe processes Client account, subscription, and billing information for Ophir’s business purposes. Ophir does not intend to send homeowner estimate submissions to Stripe.

Ophir may replace a provider or add a new material subprocessor. Ophir will give at least 15 days’ notice to Client’s account email before a new subprocessor materially processes Client Personal Data when reasonably practicable. Client may object within 10 days on reasonable data-protection grounds. The parties will attempt to resolve the concern. If they cannot, Client may terminate only the affected Service and receive a prorated refund of unused prepaid fees for that affected Service. Failure to object within the stated period constitutes approval.

Return, export, and deletion

Client is responsible for retaining its lead-alert emails and other business records. Ophir does not promise a permanent or complete lead archive unless the Order Summary expressly includes that feature.

Upon written request made during the Agreement or within 30 days after termination, Ophir will provide Client Personal Data then reasonably available in Ophir’s possession in a commonly used format, where technically feasible. Ophir may charge a disclosed and preapproved fee for unusual, manual, or custom export assistance outside the standard Services.

On Client’s lawful written instruction or termination of the Services, Ophir will delete or return Client Personal Data within 60 days unless applicable law requires retention. Data in isolated rolling backups will be protected from ordinary use and will expire through the normal backup cycle, planned within 90 days.

Ophir may retain limited billing, transaction, consent, opt-out, security, fraud, suppression, and legal-claim records as an independent controller or business where lawful. Those records remain subject to appropriate safeguards and purpose limitations.

Assessments and audits

Upon written request no more than once each year, Ophir will provide reasonably available privacy and security documentation, questionnaires, and applicable third-party reports. If that information is insufficient to address a specific legal concern, Client may conduct a narrowly scoped assessment through an independent, qualified, confidential, noncompetitor auditor.

An assessment requires at least 30 days’ notice, must occur during reasonable business hours, may not access another customer’s information, and may not unreasonably disrupt the Services. Client pays its assessment costs unless the assessment identifies Ophir’s material breach of this DPA. Additional assessments may be conducted after a Security Incident or when required by a regulator with jurisdiction.

State privacy-law requirements

If Applicable Data Protection Law imposes an additional mandatory controller-processor, business-service-provider, or contractor term, the parties incorporate that term to the minimum extent required. Ophir will cooperate with reasonable measures specified by applicable law that allow Client to monitor compliance and stop or remediate unauthorized use.

This DPA does not transfer responsibility for Client’s business practices, customer communications, advertising, HVAC services, or independent legal obligations to Ophir.

Conflict, liability, and acceptance

This DPA controls if it conflicts with the Client Agreement regarding the processing of Client Personal Data. The Client Agreement’s liability limitations apply to this DPA except where applicable law prohibits them.

This DPA is accepted when Client accepts the associated Client Agreement and Order Summary. No separate signature is required. Ophir will retain the accepted DPA version with Client’s acceptance record.