Data Processing Addendum

In short (not part of the addendum)

• Your business data stays on your PC. We get no copy.
• This addendum applies only when we handle personal data for you: when our support signs in to your installation at your request (it can open every Company File, not only what you show us), when you send files to our support, and later if you switch on a "Coming soon" feature that passes data through our services.
• We use the data only on your instructions, for the support or service you asked for (and security and legal duties); we never sell or share it or train AI with it, and keep it confidential.
• We copy nothing in a support session unless you ask and delete support files within 30 days after your case ends; we report a breach without undue delay, within 48 hours at the latest; we announce a new service provider 30 days ahead, and you can object.
• What we keep for ourselves (orders, license keys, our e-mails with you) falls under our Privacy Policy.

LivingRoom Data Processing Addendum Draft 2 of 2026-10-25 - not yet in effect

This Data Processing Addendum ("DPA") is between Point of the Mountain Software LLC, a Utah limited liability company ("Company", "we", "us", "our"), and the business that holds a License for LivingRoom, the Company's inventory and order management software for Microsoft Windows ("Software") ("Customer", "you"). It forms part of the End User License Agreement for the Software ("EULA") and applies whenever we process personal data on your behalf as section 2 describes. Words with capital letters that this DPA does not define have the meaning given in the EULA.

1. Definitions

1.1 Data Protection Laws - the personal data laws that apply to the processing under this DPA, such as US state privacy and breach laws (including the California Consumer Privacy Act as amended, "CCPA", and its regulations).

1.2 Personal Data - for this DPA only: information in Customer Data about an identified or identifiable person (including "personal information" and "personal data" as the Data Protection Laws define them) that we process for you in a Processing Activity; not personal data we hold for ourselves (2.4).

1.3 Processing Activities - the activities in section 2.2.

1.4 Support Materials - (a) files you send to our support (such as a support file, a failing import file or a screenshot); (b) copies of Customer Data we make at your request, and Customer Data we note, in a Support Session; (c) personal data of people other than your contact person written into a message to our support. Our correspondence with your contact person is our own record (Privacy Policy: kept 3 years after the last contact).

1.5 Personal Data Breach - a breach of security leading to the accidental or unlawful destruction, loss or alteration of, or unauthorized disclosure of or access to, Personal Data in our or a Subprocessor's care.

1.6 Subprocessor - a third party we engage that processes Personal Data in a Processing Activity.

1.7 Connected Service - a service we run through which a Coming Soon Feature, once switched on, passes Customer Data (2.3).

1.8 Terms the Data Protection Laws define (such as "controller", "processor", "business", "service provider", "contractor", "sell", "share") have those meanings.

2. What this DPA covers

2.1 Your Customer Data stays with you in your Installation: we receive no copy, the License Check sends none, and the AI Assistant, when available, runs on your PC and sends us nothing. In normal use we process none.

2.2 Processing Activities (Annex 1). We process Personal Data for you only in (a) Support Sessions you arrange, where our support works in your Installation with Super User rights and can open every Company File, not only what you show us; (b) files you send to our support (Support Materials); (c) Connected Services, once switched on (2.3).

2.3 Connected Services. Some Coming Soon Features are built to pass data through services we run (Annex 1 Part B). They are off and send nothing until a later release switches them on or we switch one on for your Installation for a limited test you agree to (Beta and AI Terms B5). Before that we publish updated Annexes 1-3 for it; it stays off in your Installation until an Admin turns it on, which accepts those Annexes and brings it under this DPA.

2.4 Not covered: (a) data we hold for ourselves (License Data, Trial requests, Reseller accounts and what Resellers tell us about their customers), which we control under our Privacy Policy; (b) Paddle, an independent controller of checkout data; (c) services you connect to directly (such as a marketplace via your own API keys); (d) a Reseller's own support.

2.5 Our roles. For the Processing Activities you are the controller (the CCPA "business") and we your processor (the CCPA "service provider" or, if that does not fit, "contractor"). If you hold data for your own clients (for example as a prep center or 3PL), we are your subprocessor and you confirm they allow you to use us as this DPA describes.

