Roovie™ Data Processing Addendum

Version 1.0 · Last updated: October 28, 2026

Need a countersigned copy for your records? Email privacy@roovie.com.

1. Scope and Precedence

1.1 Parties and purpose. This Data Processing Addendum (this "DPA") is between NanoTech Inc., DBA NanoTech Materials Inc. ("NanoTech"), and the Customer that has accepted the Roovie™ Beta Terms and Conditions (the "Terms"). It sets out how NanoTech protects personal data it processes for Customer through the Roovie Service. Capitalized terms not defined here have the meanings in the Terms.

1.2 How this DPA takes effect. NanoTech offers this DPA to every Customer and is bound by it from the later of its effective date and Customer's acceptance of the Terms. Customer accepts it by accepting the Terms or an Order that references it, by selecting a control expressly accepting it, or by continuing to use the Service after NanoTech gives Customer's administrator notice of it. Electronic acceptance has the effect of a signature, and this DPA is the signed data-processing addendum referred to in Terms Section 5.4, Terms Section 5.5, and Terms Section 14.2. Customer may request a countersigned copy at privacy@roovie.com; a countersigned copy does not change the text.

1.3 Precedence. For the processing of Customer Personal Data, this DPA controls over the Terms and any Order if they conflict, except that an Order or signed agreement may expressly give Customer greater protection. This DPA does not expand the licenses Customer grants in Terms Section 5.2, and nothing in it limits a commitment NanoTech makes in the Terms.

1.4 Definitions. "Customer Personal Data" means personal data or personal information, as defined by Data Protection Laws, that NanoTech processes on Customer's behalf within Customer Data, Outputs, Development Records, or the account records of Customer's Users. "Data Protection Laws" means the United States federal and state privacy and data-security laws that apply to that processing, including the California Consumer Privacy Act as amended (the "CCPA"), the Texas Data Privacy and Security Act, and comparable state laws, and, where Annex 4 applies, the laws listed there. "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data in NanoTech's or a Subprocessor's control. "Subprocessor" means a third party NanoTech engages that processes Customer Personal Data. "De-identified" means information that meets both the Terms Section 5.7 standard and the de-identification standard of applicable Data Protection Laws.

2. Roles and Instructions

2.1 Roles. For Customer Personal Data, Customer is the business or controller, or a service provider or processor acting for its own client, and NanoTech is Customer's service provider, contractor, or processor. NanoTech acts as an independent business or controller only for its own account administration, billing, security and fraud prevention, legal compliance, and communications with Customer's contacts about NanoTech's own offerings, as described in the Privacy Policy at https://www.roovie.com/privacy.

2.2 Instructions. NanoTech will process Customer Personal Data only on Customer's documented instructions. The Terms, each Order, this DPA, and Customer's and its Users' use and configuration of the Service are Customer's complete instructions, including the processing for improvement permitted by Terms Section 5.2 as limited by Section 4. NanoTech will tell Customer if, in its opinion, an instruction violates Data Protection Laws, and may suspend the affected processing until the instruction is changed or confirmed. NanoTech may process Customer Personal Data where required by law, after notifying Customer unless the law prohibits it.

2.3 Customer responsibilities. Customer is responsible for having a lawful basis and giving any notices and obtaining any consents required for NanoTech's processing, including from building owners, occupants, project participants, and other people whose information appears in project content. Customer will follow Terms Section 5.3, including the limits on uploading unnecessary personal information and the categories that require a separate written agreement. Customer will not instruct NanoTech to process Customer Personal Data in a way that violates Data Protection Laws.

2.4 Description of processing. Annex 1 describes the subject matter, duration, nature, and purpose of the processing and the categories of personal data and individuals.

3. Service Provider Commitments

3.1 Limits on use. NanoTech will not: (a) sell or share Customer Personal Data, as those terms are defined in the CCPA, or process it for targeted advertising; (b) retain, use, or disclose it for any purpose other than the business purposes specified in Section 2.2, or outside the direct business relationship between Customer and NanoTech; (c) combine it with personal information NanoTech receives from or on behalf of another person, or collects from its own interactions with individuals, except as Data Protection Laws permit service providers to do; or (d) use it to build or modify a profile of an individual for use in providing services to another business.

3.2 Compliance. NanoTech will comply with obligations that apply to it as a service provider or processor under Data Protection Laws and provide the same level of privacy protection those laws require of Customer. NanoTech will notify Customer if it determines it can no longer meet its obligations under Data Protection Laws. On notice, Customer may take reasonable and appropriate steps to stop and remediate unauthorized processing, including by suspending the affected transfers.

