LAST UPDATED: July 2026

Version: 2026.2

This Data Processing Agreement (“DPA”) forms part of the Master Services Agreement, Order Form, or other written agreement (the “Agreement”) between SOVA Systems LLC, a California limited liability company (“SOVA”), and the customer entity that has executed the Agreement (“Customer”). This DPA reflects the parties’ agreement with respect to SOVA’s processing of Personal Data on Customer’s behalf in connection with the SOVA Offerings.

Contents

• 1. Definitions
  
• 2. Roles and Scope of Processing
  
• 3. Customer Instructions and Permitted Purpose
  
• 4. Confidentiality
  
• 5. Security Measures
  
• 6. Subprocessors
  
• 7. Data Subject Rights and Cooperation
  
• 8. Security Incident Notification
  
• 9. Audits and Compliance Verification
  
• 10. Data Deletion and Return
  
• 11. Aggregated and De-Identified Data
  
• 12. U.S. State Privacy Laws
  
• 13. International Data Transfers
  
• 14. Biometric Personal Information
  
• 15. Automated License Plate Recognition (ALPR) Data
  
• 16. AI and Machine Learning Processing
  
• 17. Limitation of Liability
  
• 18. Term and Survival
  
• 19. Miscellaneous
  
• Annex 1 — Description of Processing
  
• Annex 2 — Technical and Organizational Measures
  
• Annex 3 — List of Subprocessors
  

1. Definitions

In this DPA, the following terms have the following meanings:

• “Applicable Privacy Law” means all federal, state, local, and foreign data protection, privacy, and security laws and regulations applicable to a Party’s processing of Personal Data, including without limitation the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (collectively, the “CCPA”), the Virginia Consumer Data Protection Act (“VCDPA”), the Colorado Privacy Act (“CPA”), the Connecticut Data Privacy Act (“CTDPA”), the Utah Consumer Privacy Act (“UCPA”), the Texas Data Privacy and Security Act (“TDPSA”), the Oregon Consumer Privacy Act, the Montana Consumer Data Privacy Act, and any successor or comparable laws in other U.S. states; and where the EU/UK Data Transfer Addendum has been executed, the GDPR and UK GDPR.
  
• “Authorized Person” means any of SOVA’s employees, contractors, or other personnel that SOVA has authorized to process Personal Data.
  
• “Biometric Information” means Personal Data resulting from specific technical processing relating to the physical, physiological, or behavioral characteristics of a natural person that allow or confirm the unique identification of that person, including without limitation facial recognition templates (“Facial Maps”).
  
• “Business” means as defined in the CCPA. Where Customer is the Business with respect to Personal Data processed by SOVA, references in this DPA to “controller” shall be deemed to refer to Customer in its capacity as the Business.
  
• “Customer Data” means Personal Data contained in (i) any data Customer or its Authorized Users upload to or input into the SOVA Offerings, and (ii) data generated or collected in the course of Customer’s configuration or use of the SOVA Offerings. Customer Data does not include Account Data.
  
• “Account Data” means Personal Data SOVA processes about Customer’s representatives, administrators, and billing contacts in connection with the formation, administration, billing, and support of Customer’s account. SOVA is the controller (or, where applicable, the Business) of Account Data and processes it in accordance with SOVA’s privacy notice, available at https://support.sovasystems.com/portal/en/kb/articles/sova-privacy.
  
• “Personal Data” means any information relating to an identified or identifiable natural person, including “personal information,” “personally identifiable information,” or any equivalent term as defined under Applicable Privacy Law.
  
• “Process” means any operation or set of operations performed on Personal Data, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, erasure, or destruction.
  
• “Sale” means as defined in the CCPA. SOVA does not Sell Customer Data.
  
• “Security Incident” means a confirmed breach of SOVA’s security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data transmitted, stored, or otherwise processed by SOVA. A Security Incident does not include unsuccessful attempts or activities that do not compromise the security of Personal Data, including unsuccessful log-in attempts, pings, port scans, denial-of-service attacks, or other network attacks on firewalls or networked systems.
  