3. Your responsibilities

3.1 Lawful basis and notices. You are responsible for a lawful basis for the Personal Data and our processing of it, and for required notices (such as telling staff and clients that your software vendor may see their data in support).

3.2 Only what the problem needs. Show and send us only that, and tell us which Company Files not to open (5.2). Do not put payment card numbers, online-banking passwords or access codes, individuals' Social Security, passport or driver-license numbers, health information or children's data into the Software (notes and attachments included), and never send them to us; the Software is not designed to protect them (Acceptable Use Policy 4.5; EULA section 8.5). Business details, such as a supplier's bank account on its invoice, a business tax ID (EIN) or a sales-tax exemption certificate number, may be kept.

3.3 Marketplace rules. You confirm that your agreements with the Third-Party Services whose data is in Customer Data let your software vendor see or receive it for support; if not, keep it out of Support Sessions and files you send us.

3.4 Who instructs us. An Admin, or a person you name to us in writing, may arrange a Support Session, send Support Materials and instruct us for it on your behalf; a client's staff (EULA section 2.3) may not. Requests to delete Customer Data or User Accounts, create or change roles, clear the activity log or reset the Installation (section 5.2) must come from an Admin in writing.

4. How we process Personal Data

4.1 Only on your instructions. We process Personal Data only on your documented instructions: the EULA, this DPA, your support request, the directions in a Support Session of the person section 3.4 allows to instruct us and, for a Connected Service, your Admin's settings. We will tell you if we believe an instruction breaks the Data Protection Laws, and may decline it; if a law requires other processing, we will tell you first unless it forbids that.

4.2 Business purposes. Only these specific purposes: (a) the support you asked for (finding, explaining and fixing a problem in your Installation, including restoring a Backup); (b) running a Connected Service your Admin turned on; (c) security of the Support Session, the Software and our systems, including detecting and investigating security incidents and fraud; (d) complying with the law.

4.3 What we will not do. We will not (a) sell or share Personal Data, or use it for any advertising; (b) keep, use or disclose it for any purpose other than section 4.2, including any other commercial purpose, or (c) outside our direct business relationship with you; (d) combine it with personal data we receive from others or collect in our own dealings with the people concerned; (e) use it to train, fine-tune or improve any AI model; or (f) try to re-identify anyone from data you or the Software de-identified. We may keep what we learn about a defect to fix the Software, but not the Personal Data.

4.4 Compliance. We will meet our obligations as your service provider, contractor or processor under the Data Protection Laws and give Personal Data the same level of privacy protection they require of you.

4.5 Certification. We certify that we understand the restrictions in sections 4.1 to 4.4 and will comply with them.

4.6 If we can no longer comply. If we decide we can no longer meet our obligations under this DPA or the Data Protection Laws, we will tell you promptly in writing. You may then, by notice, take reasonable and appropriate steps to stop and remedy unauthorized use (for example stop Support Sessions, have us delete Support Materials and confirm it in writing, or end this DPA and the affected Processing Activity).

4.7 Your right to check that we use Personal Data as this DPA requires: section 11.

5. Support Sessions

5.1 Only when you ask. A Support Session happens only when you arrange it and let us see or control your PC (EULA section 10), and ends when you sign it out or, at the latest, when its Support Token expires. Signing out does not cancel the token, which works until it expires (EULA 10.2); we reuse it only for the same case and only when you arrange it. [to be confirmed]

5.2 What we open and change. Only what the problem needs, and no Company File or part of the Software you ask us not to open. Our support account has Super User rights (EULA section 10.3): everything an Admin can do, plus restoring Backups (also in Read-Only Mode), issuing Backup restore codes, permanently deleting User Accounts, creating or changing roles, clearing the activity log and permanently deleting an archived Company File. We permanently delete User Accounts or an archived Company File, create or change roles, clear the activity log, delete other Customer Data or reset the Installation only at an Admin's written request (3.4). [to be confirmed] What a Support Session cannot do: Annex 2 A4.