3.3 De-identified data. When NanoTech holds De-identified data derived from Customer Personal Data, it will take reasonable measures to ensure the data cannot be associated with an individual, publicly commit to maintaining and using it only in de-identified form and not to attempt to re-identify it, and contractually require any recipient to do the same.

3.4 Certification. NanoTech certifies that it understands the restrictions in this Section 3 and will comply with them.

4. Product Improvement

4.1 Permitted improvement. Customer Personal Data may be processed under Terms Section 5.2 to evaluate, test, develop, and improve Roovie Offerings, as a business purpose that Data Protection Laws permit for service providers, and only within the limits of this Section 4.

4.2 Limits. In improvement processing, NanoTech will not use Customer Personal Data to profile, evaluate, or make decisions about any individual, to market to anyone, or to provide services to another customer. NanoTech will not permit any Subprocessor or other third party to use Customer Personal Data to train or improve its own models or services. Improvement work will use the minimum personal data reasonably necessary for the task, and personnel and tools with access will be limited to those doing it.

4.3 Removal before retention or reuse. Before NanoTech retains any Development Record after the deletion required by Terms Section 5.5, or makes any example, rule, test case, or dataset derived from Customer's projects available to other customers or the public, it will remove Customer Personal Data or make it De-identified. Account and authentication identifiers are never included. Improvements that contain no Customer Personal Data, such as generalized rules, methods, and software, are not limited by this Section 4.

5. Personnel and Confidentiality

NanoTech will ensure that personnel and contractors authorized to process Customer Personal Data are bound by written confidentiality obligations or an appropriate statutory duty, are trained on their data-protection responsibilities, and have access only as needed to perform their roles.

6. Security

6.1 Security measures. NanoTech will implement and maintain appropriate technical and organizational measures to protect Customer Personal Data, taking into account the state of the art, costs, the nature of the processing, and the risks to individuals. Those measures include at least the measures in Annex 2. NanoTech may update them, provided an update does not materially reduce the overall protection of Customer Personal Data.

6.2 Customer controls. Customer is responsible for the security settings and access choices within its control, including managing Users and roles, protecting credentials, choosing what to share through links or invitations, and exporting and protecting copies it removes from the Service.

7. Subprocessors

7.1 Authorization. Customer gives NanoTech general authorization to engage Subprocessors. The current list is published at https://www.roovie.com/legal/subprocessors, which forms Annex 3.

7.2 Subprocessor obligations. Before a Subprocessor processes Customer Personal Data, NanoTech will enter into a written agreement that imposes data-protection obligations no less protective than this DPA, to the extent appropriate to the Subprocessor's services, including the no-training restriction in Terms Section 5.6. NanoTech remains responsible for each Subprocessor's performance of those obligations.

7.3 Notice of new Subprocessors. NanoTech will give Customer's administrator at least 30 days' notice by email, and will update the published list, before a new Subprocessor begins processing Customer Personal Data. If a Subprocessor must be added or replaced sooner to address a security threat, an outage, or a provider's discontinuation of service, NanoTech may do so and will give notice as soon as reasonably practicable, and the objection right below runs from that notice.

7.4 Objection. Customer may object to a new Subprocessor on reasonable data-protection grounds by writing to privacy@roovie.com within 30 days after notice. The parties will discuss the objection in good faith, and NanoTech may offer a reasonable alternative, such as a configuration that does not send Customer Personal Data to that Subprocessor. If they do not resolve the objection within 30 days after it is made, Customer may terminate the affected Order by written notice, and NanoTech will refund unused prepaid fees and credits for the terminated portion within 30 days, as Terms Section 9.4 provides for termination under Terms Section 9.2.

8. Security Incidents

8.1 Notice. NanoTech will notify Customer's administrator and designated privacy or legal contacts without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident, unless a shorter deadline applies under Data Protection Laws or a law-enforcement agency directs a delay.

8.2 Information. The notice will describe, to the extent known: the nature of the Security Incident; the categories and approximate number of individuals and records affected; the likely consequences; the measures taken or proposed to address it and reduce its effects; and a contact for more information. Where information is not yet available, NanoTech will provide it in phases as it becomes known.