• “Sensitive Personal Information” means as defined in the CCPA, and including comparable categories under other Applicable Privacy Laws (such as “sensitive data” under VCDPA, CPA, CTDPA, and similar).
  
• “Service Provider” means as defined in the CCPA. SOVA acts as a Service Provider to Customer with respect to Customer Data.
  
• “Share” means as defined in the CCPA. SOVA does not Share Customer Data.
  
• “Subprocessor” means any third-party processor engaged by SOVA to assist with the processing of Customer Data on Customer’s behalf.
  

2. Roles and Scope of Processing

2.1 Roles. With respect to Customer Data, Customer is the controller (or Business, as applicable) and SOVA is the processor (or Service Provider, as applicable). With respect to Account Data, SOVA is the controller (or Business, as applicable) and processes Account Data in accordance with its own privacy notice.

3. Customer Instructions and Permitted Purpose

3.1 Permitted Purpose. SOVA shall process Customer Data solely (a) as necessary to provide, maintain, secure, and support the SOVA Offerings in accordance with the Agreement; (b) on the documented instructions of Customer (including those set forth in the Agreement and this DPA); and (c) as required by Applicable Privacy Law (in which case SOVA shall, where legally permitted, inform Customer of that legal requirement before processing). Collectively, the foregoing constitutes the “Permitted Purpose.”

4. Confidentiality

SOVA shall ensure that each Authorized Person is subject to a written contractual or statutory duty of confidentiality with respect to Customer Data. SOVA shall limit access to Customer Data to those Authorized Persons who reasonably require such access for the Permitted Purpose.

5. Security Measures

5.1 Technical and organizational measures. SOVA shall implement and maintain appropriate technical and organizational measures designed to protect Customer Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. The current measures are described in Annex 2 and shall be updated by SOVA from time to time consistent with the state of the art and the level of risk presented by the processing. In no event shall any update result in a material reduction of the level of security.

6. Subprocessors

6.1 General authorization. Customer authorizes SOVA to engage Subprocessors to process Customer Data, subject to the conditions of this Section 6. The current list of Subprocessors is maintained at https://support.sovasystems.com/portal/en/kb/articles/subprocess (or such successor URL as SOVA may designate) and is reproduced as of the Effective Date in Annex 3.

7. Data Subject Rights and Cooperation

7.1 Assistance. Taking into account the nature of the processing and the information available to SOVA, SOVA shall provide reasonable assistance to Customer (at Customer’s cost, except where prohibited by Applicable Privacy Law) to enable Customer to respond to (a) requests from data subjects to exercise rights under Applicable Privacy Law (including rights of access, deletion, correction, portability, restriction of processing, and opt-out of Sale, Share, or targeted advertising); and (b) inquiries or complaints from regulators or other third parties relating to the processing of Customer Data.

8. Security Incident Notification

8.1 Notification timing. SOVA shall notify Customer of any Security Incident affecting Customer Data without undue delay and in any event within seventy-two (72) hours after SOVA confirms the Security Incident.

9. Audits and Compliance Verification

9.1 Documentation-based verification. SOVA makes available to Customer the audit cooperation rights set forth in the Agreement, which include: (a) SOVA’s then-current Security Overview document; (b) summaries of infrastructure provider security certifications, currently including SOC 2 Type II and ISO 27001 attestations carried by SOVA’s cloud infrastructure provider; (c) SOVA’s own security framework attestations, if and when obtained; (d) summary reports from third-party penetration testing; and (e) SOVA’s responses to standard vendor security questionnaires (such as CAIQ or HECVAT). Such information may be requested no more frequently than once per twelve (12) month period, except in connection with a Security Incident.

10. Data Deletion and Return

10.1 Deletion timing. Upon termination or expiration of the Agreement, SOVA shall, in accordance with the data export and disposal provisions of the Agreement, (a) provide Customer with the means to export Customer Data, and (b) delete Customer Data from production systems within the period specified in the Agreement and from backup systems in accordance with SOVA’s standard backup rotation schedule.