5.3 No copies. In a Support Session we take no screenshots or recordings and export or copy no Customer Data unless you ask or agree for the case; any copy becomes Support Material (section 12).

5.4 What is recorded. The support sign-in and every change in a Support Session go into your activity log, marked "(vendor access)"; viewing, searching and most exports do not. If our support clears the log, the clear stays recorded. When one of your Admins next signs in, the Software shows when each Support Session started and how long it lasted; the License page lists them (Annex 2 A5). [not yet released]

5.5 Annex 2 describes the Software's safeguards for Support Sessions.

6. Confidentiality and our personnel

6.1 Only Company personnel who need access for the support or a Connected Service may process Personal Data, each bound by a written duty of confidentiality that survives their work for us and told about this DPA. At the date of this DPA, that is the Company's owner. [to be confirmed]

6.2 If a public authority or court requires us to disclose Personal Data, we will disclose only what is required and, unless the law forbids it, tell you first so you can object.

7. Security

7.1 We will keep technical and organizational measures appropriate to the risk, considering the nature, purpose and manner of the processing and the cost (Annex 2), and may change a measure if overall protection is not reduced.

7.2 You are responsible for the security of your PCs, network, Backups and users' passwords, and of any screen-sharing or remote-access tool you choose for a Support Session.

8. Subprocessors

8.1 Authorization. You authorize the Subprocessors in our Subprocessor List at https://livingroomlogistics.com, summarized in Annex 3.

8.2 Their terms. Before a Subprocessor processes Personal Data, we bind it in writing to at least the protection the Data Protection Laws require for its service, including section 4.3's restrictions as far as they apply, and remain responsible to you for its processing as for our own.

8.3 New Subprocessors. At least [30] days before a new Subprocessor starts to process Personal Data, we update the Subprocessor List and e-mail every Customer with an active License, at the address on its License Key (or its named contact if it signed this DPA); for an urgent replacement (for example for security), as soon as we can. [to be confirmed]

8.4 Objection. You may object in writing during the notice period on reasonable data protection grounds; we will discuss it in good faith and may offer an alternative (such as a screen-sharing tool you choose). If unresolved 30 days after you raise it, you may stop the affected Processing Activity (decline Support Sessions or file transfers through that Subprocessor, or turn off the Connected Service) and, if you cannot reasonably use the Software without it, end your License by notice, with a refund of the unused part of any prepaid period as EULA section 16.5 describes. [to be confirmed]

9. Helping with requests and assessments

9.1 Customer Data is in your hands: you can find, export and change it in your Installation to answer most requests from the people concerned.

9.2 Requests that reach us about Personal Data we process for you, we pass to you without undue delay (within [5] business days) and do not answer, except to say we passed them on, unless you instruct us or the law requires. [to be confirmed]

9.3 Our help. As reasonably needed, given what we process and know: we tell you which Support Materials we hold about the person, delete or return them on your instruction, and give you what you reasonably need for a data protection assessment or consultation with an authority (this DPA, its Annexes, our Security Overview); free where the effort is proportionate, substantial extra work at a reasonable fee agreed in advance. [to be confirmed]

10. Personal Data Breaches

10.1 Notice. We will notify you of a Personal Data Breach without undue delay after we become aware of it, and within 48 hours at the latest; for a Connected Service handling Marketplace Data, within 24 hours. [to be confirmed] The notice goes by e-mail to the address on your License Key or, if you signed this DPA, your named contact.

10.2 Content, as far as known: what happened and when; the kinds of Personal Data and approximate number of people and records; likely consequences; our measures taken or proposed; a contact. The rest follows in stages without further undue delay.

10.3 Our steps. We will take reasonable steps to contain, investigate and limit the breach and cooperate with you. You, as controller, decide whether to notify authorities and the people concerned; we will not notify them about your data without your agreement unless the law requires.

