Data Processing Addendum

1.Scope and roles

This Data Processing Addendum (“DPA”) is part of the Terms of Service between Opulentity LLC (“Opulentity”) and the customer that uses Pickbox (“Customer”). It applies whenever Opulentity processes Customer Personal Data to provide Pickbox. No signature is needed; it takes effect when Customer accepts the Terms.

“Customer Personal Data” means personal data in Customer’s content (drawings, project files, prompts, images, outputs, shared content and project memory) and personal data about Customer’s users that Opulentity processes on Customer’s behalf to provide Pickbox.

For Customer Personal Data, Customer is the controller (a “business” under the California Consumer Privacy Act, “CCPA”), and Opulentity is its processor and service provider. Opulentity’s own use of account, billing and website information to run its business is described in the Privacy Policy.

“Data Protection Laws” means the US federal and state privacy laws that apply to the processing, including the CCPA. If this DPA conflicts with the Terms, this DPA controls for the processing of Customer Personal Data.

2.Details of the processing

Item	Details
Subject matter	Providing Pickbox to Customer under the Terms.
Duration	The term of Customer’s subscription, and afterwards until the data is deleted as set out below.
Nature	Collecting, storing, transmitting (including to AI model providers), retrieving, using and deleting data.
Purpose	To provide, secure and support Pickbox and, where Customer has turned on content sharing, to diagnose problems and improve Pickbox as described in the Privacy Policy.
Personal data	Users’ names, email addresses and roles; workstation enrollment records; and any personal data that appears in Customer’s content, such as names and contact details in title blocks, notes, prompts or project files.
Data subjects	Customer’s users, and people whose details appear in Customer’s content, such as clients, property owners and project contacts.
Sensitive data	Pickbox is not designed for sensitive personal data. Customer should not include it in its content unless it is needed for the work.

3.Processing instructions

Opulentity processes Customer Personal Data only on Customer’s documented instructions. Those instructions are the Terms, this DPA, the settings Customer chooses in Pickbox (such as content sharing and the retention period) and any other written instructions both parties agree.

Turning on content sharing is an instruction to process the shared content to support Customer, diagnose problems and improve Pickbox, as described in the Privacy Policy.

Opulentity may process Customer Personal Data otherwise only where the law requires it. In that case, it will tell Customer first unless the law prohibits that. Opulentity will tell Customer if it believes an instruction breaks Data Protection Laws.

Customer is responsible for the lawfulness of its instructions, and for having the notices, consents and rights needed to provide Customer Personal Data to Pickbox, including having it sent to AI model providers.

4.Service provider commitments

As a service provider under the CCPA, Opulentity will not:

sell or share Customer Personal Data, as those terms are defined in the CCPA;
retain, use or disclose Customer Personal Data for any purpose other than the business purposes set out in the Terms and this DPA, or as the CCPA otherwise permits;
retain, use or disclose Customer Personal Data outside its direct business relationship with Customer; or
combine Customer Personal Data with personal data it receives from or on behalf of others, except as the CCPA permits.

Opulentity will comply with the CCPA’s obligations for service providers and give Customer Personal Data the level of privacy protection the CCPA requires. It will tell Customer if it can no longer meet those obligations. Customer may then take reasonable and appropriate steps to stop and remedy any unauthorized use. Opulentity certifies that it understands and will comply with these restrictions.

5.Confidentiality of personnel

Opulentity limits access to Customer Personal Data to the personnel and contractors who need it to provide, secure and support Pickbox, and makes sure they are bound by appropriate obligations of confidentiality.

6.Security measures

Opulentity maintains appropriate technical and organizational measures to protect Customer Personal Data, including:

HTTPS on every connection;
row-level security on the database, with no direct access from browsers, and all access through Opulentity’s authenticated API;
device tokens stored only in hashed form, expiring after 90 days and revocable;
restricted and audited administrative access;
signed updates: RSA-signed update manifests and installers code-signed by Opulentity; and
encryption at rest, provided by its hosting providers.

Opulentity may update these measures, as long as the update does not reduce the overall protection of Customer Personal Data.

7.Subprocessors

Customer authorizes Opulentity to use the subprocessors listed on the Subprocessors page. Opulentity has a written agreement with each subprocessor that protects Customer Personal Data at least as well as this DPA requires for the services it provides, and remains responsible for its subprocessors’ performance of those obligations.

Opulentity will give at least 30 days’ notice before it adds or replaces a subprocessor, by updating the Subprocessors page and emailing Customer’s account contact.

Customer may object on reasonable data protection grounds by emailing wadehunter@opulentity.com within that notice period. The parties will discuss the objection in good faith. If they cannot resolve it, Customer may cancel the affected service before the change takes effect and receive a refund of any fees it prepaid for the period after cancellation.

8.Assistance with requests

If Opulentity receives a request from a person exercising privacy rights over Customer Personal Data, it will pass the request to Customer and will not respond to it, except to tell the person to contact Customer, unless the law requires otherwise.

Opulentity will give Customer reasonable help, through Pickbox’s features or otherwise, to respond to such requests, and with any risk assessments or regulator consultations that Data Protection Laws require of Customer, to the extent the information is available to Opulentity.

9.Security breaches

If Opulentity becomes aware of a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data, it will notify Customer without undue delay.

The notice will describe, as far as it is known, what happened, the kinds of data and people affected, the likely consequences and the steps taken or proposed to deal with it. Opulentity will add information as it learns more, and will take reasonable steps to contain the breach and reduce its effects. Notice of a breach is not an admission of fault.

10.Deletion or return at termination

When Customer’s subscription ends, Customer may ask Opulentity in writing to return a copy of its shared content, in a commonly used format, within 30 days. After that, or earlier on request, Opulentity will delete Customer Personal Data from its systems within 90 days. Copies in backups are deleted as the backups expire on their normal schedule.

Opulentity may keep data that the law requires it to keep, and billing and usage records it needs for billing, tax and legal purposes. It will continue to protect anything it keeps under this DPA.

Data stored on Customer’s own computers, such as conversation files, local project memory and drawing checkpoints, is under Customer’s control.

11.Audits

On Customer’s written request, no more than once a year unless there has been a breach or a regulator requires it, Opulentity will provide the information reasonably needed to show that it complies with this DPA, such as answers to a reasonable security questionnaire and descriptions of its security measures. Information provided is Opulentity’s confidential information. Any on-site audit requires a separate written agreement, at Customer’s expense.

12.Processing in the United States

Opulentity and its subprocessors process Customer Personal Data in the United States. Customer is responsible for making sure that it may lawfully transfer data to the United States.

This DPA is written for US privacy laws. If Customer needs terms for laws outside the United States, such as Standard Contractual Clauses, it can contact us. Such terms apply only if both parties sign them.

13.Liability and term

Opulentity’s liability under this DPA is subject to the limitation of liability in the Terms. This DPA lasts as long as Opulentity processes Customer Personal Data.