11. Aggregated and De-Identified Data

11.1 Permitted use. SOVA may de-identify and aggregate Customer Data such that the resulting data does not identify any individual or Customer (“Aggregated Data”) and may use Aggregated Data for the purposes of operating, securing, monitoring, supporting, troubleshooting, and improving the SOVA Offerings.

12. U.S. State Privacy Laws

12.1 CCPA Service Provider terms. With respect to Personal Data subject to the CCPA, SOVA acts as a Service Provider to Customer in its capacity as a Business. SOVA: (a) shall not Sell or Share Personal Data; (b) shall not retain, use, or disclose Personal Data for any purpose other than the business purposes specified in the Agreement and this DPA, or as permitted by the CCPA; (c) shall not retain, use, or disclose Personal Data outside of the direct business relationship between the Parties; (d) shall not combine Personal Data with personal information from other sources except as permitted by the CCPA for a service provider performing a business purpose; and (e) certifies that it understands the restrictions in this Section and will comply with them.

13. International Data Transfers

SOVA processes Customer Data in the United States. SOVA does not transfer Customer Data outside of the United States in the ordinary course of providing the SOVA Offerings.

14. Biometric Personal Information

14.1 Disabled by default. As set forth in the Agreement, biometric matching, facial recognition, and biometric template generation features of the SOVA Offerings are disabled by default and may be enabled only following execution of the SOVA Biometric Addendum.

15. Automated License Plate Recognition (ALPR) Data

15.1 Disabled by default. As set forth in the Agreement, the optional automated license plate recognition (ALPR) feature of the SOVA Offerings is disabled by default and may be enabled only following execution of the SOVA Vehicle Identification / ALPR Addendum and Customer’s confirmation that it has publicly posted a compliant, site-level ALPR usage and privacy policy for the applicable property, as required under laws including the California Automated License Plate Reader Privacy Act (Cal. Civ. Code §§ 1798.90.5–1798.90.55).

16. AI and Machine Learning Processing

16.1 Permitted AI processing. Where Customer enables AI features of the SOVA Offerings, SOVA may process Customer Data through artificial intelligence and machine learning systems for the operational purposes described in the Agreement, including incident report assistance, image analysis, and operational analytics.

17. Limitation of Liability

Each Party’s liability arising out of or relating to this DPA, whether in contract, tort, or otherwise, shall be subject to the limitations of liability set forth in the Agreement. Where the Agreement contains a Super Cap, Excluded Claims Cap, or comparable provisions applicable to claims relating to data privacy or security, those provisions shall apply to claims arising under this DPA.

18. Term and Survival

This DPA takes effect on the date Customer executes it (or the date Customer accepts it by clickthrough or other electronic means) and continues until SOVA’s processing of Customer Data ceases. The provisions of this DPA that by their nature should survive termination — including without limitation Sections 4 (Confidentiality), 8 (Security Incident Notification), 10 (Data Deletion and Return), 11 (Aggregated and De-Identified Data), 15 (Automated License Plate Recognition (ALPR) Data), 17 (Limitation of Liability), and 19 (Miscellaneous) — shall survive termination of the Agreement.

19. Miscellaneous

19.1 Updates. SOVA may update this DPA from time to time to reflect changes in Applicable Privacy Law, in SOVA’s processing practices, or in industry standards. SOVA shall provide Customer with notice of material updates at least thirty (30) days before the update takes effect, and Customer’s continued use of the SOVA Offerings after the effective date constitutes acceptance of the updated DPA. If Customer reasonably objects to a material update, the Parties shall work in good faith to resolve the objection; if no resolution is reached, Customer may terminate the affected SOVA Offering on thirty (30) days’ written notice.

Annex 1 — Description of Processing

Subject matter and duration. The subject matter of the processing is the provision of the SOVA Offerings under the Agreement. The processing continues for the duration of the Agreement and any wind-down period contemplated by the data deletion provisions of the Agreement and Section 10 of this DPA.

