Data Processing Addendum

HazNode Software Limited (New Zealand) · HazNode Software USA LLC (United States)

Updated July 2026

1. Scope and Roles of the Parties

This Data Processing Addendum ("DPA") forms part of, and is incorporated by reference into, the HazNode Terms of Service (the "Agreement"). It applies where HazNode processes Personal Data on behalf of the Subscriber in the course of providing the Service. Capitalised terms not defined in this DPA have the meaning given in the Agreement.

The HazNode entity that is party to this DPA is the entity named in the applicable Order Form — HazNode Software Limited ("HazNode NZ") or HazNode Software USA LLC ("HazNode US") — determined in accordance with Section 1 of the Agreement. References to "HazNode" in this DPA mean that entity.

For the purposes of this DPA and applicable Data Protection Law:

• the Subscriber is the Controller (or, under the CCPA, the "Business") in respect of Subscriber Personal Data;
• HazNode is the Processor (or, under the CCPA, the "Service Provider") acting on the Subscriber's documented instructions;
• HazNode is an independent Controller in respect of Account Data and Analytics Data, as described in clause 3.6.

Where the Subscriber is itself acting as a processor on behalf of a third party — for example, an occupational hygiene consultancy processing data on behalf of a client organisation — HazNode acts as a sub-processor, and the Subscriber warrants that it has the authority to appoint HazNode on the terms of this DPA.

2. Definitions

"Account Data" means Personal Data relating to the Subscriber's relationship with HazNode, including the names and contact details of account administrators, billing contacts, and support correspondents.

"CCPA" means the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020, and its implementing regulations.

"Data Protection Law" means all laws relating to the processing of Personal Data applicable to a party in the performance of the Agreement, including the New Zealand Privacy Act 2020 and the Health Information Privacy Code 2020, the GDPR and UK GDPR, the CCPA and other United States state privacy laws, and the Australian Privacy Act 1988.

"Data Subject", "Controller", "Processor", "Personal Data", "Personal Data Breach", and "processing" have the meanings given in the GDPR, and equivalent terms under other applicable Data Protection Law are read accordingly. "Personal Data" includes "personal information" as defined in the New Zealand Privacy Act 2020 and the CCPA.

"GDPR" means Regulation (EU) 2016/679. "UK GDPR" means the GDPR as incorporated into the law of the United Kingdom by the European Union (Withdrawal) Act 2018, read with the Data Protection Act 2018.

"SCCs" means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission in Implementing Decision (EU) 2021/914.

"Subscriber Personal Data" means Personal Data contained within Subscriber Data that HazNode processes on behalf of the Subscriber under the Agreement.

"Sub-processor" means any third party engaged by HazNode to process Subscriber Personal Data in connection with the Service.

"UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.

3. Processing of Subscriber Personal Data

3.1 Documented Instructions

HazNode will process Subscriber Personal Data only on the Subscriber's documented instructions, unless required to do otherwise by a law to which HazNode is subject. The Agreement, this DPA, the applicable Order Form, and the Subscriber's configuration and use of the Service through its ordinary features together constitute the Subscriber's complete documented instructions.

If HazNode is required by law to process Subscriber Personal Data other than on the Subscriber's instructions, HazNode will inform the Subscriber of that requirement before processing, unless the law prohibits such notice on important grounds of public interest.

3.2 Unlawful Instructions

HazNode will inform the Subscriber promptly if, in its opinion, an instruction infringes applicable Data Protection Law. HazNode may suspend performance of an instruction it reasonably believes to be unlawful until the instruction is confirmed, amended, or withdrawn, and is not in breach of the Agreement for doing so.

3.3 Details of Processing

The subject matter, duration, nature and purpose of the processing, the types of Personal Data, and the categories of Data Subjects are set out in Annex A.

3.4 No Sale or Sharing of Personal Data

HazNode does not sell or share Subscriber Personal Data, does not retain, use, or disclose it for any purpose other than performing the Service, and does not combine it with Personal Data received from other sources except as permitted by applicable Data Protection Law. HazNode does not use Subscriber Personal Data to train generalised machine learning or artificial intelligence models made available to other customers.