10.4 Support Token key. We will also tell you without undue delay if the key that signs Support Tokens is or may have been compromised, and what to do (for example install an Update that replaces it).

10.5 A notice under this section is not an admission of fault or liability.

11. Information and audits

11.1 Information. Once in any 12 months, and after a Personal Data Breach or at an authority's request, we will on written request answer a reasonable written questionnaire on the Processing Activities and our measures and give you the documents showing how we meet this DPA (this DPA, its Annexes, our Security Overview, any independent assessment; at the date of this DPA we hold none and no security certification).

11.2 Audits of our premises or systems take place only where the Data Protection Laws give you that right or an authority requires it, and 11.1 does not reasonably answer your question: only of the Processing Activities, at most once in any 12 months (unless an authority requires more or after a Personal Data Breach), on at least [30] days' written notice, in business hours without disrupting our work, by you or an independent auditor bound by confidentiality who is not our competitor, at your cost; you share the results with us and keep them confidential. [to be confirmed]

11.3 Independent assessor. Instead, where the Data Protection Laws allow, we may have a qualified independent assessor assess our measures for the Processing Activities against an accepted standard and give you its report.

12. Deletion and return

12.1 Support Materials are deleted within 30 days after the support case ends, unless you ask us to keep them longer or the law requires; we then keep them only for that purpose, protected under this DPA. A case ends when we tell you it is closed, or 30 days after the last message about it from either of us. Before deletion you may ask for files you sent back. [not yet available]

12.2 Support Sessions leave nothing with us (5.3).

12.3 Our backups. Copies of Support Materials in backups of our mailbox or PCs are deleted in their normal cycle, within [90] days, and not used meanwhile. [to be confirmed]

12.4 Connected Services. The updated Annexes will state how long each keeps data (2.3).

12.5 Confirmation. On request, we confirm in writing that Support Materials are deleted.

13. Transfers outside the United States

13.1 Where we process. We are based in the United States and sell only to businesses located in the United States. Our Subprocessors may process Personal Data outside the United States, in the countries the Subprocessor List names.

13.2 No EU or UK terms. We do not offer the Software outside the United States at this time, so this DPA has no EU, UK or Swiss transfer terms.

14. Liability

Each party's liability arising out of or related to this DPA is subject to the EULA's limitations and exclusions of liability (section 15) and counts toward the same limits. That does not limit liability to the people concerned under the Data Protection Laws, or liability the law does not allow to be limited. [to be confirmed]

15. Order of precedence, term and changes

15.1 Precedence. For processing Personal Data on your behalf, this DPA wins over the Beta and AI Terms, the EULA, the Terms of Service and our policies; a written agreement signed by you and us comes first.

15.2 Term. From your acceptance of the EULA (or the date of signature) for as long as we process Personal Data for you, including while we hold Support Materials, even after the EULA ends.

15.3 Changes. We may update this DPA (for example for a new law, a Connected Service or a new Subprocessor), publishing it on https://livingroomlogistics.com and e-mailing you at least [30] days before a change that materially affects you takes effect; a change the law requires takes effect when the law requires. We will not reduce the protection of Personal Data in a signed DPA without your written agreement. If a change reduces the protection of Personal Data, you may end your License before it takes effect, with a refund of the unused part of any prepaid period as EULA section 16.5 describes. [to be confirmed]

15.4 Governing law. The law that governs the EULA (EULA 19.1).

15.5 Signing. This DPA applies to every Customer as part of the EULA, without signature. For a signed copy, sign the signature block and send it to support@livingroomlogistics.com; we will countersign and return it. Signing does not change the terms. [to be confirmed]

16. Contact

Point of the Mountain Software LLC. Personal Data Breaches and requests under section 9: support@livingroomlogistics.com; help with the Software: support@livingroomlogistics.com.

