This Data Processing Addendum (“DPA”) forms part of the ElectraCalcIQ Terms of Service (the “Agreement”) between the customer (“Customer” or “Controller”) and Peninsula Logic, LLC (“Peninsula Logic” or “Processor”), operator of the ElectraCalcIQ service. It applies to Peninsula Logic’s processing of Personal Data on Customer’s behalf and is designed to satisfy Article 28 of the EU General Data Protection Regulation (“GDPR”), the UK GDPR, and the California Consumer Privacy Act as amended (“CCPA”).

Enterprise Customers who need a countersigned copy on their own paper may email security@electracalciq.com. For most Customers, execution of the Agreement (including signup) is deemed acceptance of this DPA as written.

1. Definitions

Terms not defined here have the meaning given in the GDPR or the CCPA, as applicable.

• Personal Data means any information relating to an identified or identifiable natural person that Customer submits to, or generates through, the ElectraCalcIQ service.
• Processing means any operation performed on Personal Data, including collection, storage, use, disclosure, and deletion.
• Controller and Processor have the meanings given in Article 4 GDPR.
• Sub-processor means a third party engaged by Peninsula Logic to Process Personal Data on Customer’s behalf, as listed on the Security & Trust page.
• Data Subject means the individual to whom Personal Data relates.
• Personal Data Breach means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data.
• Standard Contractual Clauses or SCCs means the EU Commission-approved contractual clauses for international data transfers (Commission Implementing Decision (EU) 2021/914) and, for UK transfers, the UK International Data Transfer Addendum.

2. Roles of the Parties

With respect to Personal Data submitted through the ElectraCalcIQ service, Customer is the Controller and Peninsula Logic is the Processor. Peninsula Logic Processes Personal Data only on Customer’s documented instructions, as set out in the Agreement, this DPA, and any additional instructions Customer provides in writing.

Where Peninsula Logic determines the means and purposes of Processing on its own behalf — for example, billing records, account provisioning, security logging, and product analytics on de-identified usage patterns — Peninsula Logic acts as an independent Controller. Those Processing activities are governed by the Privacy Policy, not this DPA.

3. Nature, Purpose, and Duration of Processing

• Subject matter. Provision of the ElectraCalcIQ software service to Customer under the Agreement.
• Nature and purpose. Storing, computing on, and exporting Customer’s electrical engineering project data; delivering transactional communications; providing user authentication and session management; producing PDFs, XLSX, and DXF exports at Customer’s request.
• Categories of Data Subjects. Customer’s account owners, administrators, invited users, and any individual whose Personal Data Customer chooses to include in project metadata.
• Categories of Personal Data. Account identifiers (name, work email, organization), authentication data (hashed password, session cookies, IP address at login), and any Personal Data Customer voluntarily enters into calculator inputs, project notes, or exports.
• Special categories. Customer agrees not to submit special-category Personal Data (GDPR Article 9) or protected health information to the service. The ElectraCalcIQ service is not designed for such data.
• Duration. For the term of the Agreement plus the post-termination retention period described in Section 11.

4. Peninsula Logic’s Obligations

Peninsula Logic will:

• Process Personal Data only on Customer’s documented instructions, including with regard to international transfers, unless required to do otherwise by applicable law (in which case Peninsula Logic will inform Customer of that legal requirement before Processing, unless the law prohibits such notice on important grounds of public interest).
• Ensure that personnel authorized to Process Personal Data are bound by written confidentiality obligations that survive termination of their engagement.
• Implement the technical and organizational measures described in Section 6 to protect Personal Data.
• Assist Customer, taking into account the nature of the Processing and the information available to Peninsula Logic, in fulfilling Customer’s obligations under GDPR Articles 32–36 (security, breach notification, DPIAs) and comparable CCPA obligations.
• Make available to Customer all information reasonably necessary to demonstrate compliance with this DPA and Article 28 GDPR.
• Immediately inform Customer if, in Peninsula Logic’s opinion, an instruction from Customer would infringe applicable data protection law.