3.5 Third-Party Data Retrieval

Where a User initiates retrieval of information from a third-party source through the Service — including PIN-based retrieval from the New Zealand Hazardous Substances register via Elementor by HazNode — that retrieval is performed on the Subscriber's instruction. The Subscriber is responsible for holding the appropriate authority to access the information retrieved, as set out in clause 4(f) of the Agreement.

3.6 Data Processed as Controller

HazNode acts as an independent Controller, and not as Processor, in respect of Account Data and Analytics Data. HazNode processes Account Data to administer the subscription, invoice the Subscriber, provide support, and send service communications. Analytics Data is aggregated or de-identified so that it does not identify and cannot reasonably be used to identify any individual, and is used to monitor, secure, and improve the Service. HazNode will not re-identify Analytics Data. This processing is described in the HazNode Privacy Policy.

4. Subscriber Obligations as Controller

The Subscriber warrants and undertakes that:

• it has a valid lawful basis for collecting and processing Subscriber Personal Data, and for its disclosure to HazNode and the Sub-processors listed in Annex A;
• it has provided all privacy notices and obtained all consents or authorisations required by applicable Data Protection Law, including from workers whose exposure or health data is entered into the Service;
• its instructions to HazNode comply with applicable Data Protection Law, and it will not instruct HazNode to process Personal Data unlawfully;
• it will not enter Personal Data into free-text fields, file names, uploaded attachments, or other unstructured areas of the Service beyond what is necessary for the purpose;
• it is solely responsible for the accuracy, quality, and legality of Subscriber Personal Data and the means by which it acquired that data;
• it will maintain the security of its account, assign unique credentials to each User, and promptly deactivate Users who no longer require access.

5. Occupational Hygiene and Health Data

HazNode applies the technical and organisational measures described in Annex B to all Subscriber Personal Data, including occupational hygiene and health records. HazNode does not apply a lower standard of protection to any category of Subscriber Data.

Where the Subscriber can achieve its purpose using pseudonymised or Similar Exposure Group (SEG) level data rather than named individual records, HazNode recommends that approach. The Service supports SEG-level analysis, and statistical outputs generated through the Service's Bayesian analysis tools do not require worker names to be meaningful.

Nothing in this DPA obliges HazNode to assess whether a Subscriber holds a valid condition for processing special category data, and HazNode gives no advice on that question. Where the Subscriber requires a jurisdiction-specific arrangement for health data — for example a HIPAA Business Associate Agreement where the Subscriber is a covered entity or business associate — the Subscriber must raise this with HazNode before entering such data into the Service. HazNode does not currently offer a HIPAA Business Associate Agreement, and the Service must not be used for data subject to HIPAA unless HazNode has agreed otherwise in writing.

6. Confidentiality and Personnel

HazNode will ensure that any person authorised to process Subscriber Personal Data is bound by an appropriate obligation of confidentiality, whether contractual or statutory, that survives the end of their engagement.

HazNode limits access to Subscriber Personal Data to those personnel who require access to perform the Agreement, applies role-based access controls, and reviews access rights periodically and on any change of role.

7. Security Measures

HazNode will implement and maintain appropriate technical and organisational measures to protect Subscriber Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as well as the risk to Data Subjects. Those measures are described in Annex B.

HazNode may update the measures in Annex B from time to time provided that the updated measures do not materially reduce the overall level of protection.

The Subscriber is responsible for its own use of the Service, including configuring access controls, managing User permissions, and determining whether the Service's security measures meet the Subscriber's own regulatory requirements.

8. Sub-processors

The Subscriber grants HazNode general authorisation to engage Sub-processors to process Subscriber Personal Data. The Sub-processors engaged as at the date of this DPA are listed in Annex A.

HazNode will impose on each Sub-processor data protection obligations that are substantially the same as those in this DPA, and remains fully liable to the Subscriber for the performance of each Sub-processor's obligations.

HazNode will give the Subscriber at least 30 days' notice before adding or replacing a Sub-processor, by email to the account's nominated contact. The Subscriber may object on reasonable data protection grounds within that period by writing to support@haznode.com. The parties will work in good faith to resolve the objection. If it cannot be resolved, the Subscriber may terminate the affected subscription on written notice, and HazNode will refund any Fees prepaid for the period after the termination date.

