Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Frontier Pet Software Terms of Service (the "Agreement") between Frontier Pet Software LLC ("Frontier Pet," "Processor," "we," "us," or "our") and the salon, business, or other customer entity that accepts the Agreement ("Customer," "Controller," "you," or "your").

If you accept the Agreement on behalf of an entity, you represent that you have authority to bind that entity to this DPA. This DPA applies when Frontier Pet processes Customer Personal Data on your behalf in providing the Service.

Capitalized terms not defined here have the meaning in the Agreement. If there is a conflict between this DPA and the Agreement regarding the processing of Customer Personal Data, this DPA controls. The Privacy Policy describes Frontier Pet's practices generally; this DPA sets the contractual processor terms between Frontier Pet and Customer.

1. Definitions

"Applicable Data Protection Law" means privacy and data-protection laws that apply to the processing of Customer Personal Data under this DPA, including (as applicable) the California Consumer Privacy Act as amended by the CPRA ("CCPA") and similar US state privacy laws.

"Customer Personal Data" means personal information or personal data that Customer (or its Authorized Users) submits to the Service, or that Frontier Pet processes on Customer's behalf in providing the Service, relating to Customer's clients, prospective clients, employees/users, or other individuals — for example contact details, pet-owner records, appointment and communications data (including SMS, email, and voice/call recordings where enabled), and related operational records. It does not include Frontier Pet's own account, billing, security, and product-analytics data about Customer as Frontier Pet's customer, which Frontier Pet processes as an independent controller/business.

"Security Incident" means accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data transmitted, stored, or otherwise processed by Frontier Pet.

"Subprocessor" means a third party engaged by Frontier Pet to process Customer Personal Data on Frontier Pet's behalf in connection with the Service.

"Service" has the meaning in the Agreement (the Frontier Pet multi-tenant pet salon management platform and related tools).

2. Roles of the Parties

2.1 Customer is the controller (and, under the CCPA, the business) of Customer Personal Data. Customer determines the purposes and means of processing Customer Personal Data in connection with Customer's business.

2.2 Frontier Pet is the processor (and, under the CCPA, a service provider or contractor) of Customer Personal Data. Frontier Pet will process Customer Personal Data only on Customer's documented instructions and as needed to provide, secure, maintain, and improve the Service, comply with law, and as otherwise described in the Agreement and this DPA.

2.3 Customer is solely responsible for: (a) the accuracy and lawfulness of Customer Personal Data it provides; (b) providing any required notices to individuals; (c) obtaining and documenting consents where required (including for SMS, email, and call recording); and (d) ensuring its use of the Service complies with Applicable Data Protection Law.

3. Scope, Nature, and Purpose of Processing

3.1 Subject matter: Provision of the Service to Customer.

3.2 Duration: For the term of the Agreement and any post-termination retention/deletion period described in the Agreement, Privacy Policy, or this DPA.

3.3 Nature and purpose: Hosting, storage, transmission, display, retrieval, deletion, and related processing of Customer Personal Data to operate salon management features (including scheduling, client/pet records, booking/portal, messaging, voice/click-to-call and call recordings where enabled, payments integrations, timekeeping/payroll-related tools, support, security, and troubleshooting).

3.4 Types of personal data: As configured by Customer — typically identifiers and contact information; commercial and transaction information related to salon services; internet/technical data related to use of the Service; audio recordings of operational calls when recording is enabled; and inferences or notes Customer enters about clients/pets/services.

3.5 Categories of data subjects: Customer's clients and prospective clients; Customer's employees and Authorized Users; and other individuals whose information Customer chooses to submit to the Service.

4. Customer Instructions

4.1 Customer instructs Frontier Pet to process Customer Personal Data: (a) to provide and support the Service; (b) as documented in the Agreement, this DPA, the Privacy Policy, and Customer's use of Service settings/APIs; and (c) as otherwise reasonably necessary to comply with law or binding governmental requests (in which case Frontier Pet will, where lawful and practicable, notify Customer before responding).

4.2 Frontier Pet will promptly inform Customer if, in its reasonable opinion, an instruction infringes Applicable Data Protection Law (without obligation to provide legal advice).

4.3 Frontier Pet will not: (a) sell Customer Personal Data; (b) share Customer Personal Data for cross-context behavioral advertising; (c) retain, use, or disclose Customer Personal Data outside the business relationship or for any purpose other than the business purposes specified in the Agreement and this DPA, including for Frontier Pet's own commercial purposes, except as permitted by Applicable Data Protection Law for service providers/contractors; or (d) combine Customer Personal Data with personal information received from another source except as needed to provide the Service or as otherwise permitted for service providers under the CCPA.

4.4 Frontier Pet certifies that it understands the restrictions in this Section 4 and will comply with them.

5. Confidentiality and Personnel

Frontier Pet will ensure that persons authorized to process Customer Personal Data are bound by appropriate confidentiality obligations and receive security awareness appropriate to their role.

