Patrol Forge Data Processing Addendum

Patrol Forge Data Processing Addendum Version: 2026-08-16 Last Updated: August 16, 2026 This Data Processing Addendum ("DPA") forms part of the agreement between Patrol Forge LLC ("Patrol Forge") and the customer, company, agency, association, organization, or other entity using Patrol Forge ("Customer") when Patrol Forge processes personal information, personal data, or similar regulated information on behalf of Customer through the Patrol Forge platform. 1. Purpose This DPA describes how Patrol Forge processes Customer Data when providing the Patrol Forge website, web application, mobile applications, Windows desktop app, dashboards, client portals, CAD, GPS, parking enforcement, reporting, scheduling, vehicle, equipment, training, certification, support, billing, legal acceptance, and related services. 2. Roles of the Parties Customer determines what information is entered into Patrol Forge, which users may access it, how the platform is used, what business records are created, and how long company-controlled records should be retained, subject to the service agreement and applicable law. For Customer Data, Customer generally acts as the controller, business, or equivalent responsible party. Patrol Forge processes Customer Data to provide the service, maintain security, troubleshoot issues, support users, process payments, host data, manage backups, comply with law, and perform obligations described in the applicable agreement. For Customer Data, Patrol Forge generally acts as a processor, service provider, contractor, vendor, or equivalent service-side party. 3. Customer Instructions Patrol Forge will process Customer Data only for the following purposes: providing and operating the service, configuring accounts and permissions, hosting and storing data, authenticating users, processing support requests, maintaining security, generating audit logs, processing payments and subscriptions, performing customer-requested actions, complying with lawful obligations, enforcing agreements, preventing fraud or misuse, and other documented instructions from Customer. Customer instructs Patrol Forge to process Customer Data as necessary to provide the Patrol Forge platform and related services. Customer is responsible for ensuring that its instructions comply with applicable law. 4. Categories of Data Customer Data may include account data, company data, user data, employee and contractor data, client data, property data, GPS and location records, patrol records, CAD and dispatch records, incident reports, daily activity reports, post orders, parking enforcement records, parking permits, registered vehicle information, violation notices, payments, disputes, photos, files, signatures, vehicle checkout records, equipment records, training and certification records, license uploads, support tickets, audit logs, legal acceptance records, cookie records, analytics identifiers, billing records, and related metadata. 5. Data Subjects Data subjects may include company owners, administrators, supervisors, officers, employees, contractors, client portal users, residents, guests, property contacts, registered vehicle owners, parking permit holders, cited parties, witnesses, reporting persons, support contacts, billing contacts, and other persons whose information is entered into or generated by Patrol Forge. 6. Customer Responsibilities Customer is responsible for providing required notices, obtaining required consents, establishing a lawful basis for processing, configuring permissions, training users, limiting unnecessary sensitive information, ensuring records entered into Patrol Forge are true and accurate, responding to employment-related and company-controlled privacy requests, and determining whether Customer Data must be retained, deleted, restricted, exported, or corrected. Customer agrees that it will not use Patrol Forge to collect or submit information unless Customer is authorized to do so and has a lawful operational, contractual, employment, safety, security, property management, parking enforcement, legal, or business reason. 7. Patrol Forge Responsibilities Patrol Forge will implement reasonable administrative, technical, and physical safeguards designed to protect Customer Data against unauthorized access, disclosure, alteration, or destruction. Safeguards may include HTTPS/TLS communications, password hashing, multi-factor authentication support, role-based access controls, session controls, rate limiting, CSRF protection, signed private file access, upload validation, audit logging, least-privilege access, backups, security monitoring, software updates, and server hardening. Patrol Forge personnel and support users are required to access Customer Data only when necessary for support, security, troubleshooting, maintenance, legal compliance, or authorized operational purposes. 8. Confidentiality Patrol Forge will treat Customer Data as confidential and will require personnel with access to Customer Data to be subject to confidentiality obligations or professional duties of confidentiality. 9. Subprocessors and Service Providers Patrol Forge may use subprocessors and service providers for hosting, storage, email delivery, payment processing, mapping, analytics, backups, security, support, software delivery, and other platform operations. Patrol Forge will use reasonable diligence when selecting service providers and will require them to protect Customer Data in a manner consistent with the services they provide. 10. Security Incidents If Patrol Forge becomes aware of a confirmed security incident involving Customer Data that requires notification under applicable law or the agreement, Patrol Forge will notify affected Customer contacts without unreasonable delay and will provide information reasonably available to Patrol Forge, subject to law enforcement needs, security restrictions, and ongoing investigation. 11. Data Subject Requests If Patrol Forge receives a request from an individual to access, correct, delete, restrict, export, or otherwise exercise rights regarding Customer-controlled data, Patrol Forge may direct the individual to Customer, coordinate with Customer, or process the request according to Customer's documented instructions. Customer is responsible for responding to requests where Customer is the controller, business, employer, or responsible party. 12. Deletion and Return Upon termination of service or upon Customer's written instruction, Patrol Forge will delete, return, anonymize, or restrict Customer Data in accordance with the agreement, this DPA, technical feasibility, and applicable law. Patrol Forge may retain limited data where required or permitted for legal compliance, billing, tax, accounting, audit logs, security, fraud prevention, disputes, enforcement of agreements, backups, business continuity, or records controlled by Customer. 13. Audits and Information Requests Upon reasonable written request, Patrol Forge will provide information reasonably necessary to help Customer evaluate Patrol Forge's compliance with this DPA. Any audit or information request must be reasonable in scope, protect Patrol Forge confidential information and other customers' data, avoid disruption to the service, and comply with security requirements. 14. International Transfers Patrol Forge primarily operates in the United States. If Patrol Forge transfers Customer Data internationally, Patrol Forge will use reasonable safeguards required by applicable law. If standard contractual clauses or other transfer terms are required, the parties will work in good faith to put appropriate terms in place. 15. U.S. State Privacy Laws To the extent applicable, Patrol Forge will process Customer Data as a service provider, processor, contractor, or equivalent role under U.S. state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act, the Colorado Privacy Act, and similar state privacy laws. Patrol Forge will not sell Customer Data or share Customer Data for cross-context behavioral advertising. Patrol Forge will not retain, use, or disclose Customer Data outside the permitted business purposes described in the agreement, this DPA, Customer instructions, or applicable law. 16. Sensitive Data Customer is responsible for limiting sensitive information entered into Patrol Forge to what is reasonably necessary for legitimate operations. Patrol Forge is not designed to be a medical records system, consumer reporting agency system, or system for unnecessary sensitive personal information. Customer should not enter protected health information, financial account credentials, social security numbers, or similarly sensitive information unless expressly authorized, legally permitted, and operationally necessary. 17. Order of Precedence If this DPA conflicts with the agreement between Patrol Forge and Customer, this DPA controls only with respect to data processing obligations. The agreement controls all other matters, including payment, subscriptions, service levels, support, warranties, limitations of liability, and termination unless expressly stated otherwise. 18. Contact Questions about this DPA may be sent to privacy@patrolforge.com. Patrol Forge may also be reached by phone at 505-219-1987. Mailing address: Patrol Forge LLC P.O. Box 20431 Albuquerque, NM 87154