• Customer’s authorized users (security officers, supervisors, administrators, account managers)
  
• Visitors, deliveries, and vendors checked in through the SOVA Offerings
  
• Subjects of incident reports, persons-of-interest records, and lost-and-found claims (typically guests, employees, contractors, or members of the public present at Customer’s facilities)
  
• Customer’s clients and contacts (where Customer is itself a service provider deploying the SOVA Offerings at end-client facilities)
  

• Identifiers and contact information (name, phone number, mailing address; for visitors, also parsed identifying data from government identification barcodes)
  
• Photographs (visitor badge photographs; incident scene photographs)
  
• Operational records (incident reports, daily activity reports, tour data, persons-of-interest records, lost-and-found claims)
  
• Account credentials and authentication data
  
• Where biometric features are enabled under a Biometric Addendum: facial recognition templates
  
• Where the ALPR feature is enabled under a Vehicle Identification / ALPR Addendum: vehicle license plate images (transmitted directly from the Authorized User’s device to a third-party recognition provider identified in Annex 3, not retained by SOVA except where a vehicle record with an attached plate photo is saved) and decoded plate text
  
• Where Customer enables HIPAA-capable infrastructure under a Business Associate Agreement: Protected Health Information of the categories described in the BAA
  

Annex 2 — Technical and Organizational Measures

SOVA implements and maintains the following technical and organizational measures to protect Customer Data. SOVA may update these measures from time to time, provided that no update results in a material reduction in security.

• Multi-factor authentication required for all SOVA administrative access, all elevated customer-facing access, and all access to source code repositories and cloud infrastructure consoles.
  
• Role-based access control limiting Authorized Persons to the minimum data necessary for their function.
  
• Audit logging of access to systems containing Customer Data, retained for not less than twelve (12) months.
  
• Segregation of operational support access from end-user Personal Data, as described in Section 6.5.
  

• Encryption in transit using TLS 1.2 or higher.
  
• Encryption at rest using AES-256 or equivalent industry-standard algorithms, applied to production databases and backups.
  

• Production infrastructure hosted on Amazon Web Services within the United States, leveraging AWS’s SOC 2 Type II, ISO 27001, and other compliance certifications for the underlying infrastructure layer.
  
• Network segmentation between production, staging, and other environments.
  
• Annual third-party penetration testing of the SOVA Offerings, with remediation tracked to closure.
  
• Documented incident response plan, with named roles, pre-selected breach counsel and forensics resources, and periodic tabletop exercises.
  
• Vulnerability scanning and dependency monitoring on application code and infrastructure.
  

• Daily encrypted backups, retained for thirty (30) days, with documented restoration procedures.
  
• Data minimization through configurable retention policies for Personal Data-rich record types.
  
• Synthetic or masked data used in software development environments; production data access by development personnel limited to time-boxed, audit-logged exceptions.
  

• Background checks for personnel with access to production systems, where permitted by applicable law.
  
• Confidentiality obligations imposed by written agreement on all Authorized Persons.
  
• Privacy and security training for personnel with access to Personal Data.
  

• Written agreements with all Subprocessors imposing data protection obligations no less protective than this DPA.
  
• Periodic review of Subprocessor compliance documentation, including SOC 2 reports and other third-party attestations where available.
  

Annex 3 — List of Subprocessors

The current list of Subprocessors is maintained at https://support.sovasystems.com/portal/en/kb/articles/subprocess (or such successor URL as SOVA may designate). The list is reproduced as of the Effective Date of this DPA below. SOVA shall provide notice of changes to the list in accordance with Section 6 of this DPA. Unlike SOVA’s other Subprocessors, the third-party ALPR recognition provider identified in the list is not currently covered by a negotiated data processing agreement, as described in Section 15.3.

[Insert current Subprocessor list as published at the URL above. The list typically includes infrastructure providers (Amazon Web Services), payment processing (Stripe), shipping integration (Shippo), the third-party ALPR recognition provider, AI service providers, the Operational Support Team’s contracting firm, and other Subprocessors as updated from time to time.]