8.3 Response. NanoTech will promptly investigate, contain, and remediate each Security Incident, keep Customer reasonably informed, and provide reasonable cooperation for Customer's own investigation and any notifications Customer must make. Unless Data Protection Laws require NanoTech to notify directly, Customer decides whether to notify affected individuals or authorities, and NanoTech will not name Customer in a public statement without Customer's consent unless required by law.

8.4 No admission. Notice of, or a response to, a Security Incident is not an acknowledgment of fault or liability. Reasonable costs of a Security Incident caused by NanoTech's breach are recoverable as Terms Section 12.2 provides.

9. Assistance

9.1 Individual requests. If NanoTech receives a request from an individual to exercise privacy rights over Customer Personal Data, it will promptly forward it to Customer and will not respond, other than to direct the individual to Customer, unless Customer authorizes it or law requires. Customer may use the Service's export, editing, and deletion tools to respond, and NanoTech will provide reasonable additional assistance where those tools are not enough.

9.2 Assessments and authorities. NanoTech will provide reasonably available information to help Customer complete data-protection assessments and respond to inquiries from regulators about the processing.

9.3 Costs. Assistance is provided at no charge where it is reasonably limited or results from NanoTech's breach. NanoTech may charge reasonable, pre-agreed fees for extensive assistance beyond the Service's self-serve tools.

10. Return and Deletion

Customer may export Customer Personal Data with the Service's tools during the Term. When Customer's access ends, Terms Section 5.5 governs the 30-day archive, export, and deletion, including deletion by Subprocessors through available controls. Copies kept in routine backups or security logs, or retained because law requires it, remain protected by this DPA, will not be used for any other purpose, and will be deleted when the backup or log cycle or legal requirement ends. On written request, NanoTech will confirm deletion in writing.

11. Audits and Information

11.1 Information. Once in any 12-month period, and more often if required by a regulator or after a Security Incident, NanoTech will respond in writing to a reasonable security and privacy questionnaire from Customer and make available summaries of its relevant security policies. Once NanoTech holds a current independent security report, such as a SOC 2 Type II report or ISO/IEC 27001 certificate, it may provide that report in place of answers it covers.

11.2 Audits. If the information under Section 11.1 is not enough to show compliance with this DPA, Customer may conduct an audit only where required by a regulator or Data Protection Laws, or after a Security Incident affecting Customer Personal Data. An audit requires at least 30 days' written notice, a mutually agreed scope and schedule, an independent auditor reasonably acceptable to NanoTech and bound by confidentiality, and no unreasonable disruption to NanoTech's business. Audits do not extend to other customers' data or to Subprocessors' facilities, for which NanoTech will provide available Subprocessor reports instead. Customer bears its own audit costs and NanoTech's reasonable costs, except where the audit reveals a material breach of this DPA by NanoTech.

11.3 Confidentiality. Information provided under this Section 11 is NanoTech's Confidential Information.

12. Location and Transfers

NanoTech and its Subprocessors primarily process Customer Personal Data in the United States, and NanoTech may access it from the United States. If Customer Personal Data is subject to the laws of the European Economic Area, the United Kingdom, or Switzerland, Annex 4 applies.

13. Government Requests

If a government authority requests access to Customer Personal Data, NanoTech will direct the authority to Customer where reasonably possible, notify Customer before disclosing unless the law prohibits it, challenge requests that are unlawful or overbroad where reasonable, and disclose only the minimum data required.

14. Liability, Term, and Changes

14.1 Liability. Each party's liability under this DPA is subject to Terms Section 12, except to the extent Data Protection Laws or Annex 4 do not permit it to be limited.

14.2 Term. This DPA continues as long as NanoTech processes Customer Personal Data and survives termination of the Terms for that period.

14.3 Changes. NanoTech may update this DPA, with notice to Customer's administrator, to reflect changes in Data Protection Laws, Subprocessors listed under Section 7, or the Service. An update that materially reduces the protection of Customer Personal Data requires the affirmative acceptance described in Terms Section 13. Earlier versions continue to apply to Customers who have not accepted a material update, until their current Order ends.

14.4 Contact. Questions, objections, requests, and notices under this DPA go to privacy@roovie.com. Legal notices may also be sent to legal@roovie.com.

Annex 1: Description of Processing

Subject matter and duration: NanoTech's provision of the Service to Customer under the Terms, for the Term and the period of the Terms Section 5.5 archive and deletion.

Nature of processing: collection, storage, organization, analysis, AI-assisted interpretation and correction, simulation, display, transmission, export, sharing at Customer's direction, de-identification, and deletion.

