Data Processing Addendum

Effective September 24, 2026 · Version 2026-09-24

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Daily Log LLC (“Processor”) and the customer company (“Controller”). It applies automatically whenever we process personal information on the Controller's behalf.

You do not need to sign this. It is incorporated into the Terms of Service and is in force for every customer. If your procurement process requires a countersigned copy, email support@dailylog.com with the subject line DPA Request and we will sign one.

1. Roles

The Controller determines the purposes and means of processing the personal information in its workspace. We process it only on the Controller's documented instructions. Using the Services as designed — and any configuration the Controller chooses within them — constitutes those instructions. Under California law we act as a service provider, and we certify that we understand and will comply with the restrictions in Section 3.

2. Scope of processing

Subject matter	Providing the DailyLog construction daily-log platform
Duration	The term of the subscription, plus the retention periods in the Privacy Policy
Nature and purpose	Hosting, storage, transmission, text messaging, AI captioning and transcription, reporting and export
Categories of data subject	The Controller's employees, crew members, subcontractors, and business contacts; people appearing or audible in uploaded media
Types of personal information	Names, email addresses, mobile phone numbers, job roles, photographs and video, voice recordings and transcripts, hours worked, schedule assignments, activity timestamps, IP addresses

3. Our obligations

Process personal information only on the Controller's documented instructions, and tell the Controller if we believe an instruction violates applicable law
Not sell or share personal information, and not retain, use, or disclose it for any purpose other than performing the Services, or outside the direct business relationship — except as permitted by law
Not combine personal information received from the Controller with information from other sources, except as permitted for a service provider
Ensure personnel with access are bound by confidentiality
Maintain the technical and organizational measures described in Section 7 of the Privacy Policy
Assist the Controller in responding to data-subject requests, and in meeting its security, breach-notification, and impact-assessment obligations, taking account of the information available to us
Make available the information reasonably necessary to demonstrate compliance with this DPA

4. The Controller's obligations

Have a lawful basis for the personal information it puts into the Services, and provide required notices to its own people
Obtain text-message consent from every person whose number it adds, and maintain its own record of that consent — see Section 5 of the Terms of Service
Obtain any consent required to photograph, film, or record its workers and third parties
Not upload the categories of sensitive information we ask customers to keep out of the Services
Configure roles and remove departed users promptly

5. Subprocessors

The Controller gives general authorization for us to engage the subprocessors listed on our Subprocessors page. We impose data-protection obligations on each that are at least as protective as those in this DPA, and we remain responsible for their performance. We will update that page before a new subprocessor begins processing, and the Controller may object on reasonable data-protection grounds as described there.

6. Security incidents

We will notify the Controller without undue delay, and in any event within 72 hours of confirming a personal-data breach affecting the Controller's data. The notice will describe the nature of the incident, the categories and approximate volume of data involved, the likely consequences, and the measures taken or proposed. We will cooperate reasonably with the Controller's own notification obligations. An unsuccessful attempt that does not compromise data is not a breach.

7. Data-subject requests

If we receive a request from one of the Controller's data subjects, we will not respond substantively ourselves — except to acknowledge and redirect — and will forward it to the Controller promptly. We provide tools within the Services, and reasonable assistance beyond them, for the Controller to access, correct, export, and delete personal information in its workspace.

8. Audits

On reasonable written request, no more than once a year, we will answer a reasonable security questionnaire and provide available documentation about our controls. Where a Controller's regulator requires an on-site audit, the parties will agree scope, timing, and cost in advance so it does not disrupt the Services or compromise other customers' confidentiality.

9. Deletion and return

On termination, the Controller may export its data for 90 days. After that we delete it on the schedule published in Section 6 of the Privacy Policy, except where law requires us to keep it. Backup copies age out on their normal cycle.

10. International transfers

We process personal information in the United States. Where a transfer mechanism is required for personal information originating outside the United States, the parties will put an appropriate one in place — contact us and we will work through it.

11. Liability and precedence

Each party's liability under this DPA is subject to the limitations in the Terms of Service. If this DPA conflicts with the Terms of Service on the processing of personal information, this DPA controls. A separate written agreement signed by both parties controls over both.

12. Contact

Daily Log LLC

support@dailylog.com