Data Processing Agreement

Last updated 11 October 2026

This Data Processing Agreement ("DPA") is between PHENEX TECHNOLOGIES INC., a British Columbia corporation based in Vancouver, British Columbia, Canada, operating WattOps ("we", "us"), and the organisation that uses WattOps for its team or fleet ("you"). It forms part of our Terms of Service and of any order form between us. It applies automatically when we process personal data on your behalf. If you want a countersigned copy, ask through the contact form.

1. What this covers

"Your personal data" means personal data that you or your users send to WattOps and that we process on your behalf. Examples are team members' email addresses, job and user names in Live heartbeats, and the labels of tracked runs. Annex I describes it in detail.

For your personal data, you are the controller and we are your processor. For the account data we collect for our own purposes, such as sign-in and billing, we are the controller. Our Privacy Policy covers that data.

2. Our commitments

We will:

• process your personal data only on your documented instructions. Those instructions are the Terms, any order form, and the way you configure and use the service. If an instruction would break data protection law, we will tell you;
• make sure everyone who can access your personal data is bound by confidentiality;
• protect it with the measures in Annex II;
• help you, as far as we reasonably can, to answer requests from people exercising their rights, and with data protection impact assessments and consultations with authorities;
• tell you without undue delay after we become aware of a personal data breach affecting your personal data, with the information you need to meet your own obligations;
• make available the information needed to show we comply with this DPA. We will also allow audits by you or an auditor you choose, at your cost, on 30 days' notice, no more than once a year unless an authority requires it or there has been a breach.

3. Sub-processors

You give us general authorisation to use the sub-processors listed in Annex III and in our Privacy Policy. We will update that list at least 14 days before a new sub-processor starts processing your personal data. You can object within that time on reasonable data protection grounds. If we cannot address the objection, you can end the affected service and receive a refund of any prepaid fees for it. We impose data protection terms on each sub-processor that are no less protective than this DPA, and we remain responsible for them.

4. International transfers

We are in Canada, and our sub-processors process data mainly in the United States (Annex III).

- Module Two applies where you are a controller, and Module Three where you are a processor. - Clause 7 (docking) does not apply. - In Clause 9, Option 2 applies, with the notice period in section 3. - The optional wording in Clause 11 does not apply. - Clauses 17 and 18 choose the law and the courts of Ireland. - Annexes I to III of this DPA complete the SCCs' annexes.

• From the European Economic Area. A transfer of your personal data to us is covered by the European Commission's adequacy decision for Canada wherever that decision applies. Where it does not apply, the standard contractual clauses in Commission Implementing Decision (EU) 2021/914 ("SCCs") are incorporated into this DPA:

• From the United Kingdom. The UK International Data Transfer Addendum to the SCCs applies.
• From Switzerland. The SCCs apply as adapted for Swiss law, with the Swiss Federal Data Protection and Information Commissioner as the competent authority.

Our transfers onward to sub-processors rely on their data processing agreements, which include the SCCs.

5. When the service ends

You can download your data at any time under Settings → Your data, and delete your account under Settings → Delete account. Deleting the account deletes your personal data from our database. Copies in our hosting provider's backups expire on its backup schedule. We may keep data only where the law requires it.

6. General

Each party's liability under this DPA is subject to the limits in the Terms. If this DPA and the Terms conflict, this DPA wins. If the SCCs conflict with anything else, the SCCs win. Apart from the SCCs, this DPA is governed by the law that governs the Terms.

Annex I: details of the processing

Annex II: security measures

• Encryption in transit (HTTPS/TLS) for every connection to the website, API and database. Data at rest is encrypted by our database provider.
• API keys are stored only as SHA-256 fingerprints. The full key is shown once and never kept.
• The database is reachable only through server-side functions, each of which checks a server secret and the caller's identity. The tables sit in a private schema that the public API roles cannot read, and row-level security is on for every table as a second lock.
• Access to production systems is limited to the people who run the service.
• Rate limits on the API and the contact form, and plan limits on stored data.
• Short retention where possible: Live heartbeats are deleted after 6 hours, and the contact form keeps only a hashed IP address.
• Automated tests of the API, sign-in and access rules run on every change before it is deployed.

Annex III: sub-processors