Purposes: providing, operating, supporting, securing, and maintaining the Service, including AI-assisted features; communications Customer and its Users choose to send through the Service; and improvement of Roovie Offerings within Section 4.

Categories of individuals: Customer's Users; Customer's clients, building owners, tenants, occupants, contractors, designers, and other project participants whose information appears in project content; and people Customer invites, messages, or shares results with through the Service.

Categories of personal data: names, email addresses, phone numbers, job titles, and organizations; building and property addresses, including addresses of homes; content of plans, drawings, documents, utility bills, and utility account details; photographs and room scans of building interiors; readings and settings from thermostats and other devices Customer connects; messages, comments, and support conversations; and account, sign-in, and Service usage records.

Sensitive data: none is intended. Under Terms Section 5.3, Customer must not upload passwords, payment-card, health, biometric, children's, classified, or export-controlled data without a separate written agreement. Incidental images of people in photographs or scans are not processed to identify anyone.

Frequency: continuous, for as long as Customer uses the Service.

Annex 2: Security Measures

Encryption: data is encrypted in transit using TLS and encrypted at rest in the database and file storage, with encryption keys managed through a dedicated key-management service.

Access control: personnel access to production systems and Customer Personal Data is role-based, limited to those who need it, protected by individual credentials and multi-factor authentication where supported, and removed promptly when no longer needed. Customer data is separated by organization within the application, and access is checked on every request.

Authentication: sign-in is handled by a contracted authentication provider; passwords are not stored in Roovie's application database.

Monitoring and logging: security-relevant events and administrative actions are logged and reviewed, and automated rate limits and bot protection guard public forms and interfaces.

Resilience: data is backed up regularly by the database provider, with restoration procedures, and the Service is hosted with reputable cloud providers that maintain their own physical and environmental security controls and independent security certifications.

Secure development: code changes are reviewed and tested before release, dependencies are monitored for known vulnerabilities, and secrets are kept out of source code.

Incident response: NanoTech maintains a procedure to detect, investigate, contain, and recover from Security Incidents and to notify Customers under Section 8.

Vendors: Subprocessors are reviewed for security and privacy before engagement and bound by Section 7.2.

Personnel: personnel with access to Customer Personal Data are bound by confidentiality and receive data-protection training.

Annex 3: Subprocessors

The current list of Subprocessors, with each one's purpose, the data it receives, and its primary processing location, is published at https://www.roovie.com/legal/subprocessors and is updated as Section 7 provides.

Annex 4: EU, UK, and Swiss Transfers

Application: this Annex applies only to Customer Personal Data subject to the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, or the Swiss Federal Act on Data Protection (together, "European Data Protection Laws"). For that data, those laws are included in Data Protection Laws, and this Annex controls over the rest of this DPA if they conflict.

Processor terms: the commitments in Sections 2 through 11 apply as the terms required by Article 28(3) GDPR. Section 2.2 is Customer's documented instruction, including for the de-identification and anonymization described in Section 4, and Section 10 is Customer's instruction on return and deletion. Personal data breaches are notified under Section 8. Section 7 is NanoTech's general written authorization to engage Subprocessors, with the notice and objection rights stated there.

Standard Contractual Clauses: for transfers from the European Economic Area to NanoTech in the United States, the parties incorporate the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (the "SCCs"), Module Two where Customer is a controller and Module Three where Customer is a processor. Customer is the data exporter and NanoTech the data importer. Clause 7 does not apply. Under Clause 9, Option 2 applies with the notice period in Section 7.3. The optional language in Clause 11 does not apply. Under Clause 13, the competent supervisory authority is the one determined by Customer's establishment or representative. Under Clauses 17 and 18, the SCCs are governed by the laws of, and disputes are resolved in the courts of, Ireland. Annex I of the SCCs is completed by Annex 1 of this DPA and the parties' details in the Terms and Order; Annex II by Annex 2; and Annex III by Annex 3.

United Kingdom: for transfers from the United Kingdom, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner applies, completed with the information above, and either party may end it as permitted by Section 19 of that Addendum.

Switzerland: for transfers from Switzerland, the SCCs apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority, and Switzerland included as a place where individuals may bring claims.

Precedence and liability: if the SCCs conflict with this DPA or the Terms, the SCCs control. Section 14.1 does not limit liability that the SCCs do not permit to be limited.