Where a Subscriber connects a third-party application to the Service using its own credentials — including the Xero integration — that third party is not a HazNode Sub-processor. The connection is made on the Subscriber's instruction, the third party acts as an independent controller in respect of data it receives, and HazNode is not responsible for that third party's processing.

9. Data Subject Requests

The Service provides the Subscriber with functionality to access, correct, export, and delete Subscriber Personal Data. The Subscriber is expected to use that functionality to respond to Data Subject requests in the first instance.

Where a Data Subject request cannot be fulfilled through the Service, HazNode will provide reasonable assistance to enable the Subscriber to respond within the timeframes required by applicable Data Protection Law. HazNode may charge a reasonable fee for assistance that is substantially in excess of ordinary support.

If HazNode receives a request directly from a Data Subject relating to Subscriber Personal Data, HazNode will not respond to the substance of the request other than to acknowledge it and direct the Data Subject to the Subscriber, and will notify the Subscriber promptly unless prohibited by law.

10. Personal Data Breach Notification

HazNode will notify the Subscriber without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Subscriber Personal Data.

The notification will, to the extent known, describe:

• the nature of the breach, including the categories and approximate number of Data Subjects and records affected;
• the likely consequences of the breach;
• the measures taken or proposed to address it and mitigate its effects; and
• a contact point for further information.

Where HazNode cannot provide all of that information at once, it will provide what it has and supply the remainder in phases as it becomes available. HazNode will cooperate with the Subscriber and take reasonable steps to assist in the Subscriber's investigation, mitigation, and any notification the Subscriber is required to make to a regulator or Data Subject — including under Part 6 of the New Zealand Privacy Act 2020, which requires notification of privacy breaches likely to cause serious harm.

HazNode's notification of a breach is not an acknowledgement of fault or liability.

11. Impact Assessments and Prior Consultation

Taking into account the nature of the processing and the information available to it, HazNode will provide reasonable assistance to the Subscriber with data protection impact assessments and prior consultation with supervisory authorities, where the Subscriber is required to carry these out under applicable Data Protection Law and cannot reasonably obtain the necessary information from the documentation HazNode makes available.

12. International Transfers

HazNode processes Subscriber Personal Data on infrastructure that may be located in Australia, Singapore, the United States, the United Kingdom, Germany, the Netherlands, or Canada. HazNode does not currently offer single-region data residency as a default; Subscribers with specific residency requirements should contact HazNode to discuss available options.

Where a transfer of Subscriber Personal Data is subject to the GDPR and is made to a country not covered by an adequacy decision, the SCCs are incorporated into this DPA and apply, with Module Two (controller to processor) applying where the Subscriber is a controller, and Module Three (processor to processor) applying where the Subscriber is itself a processor. For the purposes of the SCCs:

• the Subscriber is the data exporter and HazNode is the data importer;
• the optional docking clause in Clause 7 applies, and in Clause 9 Option 2 (general written authorisation) applies with the notice period set out in Section 8 of this DPA;
• the optional redress clause in Clause 11(a) does not apply; the governing law in Clause 17 is the law of Ireland; and the forum in Clause 18(b) is the courts of Ireland;
• Annex I, II, and III of the SCCs are populated by Annex A and Annex B of this DPA.

Where a transfer is subject to the UK GDPR, the UK Addendum applies to the SCCs, with the Subscriber as exporter and HazNode as importer, and neither party may end the UK Addendum under its Section 19. Where a transfer is subject to Swiss law, references in the SCCs to the GDPR are read as references to the Swiss Federal Act on Data Protection and the competent authority is the Swiss Federal Data Protection and Information Commissioner.

Where a transfer is subject to the New Zealand Privacy Act 2020, HazNode complies with Information Privacy Principle 12 by relying on transfers to prescribed countries, binding contractual safeguards requiring comparable protection, or another lawful mechanism.

13. Return and Deletion of Data

The Subscriber may export Subscriber Data at any time during the Subscription Term using the Service's export functionality. The Subscriber is responsible for exporting its data before the end of the Subscription Term.