5. Sub-processors

Customer provides a general written authorization for Peninsula Logic to engage the Sub-processors listed on the Security & Trust page. Peninsula Logic:

• Enters into a written agreement with each Sub-processor imposing data protection obligations no less protective than those in this DPA.
• Remains fully liable to Customer for each Sub-processor’s performance of its data protection obligations.
• Will notify Customer by email (to the account owner on file) at least 30 days before onboarding any new Sub-processor that Processes Personal Data, or replacing an existing one. Customer may object on reasonable data-protection grounds within that notice window; if the parties cannot resolve the objection in good faith, Customer’s sole remedy is to terminate the affected portion of the Agreement without penalty.
• May engage a new Sub-processor without prior notice where required to respond to a security incident or to maintain service availability, and will notify Customer as soon as practicable thereafter.

6. Security Measures

Peninsula Logic implements the technical and organizational measures described on the Security & Trust page, incorporated into this DPA by reference. Those measures include, at a minimum:

• Encryption of Personal Data in transit (TLS 1.2+) and at rest (managed database and backup encryption).
• Access controls: ED25519-only SSH to production; per-organization ORM-level tenancy isolation; session cookies with Secure, HttpOnly, SameSite=Lax; CSRF protection on state-changing requests; rate limiting on authentication endpoints.
• Three-layer backup strategy (host snapshot, local pg_dump, offsite object-store copy in a separate region), with documented restore procedures targeting 24-hour RPO and 4-hour RTO.
• Security event logging and monitoring with alerting on backup pipeline failures.
• Change management via version-controlled deployments and pre-deploy review.

Peninsula Logic may update these measures over time, provided the overall level of security is not materially reduced.

7. Data Subject Rights Assistance

Taking into account the nature of the Processing, Peninsula Logic will assist Customer by appropriate technical and organizational measures, insofar as this is possible, in fulfilling Customer’s obligation to respond to requests from Data Subjects to exercise their rights of access, rectification, restriction, erasure, portability, and objection under Articles 15–22 GDPR and comparable CCPA rights.

Where a Data Subject contacts Peninsula Logic directly with a rights request relating to Customer’s account, Peninsula Logic will, without undue delay, forward the request to Customer and will not respond to the request itself except to acknowledge receipt and direct the Data Subject to Customer.

Standard in-app export and account-deletion functions available to Customer’s administrators, and the email-based full-account export and organization-deletion procedures described on the Security & Trust page, are provided at no additional charge. Extraordinary requests requiring bespoke engineering work may be billed at Peninsula Logic’s standard professional-services rate on prior written agreement.

8. Personal Data Breach Notification

Peninsula Logic will notify Customer without undue delay, and in any event within 72 hours of becoming aware of a confirmed Personal Data Breach affecting Customer’s Personal Data. The notification will include, to the extent then known:

• The nature of the Personal Data Breach, including the categories and approximate number of Data Subjects and records concerned.
• The name and contact details of the Peninsula Logic point of contact from whom further information can be obtained.
• The likely consequences of the Personal Data Breach.
• The measures taken or proposed to address the Personal Data Breach and to mitigate its possible adverse effects.

Peninsula Logic will supplement this information as it becomes available and will cooperate reasonably with Customer’s own breach-response and regulator-notification activities. A notification will not be construed as an admission of fault or liability.

9. Data Protection Impact Assessments

On Customer’s reasonable written request, Peninsula Logic will provide Customer with information reasonably necessary for Customer to conduct data protection impact assessments and prior-consultation processes under GDPR Articles 35–36, to the extent such information is not already available on the Security & Trust page or in this DPA and is within Peninsula Logic’s reasonable ability to provide.

