Data Processing Addendum

1. Scope and roles

The customer is the controller, business, or equivalent party that determines the purposes and means of processing Customer Personal Data. Trough is the processor, service provider, or contractor processing that data to provide the Service. Each party remains independently responsible for personal data it processes for its own account, including account administration, billing, security, fraud prevention, and legal compliance.

Customer Personal Data means personal information submitted to the Service by or for the customer, including homeowner, prospect, employee, applicant, subcontractor, and job information, but excluding information for which Trough independently determines the processing purposes.

2. Processing details

• Subject matter: hosting and operating contractor workflow, CRM, field, proposal, signature, communication, scheduling, reporting, and payment-record services.
• Duration: the agreement term plus the retention and deletion period described in the Privacy Policy, the customer's instructions, and applicable law.
• Nature and purpose: collect, organize, store, retrieve, transmit, display, back up, secure, support, and delete data as needed to provide the Service.
• People: contractor customers and prospects, homeowners, property contacts, workforce members, applicants, subcontractors, suppliers, and authorized users.
• Data: identity, contact, property, job, photo, scheduling, communication, proposal, signature, payment-status, workforce, device, usage, and audit data. Raw card data is intended to be handled by Stripe rather than Trough.

3. Customer instructions

Trough will process Customer Personal Data only on documented customer instructions, including the agreement, product configuration, authorized user actions, support requests, and legal requirements. Trough will notify the customer if an instruction appears to violate applicable data-protection law unless prohibited from doing so. The customer is responsible for lawful instructions, notices, permissions, accuracy, and data minimization.

4. Confidentiality and personnel

Trough will limit access to people and providers who need it to operate, secure, or support the Service and who are subject to appropriate confidentiality obligations. Trough will provide relevant privacy and security direction to personnel with access.

5. Security measures

Trough may update safeguards as technology and risk change, provided the overall protection is not materially reduced during a paid term without reasonable justification.

• Authentication, role-based authorization, tenant-qualified data access, and restricted platform administration.
• Transport encryption through managed HTTPS/TLS services and provider-managed storage encryption where offered.
• Audit logging, rate limiting, browser security headers, input and upload controls, secret management, monitoring, and incident investigation.
• Stripe-hosted payment collection designed to keep raw payment-card data outside Trough.
• Logical export and backup procedures, with production recovery settings and restore evidence maintained as operational controls mature.

6. Subprocessors

The customer generally authorizes the subprocessors listed on the Subprocessors page. Trough will require each subprocessor to protect Customer Personal Data consistently with the applicable portions of this DPA and remains responsible for its own selection and instruction of subprocessors as required by law.

Trough will post material new subprocessors before or when production processing begins. A customer with a legal right to object may contact support@trough.app promptly with a reasonable data-protection basis. The parties will work in good faith on an alternative, configuration change, or termination of the affected feature or Service.

7. Individual requests

Taking into account the nature of processing, Trough will provide reasonable assistance for verified requests to access, correct, delete, restrict, or export Customer Personal Data when the customer cannot fulfill the request using the Service. If Trough receives a request relating to customer-controlled data, it may direct the requester to the customer and will not respond substantively without authorization unless law requires it.

8. Security incidents

Trough will notify the customer without undue delay after confirming unauthorized acquisition of or access to Customer Personal Data for which notice is required. Notice will include available information reasonably needed for the customer to meet its obligations and will be updated as the investigation develops. Notice is not an admission of fault or liability.

9. Compliance assistance

Taking into account the processing and information available to Trough, Trough will provide reasonable assistance with security assessments, breach obligations, data-protection impact assessments, and regulator consultations required for the customer's use of the Service. Extraordinary assistance may be subject to agreed fees when not caused by Trough's breach.

10. Return and deletion

During an active account, authorized owners may use available exports. After termination or a verified instruction, Trough will delete or return Customer Personal Data as reasonably supported by the Service, except for information retained for legal, security, payment, dispute, or backup purposes. Retained copies remain protected by this DPA and are not used for another purpose. Provider backups may expire according to provider cycles rather than immediately.

11. Information and audit

Trough will make reasonably available current security and privacy documentation needed to demonstrate compliance. If that information is insufficient and law requires additional review, the customer may request a scoped audit no more than annually, subject to confidentiality, reasonable notice, minimal disruption, qualified independent reviewers, and responsibility for its costs. Audits may not expose another customer's data, security-sensitive testing details, or provider confidential information.

12. US state processor terms

Where a US state privacy law applies, Trough will process personal data only for the limited and specified purposes in the agreement; will not sell or share Customer Personal Data for cross-context behavioral advertising; will not retain, use, or disclose it outside the direct business relationship except as permitted by law; will provide the same level of privacy protection required of an applicable processor or service provider; and will notify the customer if it can no longer meet those obligations. The customer may take reasonable steps to stop and remediate unauthorized use.

13. Priority and changes

This DPA controls over conflicting agreement terms concerning processing of Customer Personal Data. Other agreement terms, including liability limits, remain effective unless applicable law prohibits them for a specific obligation. Trough may update this DPA to reflect law or Service changes without materially reducing protection; material changes will be communicated as described in the Terms.