Following termination or expiry, HazNode will retain Subscriber Data for 60 days as set out in clause 7(d) of the Agreement, after which it will be deleted. On written request within that 60-day period, HazNode will delete Subscriber Personal Data earlier, or provide a copy in a structured, commonly used, machine-readable format.

Where the Agreement is terminated for non-payment, clause 6 of the Agreement applies and HazNode has no obligation to retain Subscriber Data.

HazNode may retain Subscriber Personal Data to the extent required by applicable law, and may retain data held in routine backups until those backups expire in the ordinary course. Data retained in backups remains subject to this DPA and to the security measures in Annex B, and is not actively processed.

14. Audit and Compliance

HazNode will make available to the Subscriber the information reasonably necessary to demonstrate compliance with this DPA, including its then-current security documentation and any third-party assessments or certifications it holds.

Where that information is not sufficient to satisfy the Subscriber's audit obligations under applicable Data Protection Law, the Subscriber may request an audit no more than once in any 12-month period, on at least 30 days' written notice. An audit must be conducted during business hours, must not unreasonably interfere with HazNode's operations, must be limited to systems and records relevant to Subscriber Personal Data, and is subject to the confidentiality obligations in clause 3.9 of the Agreement. The Subscriber bears its own costs and HazNode's reasonable costs of supporting the audit.

An audit may be conducted by the Subscriber or by an independent auditor appointed by it, provided the auditor is not a competitor of HazNode and is approved by HazNode in writing, such approval not to be unreasonably withheld. The auditor must enter into confidentiality obligations no less protective than those in the Agreement before the audit begins, and the findings of an audit are the Confidential Information of both parties.

A supervisory authority may conduct an audit where required by applicable Data Protection Law, and the frequency limit above does not apply to it.

15. Region-Specific Terms

15.1 New Zealand

HazNode complies with the Information Privacy Principles in the Privacy Act 2020 and, where health information is processed, with the Health Information Privacy Code 2020. HazNode will assist the Subscriber in meeting its notifiable privacy breach obligations under Part 6 of the Privacy Act 2020.

15.2 European Economic Area and United Kingdom

This DPA satisfies the requirements of Article 28(3) of the GDPR and UK GDPR. Where the Subscriber is established outside the EEA or UK but its processing is subject to the GDPR or UK GDPR, the Subscriber is responsible for appointing a representative under Article 27 where required.

15.3 United States

In respect of Personal Data subject to the CCPA, HazNode acts as a Service Provider. HazNode is prohibited from, and will not: sell or share such Personal Data; retain, use, or disclose it for any purpose other than performing the services specified in the Agreement, including for a commercial purpose other than those services; or retain, use, or disclose it outside the direct business relationship between HazNode and the Subscriber. HazNode certifies that it understands and will comply with these restrictions. HazNode will notify the Subscriber if it determines it can no longer meet its obligations under the CCPA. Equivalent terms apply in respect of comparable state privacy laws, including those of Virginia, Colorado, Connecticut, Utah, and Texas.

15.4 Australia

Where the Australian Privacy Act 1988 applies, HazNode will handle Personal Data in accordance with the Australian Privacy Principles to the extent applicable to its role as Processor, and will assist the Subscriber with its obligations under the Notifiable Data Breaches scheme.

16. Liability and Relationship to the Agreement

Each party's liability under or in connection with this DPA is subject to the exclusions and limitations of liability in Section 13 of the Agreement. Liability under this DPA and under the Agreement is aggregated and does not create separate or cumulative caps.

Nothing in this clause limits either party's liability to a Data Subject under the third-party beneficiary rights in the SCCs, or any liability that cannot be limited under applicable Data Protection Law.

This DPA forms part of the Agreement. In the event of any inconsistency, the order of precedence in clause 15(b) of the Agreement applies, save that in respect of data protection obligations specifically, this DPA prevails over the balance of the Terms of Service, and the SCCs prevail over this DPA.

17. Term, Changes, and Contact

This DPA takes effect on the Effective Date recorded in the Order Form and continues for as long as HazNode processes Subscriber Personal Data. Clauses that by their nature should survive termination do so, including clauses 6, 13, 14, and 16.