10. International Data Transfers

ElectraCalcIQ is hosted in the United States. Where Customer’s use of the service involves the transfer of Personal Data from the European Economic Area, the United Kingdom, or Switzerland to the United States or to another country not recognized as offering an adequate level of protection, the parties agree that:

• The EU Standard Contractual Clauses (2021/914), Module Two (Controller-to-Processor), are hereby incorporated by reference into this DPA and apply to such transfers, with Customer as “data exporter” and Peninsula Logic as “data importer.” Optional clauses are not selected unless the parties agree in writing.
• For UK transfers, the UK International Data Transfer Addendum is likewise incorporated by reference.
• Peninsula Logic will implement supplementary measures (encryption in transit and at rest, minimal metadata retention, and the government-request handling described in the Security & Trust page) as necessary to give effect to the transfer mechanism.

11. Deletion or Return of Personal Data

On termination or expiration of the Agreement, and following any post-termination export window described on the Security & Trust page (currently 30 days), Peninsula Logic will delete all Personal Data from production systems within 7 days and purge Personal Data from backup media within 90 days on the standard backup-rotation schedule, unless applicable law requires continued retention.

Customer may request an accelerated deletion or a machine-readable export of Personal Data at any time during or after the export window by emailing support@electracalciq.com. Peninsula Logic will provide written confirmation of completed deletions.

12. Audit Rights

Peninsula Logic will make available to Customer all information reasonably necessary to demonstrate compliance with this DPA. That obligation is discharged, in the first instance, by Peninsula Logic:

• Maintaining and publishing the Security & Trust page.
• Providing, on Customer’s reasonable written request no more than once per twelve-month period, responses to a written security questionnaire (SIG Lite or comparable) and a summary of Peninsula Logic’s internal controls mapping under NDA.
• Providing summaries of Sub-processor audit reports where Peninsula Logic has the right to share them.

Where Customer reasonably determines that the foregoing does not provide sufficient assurance and applicable law entitles Customer to further audit, Customer may, on 30 days’ prior written notice and no more than once per twelve-month period (except following a confirmed Personal Data Breach or a specific regulator directive), conduct an audit at Customer’s expense during Peninsula Logic’s business hours, scoped to minimize disruption. Peninsula Logic may require the auditor to sign a reasonable non-disclosure agreement and may redact information relating to other customers, security details whose disclosure would materially weaken Peninsula Logic’s security posture, or Sub-processor information Peninsula Logic is contractually barred from sharing.

13. CCPA-Specific Terms

To the extent Peninsula Logic Processes “personal information” (as defined in the CCPA) on Customer’s behalf, Peninsula Logic acts as a “service provider” under the CCPA. Peninsula Logic:

• Will not “sell” or “share” such personal information as those terms are defined in the CCPA.
• Will not retain, use, or disclose such personal information for any purpose other than for the specific business purpose of providing the ElectraCalcIQ service, or as otherwise permitted for a service provider under the CCPA.
• Will not combine such personal information with personal information received from or on behalf of another party except as permitted for a service provider under the CCPA.
• Certifies its understanding of these restrictions.

14. Liability and Order of Precedence

Each party’s and its affiliates’ liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set out in the Agreement. In the event of a conflict between this DPA and the Agreement, this DPA governs solely with respect to the subject matter of this DPA. In the event of a conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses govern.

15. Term and Termination

This DPA takes effect on the earlier of Customer’s acceptance of the Agreement or Customer’s first Processing of Personal Data through the service, and continues in force for as long as Peninsula Logic Processes Personal Data on Customer’s behalf. Termination of the Agreement does not relieve either party of obligations that by their nature survive termination, including confidentiality, deletion, and post-termination breach notification.

16. Governing Law and Jurisdiction

This DPA is governed by the same law that governs the Agreement, without regard to conflict-of-laws principles, except where mandatory local data-protection law provides otherwise (for example, GDPR jurisdictional rules for Data Subject claims).

Contact

• DPA and privacy inquiries: security@electracalciq.com
• Data Subject rights requests (via Customer): support@electracalciq.com

Peninsula Logic, LLC — operator of ElectraCalcIQ.