Data Processing Addendum (DPA)

1. Scope and Incorporation

This Data Processing Addendum ("DPA") forms part of the Terms of Service between the customer entity ("Customer") and Dooro Inc. ("Dooro," "Processor," "we," or "us") governing Customer’s use of Dooro (the "Agreement"). This DPA applies to the extent Dooro processes Personal Data on behalf of Customer as a Processor. If this DPA conflicts with the rest of the Agreement about the processing of Personal Data, this DPA controls.

2. Roles and Responsibilities

Customer is the Controller of Personal Data it submits to or collects through Dooro, and Dooro acts as the Processor. Customer is responsible for having a lawful basis, and any notice or consent required by law, for the Personal Data it provides and the outreach it approves. Dooro acts as Processor for the parser improvement instruction in Section 4.

3. Processing Details

Subject matter and purpose: the services Customer chooses to use, including Vacancy Recovery, which reviews rental inquiries Customer forwards to Dooro, prepares follow-up outreach for Customer’s approval, sends approved emails on Customer’s behalf, and reports campaign activity; reading lease documents Customer uploads; and testing and improving how Dooro reads forwarded emails, as Customer instructs in Section 4. Nature of processing: hosting, storage, transmission, organization, and the other processing needed to provide these services. Duration: the term of the Agreement, followed by deletion or return under Section 11 and the limited retention described in our Privacy Policy.

Categories of Data Subjects: Customer personnel; renters and prospective renters who contacted Customer about a rental. Categories of Personal Data: names and contact details; the content of emails forwarded to Dooro; rental inquiry and vacancy details; campaign records and email delivery and engagement events; lease document contents. Special categories of data are not intended to be processed, and Customer will not upload them unless required by law and adequately safeguarded.

4. Customer Instructions

Dooro will process Personal Data only on documented instructions from Customer. The Agreement, this DPA, and Customer’s configuration and use of the services are Customer’s documented instructions. If Dooro is required by law to process Personal Data beyond those instructions, Dooro will tell Customer first unless the law prohibits it.

Parser improvement. Customer instructs Dooro to keep the original copy of emails Customer forwards to Dooro, and, beyond providing the services, to use that copy only to test and improve how Dooro reads forwarded emails, so that future messages in the same format are understood correctly. Dooro will delete each original copy once it is 90 days old, using a job that runs daily, or earlier when Customer’s account is deleted. Dooro will not use this Personal Data to train or fine-tune artificial intelligence or machine-learning models. This instruction covers no other use of Personal Data.

5. Confidentiality

Dooro will ensure that each person who processes Personal Data on Customer’s behalf is subject to a duty of confidentiality with respect to that data, and that access is limited to people who need it to provide, secure, or support the services.

6. Security Measures

Dooro implements appropriate technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, taking into account the nature of the processing and the risks involved. Measures include encryption in transit, access controls, logging, and incident response procedures.

7. Subprocessors

Customer gives a general authorization for Dooro to engage Subprocessors. Dooro lists current Subprocessors at /legal/subprocessors. Dooro will give Customer notice before engaging a new Subprocessor, by updating that list and notifying Customer by email or a prominent notice in the product. Customer may object to a new Subprocessor on reasonable grounds by contacting privacy@dooro.co within a reasonable period after notice.

Dooro will engage each Subprocessor under a written contract requiring the Subprocessor to meet the obligations of Dooro under this DPA with respect to the Personal Data, and remains responsible for each Subprocessor’s performance.

8. International Transfers

Where applicable, transfers of Personal Data outside the originating jurisdiction will be made under appropriate safeguards required by applicable law.

9. Data Subject Requests and Assistance

Taking into account the nature of processing and the information available to it, Dooro will assist Customer by appropriate technical and organizational measures, insofar as possible, to respond to data subject requests (such as access, correction, and deletion), and to meet Customer’s obligations for the security of processing, breach notification, and data protection assessments.

10. Personal Data Breach Notification

Dooro will notify Customer without undue delay and in any event within 72 hours after becoming aware of a Personal Data Breach affecting Personal Data processed on Customer’s behalf. Dooro will provide the information reasonably available to it to help Customer meet any breach notification obligations, and will update Customer as more information becomes available.

11. Return or Deletion of Data

At the end of the provision of services, Dooro will, at Customer’s direction, delete or return all Personal Data processed on Customer’s behalf, unless retention is required by law. To ask for a return, contact privacy@dooro.co. Copies in backups are overwritten in the ordinary course.

Section 11 does not require Dooro to delete the email address of anyone who unsubscribes, which Dooro keeps indefinitely to honor opt-outs, or information Dooro derived from forwarded emails for an audit or campaign, which Dooro retains as described in the Retention and deletion section of the Privacy Policy. Original copies of forwarded emails are deleted as stated in Section 4.

12. Assessments and Audits

On Customer’s reasonable request, Dooro will make available the information in its possession necessary to demonstrate Dooro’s compliance with this DPA and applicable data protection law. Dooro will allow and cooperate with reasonable assessments of Dooro’s policies and technical and organizational measures by Customer or an assessor Customer designates, subject to reasonable confidentiality and scheduling, and no more than once a year unless required by law or following a Personal Data Breach.

13. Contact

Privacy and data protection inquiries: privacy@dooro.co