HazNode may update this DPA where required to reflect a change in applicable Data Protection Law, a change in Sub-processors, or a change to the Service, on the notice required by clause 15(c) of the Agreement. HazNode will not make a change that materially reduces the protections in this DPA without the Subscriber's agreement.

This DPA is governed by the same law, and subject to the same jurisdiction, as the Agreement under Section 14 of the Agreement — determined by which HazNode entity is named in the Order Form. This does not affect the governing law of the SCCs, which is set out in clause 12 of this DPA.

Data protection queries, sub-processor objections, and Data Subject request escalations should be directed to support@haznode.com, or by post to the contracting entity named in the Order Form at the address in clause 15(m) of the Agreement.

Annex A — Details of Processing

A.1 Subject Matter and Duration

The subject matter is HazNode's provision of the Service to the Subscriber. Processing continues for the Subscription Term plus the 60-day post-termination retention period described in clause 13 of this DPA.

A.2 Nature and Purpose

Hosting, storage, transmission, organisation, retrieval, structuring, statistical analysis, report generation, and deletion of Subscriber Data, for the purpose of enabling the Subscriber to manage occupational hygiene consultancy operations — including client and contact management, quoting, project and fieldwork management, exposure monitoring and risk assessment, statistical analysis, laboratory workflow, equipment management, and invoicing.

A.3 Categories of Data Subjects

• the Subscriber's Users, employees, and contractors;
• the Subscriber's clients and their personnel and contacts;
• workers at sites assessed by the Subscriber, including those who are the subject of personal exposure monitoring or health surveillance;
• laboratory, supplier, and other third-party contacts recorded by the Subscriber.

A.4 Types of Personal Data

• identity and contact data — names, job titles, employers, email addresses, telephone numbers, business addresses;
• account and authentication data — usernames, hashed credentials, access logs, IP addresses, session metadata;
• occupational data — role, work area, shift pattern, task descriptions, Similar Exposure Group assignment;
• exposure and monitoring data — personal sampling results, sample identifiers, analytical results, exposure calculations, and risk ratings, which may be linked to an identifiable worker;
• health-related data where entered by the Subscriber — biological monitoring results, health surveillance outcomes, respirator fit-test records;
• commercial and billing data — quotes, projects, invoices, and related correspondence;
• any other Personal Data the Subscriber chooses to enter into free-text fields, uploaded documents, or attachments.

A.5 Special Category Data

Where exposure, biological monitoring, or health surveillance data is linked to an identifiable individual, it constitutes data concerning health under Article 9 of the GDPR and health information under the New Zealand Health Information Privacy Code 2020. Clause 5 of this DPA applies.

A.6 Frequency of Processing

Continuous, for the duration of the Subscription Term.

A.7 Sub-processors

Processing locations reflect the regions in which each Sub-processor may operate. HazNode will notify Subscribers of changes to this list in accordance with Section 8.

Annex B — Technical and Organisational Measures

B.1 Encryption

• TLS encryption for all data in transit between Users and the Service;
• encryption at rest for stored Subscriber Data;
• credentials stored using one-way hashing, never in plain text.

B.2 Access Control

• authentication managed through Clerk, with support for multi-factor authentication;
• unique credentials required for each User; credential sharing is prohibited;
• role-based access controls within the Application;
• HazNode personnel access to production data limited to those requiring it, on a least-privilege basis, and reviewed periodically;
• logical separation of each Subscriber's data.

B.3 Resilience and Availability

• hosting on DigitalOcean infrastructure with provider-level physical security;
• routine automated backups of Subscriber Data;
• ability to restore availability and access to data following an incident.

B.4 Monitoring and Testing

• application and infrastructure logging, including authentication events;
• regular infrastructure and application security reviews;
• dependency and vulnerability monitoring, with patching on a risk-assessed basis.

B.5 Organisational Measures

• confidentiality obligations binding all personnel with access to Subscriber Data;
• documented incident response and breach notification process;
• data protection obligations imposed contractually on all Sub-processors;
• secure deletion of data at the end of the retention period.

These measures are reviewed periodically and may be updated in accordance with Section 7.