Data Processing Agreement

Last Updated: October 29, 2026

This Data Processing Agreement ("DPA") forms part of the PoolDial Terms of Service between you, the business customer, and Idappaccayata, LLC, which operates PoolDial. It applies when you are subject to the EU General Data Protection Regulation (GDPR), the UK GDPR, or the Swiss Federal Act on Data Protection, and PoolDial processes personal data in your Customer Data on your behalf. If this DPA and the Terms conflict on data protection, this DPA controls. If this DPA and the Standard Contractual Clauses conflict, the Standard Contractual Clauses control.

1. Roles

You are the controller of personal data in your Customer Data, such as your customers' names, addresses, service history, photos, messages, and call recordings. PoolDial is your processor. PoolDial is a separate controller for your account, billing, and usage information, as described in our Privacy Policy.

2. Your Instructions

PoolDial processes your personal data only to provide the Service and on your documented instructions, which are the Terms, this DPA, your settings, and your use of the Service, including actions you or your users ask Cody to take. If we believe an instruction breaks data protection law, we will tell you. If the law requires us to process data in another way, we will tell you first unless the law forbids it.

3. Confidentiality

Only people who need access to provide or support the Service may access your personal data, and they are bound by confidentiality. Today, production access is limited to PoolDial's founder.

4. Security

PoolDial maintains the technical and organizational measures in Annex II and will not materially weaken them while you use the Service.

5. Subprocessors

You give PoolDial general authorization to use the subprocessors listed in our Privacy Policy. We will email the account owner at least 30 days before adding or replacing a subprocessor that processes your personal data. You may object on reasonable data protection grounds within that period. If we cannot resolve the objection, you may end your subscription before the change takes effect, and we will refund prepaid fees for the period after it ends. We bind each subprocessor to data protection terms at least as protective as this DPA, and we remain responsible to you for their work.

6. Helping You

PoolDial will help you respond to requests from people exercising their data protection rights, mostly through the Service's tools for viewing, correcting, exporting, and deleting records. If someone contacts us directly about your Customer Data, we will point them to you and tell you without undue delay. We will also give reasonable help with data protection impact assessments and with consulting a supervisory authority, taking into account what information we have.

7. Personal Data Breaches

If we confirm a personal data breach affecting your personal data, we will email the account owner without undue delay, and within 72 hours of confirming it. We will share what we know, including the nature of the breach, the data and people likely affected, the likely consequences, and what we are doing about it, and we will add details as we learn them.

8. Deletion and Return

You can download your records at any time. When your subscription or trial ends, or when you delete your account, your personal data is kept or deleted as described in Section 13 of the Terms and the Data Retention section of the Privacy Policy. Copies in backups are deleted when the backups expire. Any data we must keep by law remains protected under this DPA.

9. Audits

PoolDial will make available the information reasonably needed to show compliance with this DPA, including written answers to reasonable security questionnaires. If that is not enough, you may audit PoolDial, or appoint an independent auditor bound by confidentiality, once per year with at least 30 days' written notice, during normal business hours, and at your own cost. We may first offer a remote review.

10. International Transfers

PoolDial processes personal data in the United States. For transfers of personal data from the EU or EEA to PoolDial, the Standard Contractual Clauses adopted by the European Commission in Decision (EU) 2021/914, Module Two (controller to processor), are incorporated into this DPA. You are the data exporter and PoolDial is the data importer. For those clauses:

• The optional docking clause in Clause 7 does not apply
• Under Clause 9, Option 2 (general written authorization) applies, with the 30-day notice in Section 5 of this DPA
• The optional language in Clause 11 does not apply
• Under Clause 13, the competent supervisory authority is the one for your establishment in the EU or EEA, or your EU representative if you have one
• Under Clauses 17 and 18, the clauses are governed by the law of Ireland, and disputes are resolved by the courts of Ireland
• The annexes are Annexes I to III of this DPA

For transfers from the United Kingdom, the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the UK Information Commissioner applies, with Table 1 completed with the parties in Annex I, Tables 2 and 3 completed as above, and either party may end it as allowed in its Section 19. For transfers from Switzerland, the same clauses apply, with references to the GDPR read as references to Swiss law and the Swiss Federal Data Protection and Information Commissioner as the competent authority.

11. Liability

Each party's liability under this DPA is subject to the limits in the Terms, except where the Standard Contractual Clauses or applicable law do not allow it.

Annex I: Description of the Processing

A. Parties. Data exporter: the business customer named on the PoolDial account, acting as controller. Data importer: Idappaccayata, LLC (PoolDial), 219 E Fairmont Dr, Tempe, AZ 85282, USA, [email protected], acting as processor.

B. Data subjects. Your customers and prospects, such as homeowners and property managers; your employees and technicians; and people who call, text, or email your business through PoolDial.

C. Categories of personal data. Names, phone numbers, email addresses, and property addresses; service history, notes, chemical readings, photos, documents, and signatures; messages, call recordings, and transcripts; invoices and payment records (card details are held by Stripe, not PoolDial); technician location history if you enable GPS tracking; and anything else you choose to store in the Service.

D. Sensitive data. None is intended. You should not store special categories of personal data in the Service.

E. Frequency. Continuous, for as long as you use the Service.

F. Nature and purpose. Hosting, storing, organizing, displaying, and transmitting your data, and processing it with AI features you use, so that PoolDial can provide the Service to you.

G. Retention. As described in Section 8 of this DPA.

H. Subprocessors. See Annex III.

Annex II: Security Measures

• HTTPS encryption for connections between users' browsers or apps and PoolDial
• Encryption at rest by PoolDial's hosting and storage providers, Railway and Cloudflare, using AES-256
• Passwords stored only as one-way hashes
• Role-based permissions within each account
• A database reachable only on the hosting provider's private network, with production access limited to PoolDial's founder
• Rate limiting and error monitoring
• Support access to an account is read-only, hides customer details by default, and cannot export data
• Breach notification as described in Section 7

Annex III: Subprocessors

The current list is in the Our Service Providers section of the Privacy Policy, together with what each provider does.