6. Security

6.1 Frontier Pet will implement and maintain reasonable administrative, technical, and organizational measures designed to protect Customer Personal Data against Security Incidents, taking into account the nature of the Service, the types of data, and available technology. Measures include tenant-scoped access controls, authentication, role-based permissions, encryption in transit where applicable, audit logging, and managed cloud infrastructure, as further described at a high level in the Privacy Policy.

6.2 Customer is responsible for securely managing its user accounts, credentials, endpoint devices, and the configuration of features it enables (including who may access call recordings and other sensitive records).

7. Subprocessors

7.1 Customer authorizes Frontier Pet to engage Subprocessors to process Customer Personal Data as needed to provide the Service. Current Subprocessor categories include: cloud hosting and storage; databases; voice and messaging (e.g. Twilio); payment processing (e.g. Square); email delivery; authentication; logging, monitoring, and error tracking; and customer support tooling.

7.2 Frontier Pet will impose data-protection obligations on Subprocessors that are materially no less protective of Customer Personal Data than those in this DPA, to the extent applicable to the subprocessed services.

7.3 Frontier Pet will remain responsible for Subprocessors' performance of their obligations with respect to Customer Personal Data, subject to the liability terms of the Agreement.

7.4 Frontier Pet may update its Subprocessors from time to time. Where Frontier Pet intends to add a Subprocessor that materially changes how Customer Personal Data is processed, Frontier Pet will provide notice (for example by updating a Subprocessors list on its website or notifying account administrators) and Customer may object on reasonable data-protection grounds within thirty (30) days. If the parties cannot resolve an objection, Customer may terminate the affected Service as its sole remedy for that objection.

8. Assistance with Individual Requests

Taking into account the nature of processing, Frontier Pet will provide reasonable assistance to Customer (via product features or support) to help Customer respond to requests from individuals to access, delete, correct, or exercise other rights available under Applicable Data Protection Law regarding Customer Personal Data. Customer is responsible for verifying and responding to such requests. Frontier Pet may redirect individuals who contact Frontier Pet about Salon-controlled data to Customer.

9. Security Incidents

9.1 Frontier Pet will notify Customer without undue delay after becoming aware of a Security Incident affecting Customer Personal Data. Where feasible, initial notice will include available details about the nature of the incident, categories of data involved, and measures taken or proposed.

9.2 Frontier Pet will reasonably cooperate with Customer's investigation and any legally required notifications, taking into account the nature of processing and information available to Frontier Pet. Notification under this Section is not an admission of fault or liability.

10. Return and Deletion

Upon termination of the Agreement or earlier written request, Frontier Pet will, within a reasonable period and subject to technical constraints and legal retention requirements, delete or return Customer Personal Data, except that Frontier Pet may retain copies as required by law, for dispute resolution, or in routine encrypted backups that are deleted on the backup lifecycle. Call recording audio may be subject to shorter platform retention as described in the Privacy Policy and product settings.

11. Audits and Information

Upon written request no more than once per twelve (12) months (unless required by a competent authority or following a Security Incident), Frontier Pet will provide written information reasonably necessary to demonstrate compliance with this DPA (for example security overview summaries). On-site audits are not required; if Applicable Data Protection Law mandates a further audit right, the parties will discuss in good faith a mutually acceptable scope, timing, confidentiality, and cost allocation.

12. International Processing

Frontier Pet may process Customer Personal Data in the United States and in other locations where Frontier Pet or its Subprocessors operate infrastructure. Customer instructs Frontier Pet to perform such processing as needed to provide the Service. If Customer later requires EU/UK transfer mechanisms, the parties may execute an additional transfer annex.

13. CCPA / State Privacy Law Specific Terms

To the extent the CCPA or similar US state privacy laws apply: Frontier Pet acts as a service provider/contractor; Customer discloses Customer Personal Data to Frontier Pet only for the limited business purposes of providing the Service; Frontier Pet will not retain, use, disclose, or otherwise process Customer Personal Data for any purpose other than those business purposes or as otherwise permitted for service providers/contractors; and Frontier Pet will comply with applicable obligations under those laws and provide the same level of privacy protection as required of Customer by those laws with respect to the Customer Personal Data it processes. Customer may take reasonable and appropriate steps to ensure Frontier Pet uses Customer Personal Data consistently with Customer's obligations, including the rights in this DPA. If Frontier Pet determines it can no longer meet its obligations under this Section, it will notify Customer, and Customer may take reasonable and appropriate steps to stop and remediate unauthorized use.

14. Liability

Each party's liability arising out of or related to this DPA is subject to the limitations of liability and exclusions in the Agreement, except to the extent Applicable Data Protection Law prohibits limiting liability for a particular obligation.

15. Term

This DPA takes effect on the Effective Date above (or the date Customer first accepts the Agreement on or after that date) and continues for as long as Frontier Pet processes Customer Personal Data on Customer's behalf.

16. Contact

Privacy and DPA questions: josh@frontierpet.io