Signatures (only if the parties sign this DPA; section 15.5)

Annex 1 - Details of the processing

Part A - Support Sessions and files sent to support (in effect)

Part B - Connected Services (not in effect: switched off; replaced by a full description before any is switched on, section 2.3). As built, they would pass and keep what Subprocessor List section 4 describes. The AI Assistant's online add-on leaves out buyers' and customers' names and contact details and users' names and keys, but a vendor's name, or personal data typed into a question, can still be sent.

Annex 2 - Security measures

Only this Annex binds (details: Security Overview). Items marked [to be confirmed] are working practices the Company commits to; the rest are built in. Connected Services: the updated Annex 2 (2.3).

A. Support Sessions (with sections 5.1-5.4)

1. Access only through screen sharing or remote access the Customer arranges (the Software has none of its own); sign-in only on the PC that holds the data.
2. Support Tokens: signed with a key only the Company holds (the Software has only the checking key); made for the Installation's License Key and refused with another or none; valid 4 hours unless agreed longer with the Customer, never more than 7 days (5.1). The installed support account has no password; Customers never give us theirs.
3. Visible: "Super User" and "Vendor · expires" with the end time at the top of the screen; no extension past the token's expiry.
4. Limits: no password changes or resets, new users, password recovery keys or Recovery Codes, keys for outside access to Customer Data (Reporting API, web companion) or Plan changes in a Support Session; no acceptance of the EULA or the AI consent for the Customer [not yet released]. Section 5.2 lists what the support account can do.
5. Record: section 5.4; the audit trail marks entries "[vendor access]" and also records a clear of the activity log; the Customer's Admins see these entries. Each Support Session's start and end are recorded in the Installation (kept 3 years, at most the 500 newest, through a restore, a reset or a clear of the activity log): Customer Data on the Customer's PC, not kept by the Company; Admins see it as 5.4 says. [not yet released]
6. Our log of Support Tokens. We record each Support Token we issue: when, for how long, and the fingerprint of the Installation's License Key. [not yet available]
7. Working practice: sections 5.2 and 5.3; we sign out at the end. [to be confirmed]

B. Support files and other files

1. The support file is made by an Admin and never sent automatically; the Customer decides whether to send it. It holds the version, system information, record counts, settings (values only for a fixed list) and the end of the log. The Software first removes users' user names, names and e-mail addresses, company names, the Company Profile, vendors' names and contact details, and anything that looks like an e-mail address, phone number, network address, Windows user folder, password, key or token, but may miss details such as a customer's or buyer's name in a log line (finding F-DPA5).
2. Other files: only what the problem needs; for personal data we recommend a password-protected ZIP file, the password sent another way. [to be confirmed]
3. Where we keep them: our support mailbox at [E-MAIL PROVIDER], with multi-factor authentication [to be confirmed]; files are opened only on the Company's own PCs (full-disk encryption, automatic screen lock, current security updates, anti-malware) and copied to no other service [to be confirmed].
4. Deletion: section 12.

C. The Company's people, accounts and keys

1. Need-to-know access under a written duty of confidentiality (section 6). [to be confirmed]
2. Multi-factor authentication on the Company's e-mail, hosting, code-hosting and payment accounts. [to be confirmed]
3. A written security incident plan, reviewed yearly and after each incident. [to be confirmed]
4. The keys that sign License Keys and Support Tokens stay with the Company, never in the Software (the build refuses any file that looks like a secret).

D. On the Customer's PC (for information): see the Security Overview. The Software does not encrypt the copies of imported files it keeps, attachments, exported files or logs (EULA 8.5).

Annex 3 - Subprocessors

The Subprocessor List at https://livingroomlogistics.com is authoritative (section 8). At the date of this DPA:

Only once a Connected Service is switched on: Cloudflare, Inc. (its host) and the online add-on's AI provider [to be confirmed]. Not Subprocessors (no processing for the Customer): Paddle (an independent controller), providers handling only data we hold for ourselves (2.4 (a); such as Cloudflare and Resend for the License Server, its Trial registrations, renewal consent records and e-mails), and download sources and Third-Party Services the Customer uses directly (Subprocessor List sections 2 and 3).