Data Processing Addendum

1. Roles & subject matter

The Customer is the data controller of personal data uploaded to HiveMasterPro. Quail'a Bee Solutions LLC (operating HiveMasterPro) is the data processor. The subject matter is processing of personal data necessary to provide the HiveMasterPro service in accordance with the Terms of Service.

2. Categories of data & data subjects

• Data subjects: the Customer's authorised users (employees, crew members, drivers), the Customer's pollination clients, retail customers added to the Sales CRM, and end users who scan the Customer's public “Meet My Hive” QR pages.
• Categories: contact identifiers (name, email, role), authentication credentials, device identifiers, GPS coordinates of operations, photographs of hives and field work, voice recordings dictated by users, and customer / payment data captured through the Sales CRM.

3. Subprocessors

Authorised subprocessors are listed in the Privacy Policy § 4. Customer hereby grants general written authorisation under Article 28(2) GDPR to engage these subprocessors. We will give at least 30 days' advance notice via the Changelog before adding or replacing a subprocessor materially involved in processing Customer Personal Data; Customer may object on reasonable grounds within that window.

4. Security measures

We implement and maintain the technical and organisational security measures described in our Security overview, including encryption in transit (TLS 1.2+) and at rest (AES-256), Row Level Security on all Postgres tables, optional TOTP two-factor authentication, audit logging on permission and recall events, automatic backups with point-in-time recovery, and least-privilege access controls.

5. International transfers

Personal data may be processed in the United States. For transfers from the EU/EEA, the United Kingdom, or Switzerland to the United States, we rely on the European Commission's Standard Contractual Clauses (Commission Decision (EU) 2021/914) and the UK International Data Transfer Addendum, as applicable. A copy is available on request.

6. Data subject rights

We will, taking into account the nature of the processing, assist the Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling its obligation to respond to data subject requests under Chapter III GDPR, the CCPA, the CPRA, PIPEDA, and other applicable privacy laws.

7. Personal data breach notification

We will notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data, providing information reasonably necessary for the Customer to comply with its own breach-notification obligations.

8. Deletion and return of data

On termination of the underlying agreement, the Customer may export a portable bundle (see Terms § 8) for up to 60 days, after which we will delete or anonymise Customer Personal Data, unless retention is required by applicable law.

9. Audits

On reasonable request and with reasonable advance notice, we will make available to the Customer information necessary to demonstrate compliance with this DPA, including by providing third-party audit reports of our subprocessors (e.g. Supabase's SOC 2 Type II) where contractually permitted.