Data Processing Addendum

1. Processing instructions and purpose

Customer instructs Strelve to process Customer Personal Information as reasonably needed to provide, secure, maintain, and support the Service. This includes receiving and storing enquiries and incomplete estimates, displaying job details and estimates, sending messages Customer configures or requests, and sending information to integrations Customer connects.

Customer's documented instructions are this Addendum, the Terms, Customer's settings and use of the Service, and written support instructions. Strelve will not use Customer Personal Information for an unrelated purpose, its own direct marketing, or training public AI models. Strelve may process information where required by law and, unless the law prevents it, will tell Customer about that requirement.

If Strelve believes an instruction would breach applicable privacy law, it will tell Customer unless prohibited by law. Strelve may pause the affected instruction while the parties address the issue.

2. Customer responsibilities

Customer is responsible for:

• deciding the purposes and means of collecting and using information through the Service;
• having the authority and lawful basis needed to collect, use, and provide the information to Strelve and any integrations Customer connects;
• giving individuals the privacy notices required by applicable law;
• ensuring its questions, messages, follow-up, and use of integrations comply with applicable law;
• limiting information submitted to what is reasonably needed and not requesting sensitive or special-category information unless the parties first agree appropriate safeguards in writing; and
• managing account access and promptly removing access that is no longer required.

3. Strelve responsibilities

Strelve will:

• process Customer Personal Information only under Customer's documented instructions or as required by law;
• ensure people authorised to handle Customer Personal Information are subject to confidentiality obligations;
• maintain the security measures described in Schedule 2 and keep them under review as the Service changes;
• provide reasonable assistance with individual requests, privacy impact assessments, and regulator consultations, taking account of the processing and information available to Strelve; and
• provide information reasonably available to Strelve to help Customer demonstrate compliance with this Addendum, subject to protecting confidential information, service security, and other customers' information.

4. Subprocessors

Customer gives general authorisation for Strelve to use the Subprocessors listed in Schedule 1 to provide the Service. Strelve will ensure each Subprocessor that handles Customer Personal Information is bound by written privacy and security obligations appropriate to its role, including the data protection obligations that apply to Strelve under this Addendum. Strelve remains responsible for its Subprocessors to the extent required by applicable law and the Terms.

Strelve will give Customer at least 30 days' notice by email before adding or replacing a Subprocessor that will handle Customer Personal Information. Customer may object in writing during that period on reasonable privacy grounds. The parties will work together on a reasonable solution. If no reasonable solution is available, Strelve will not use the new Subprocessor for Customer Personal Information and may suspend the affected feature. Customer may end the affected Service under the Terms.

A third-party service Customer chooses to connect is a Customer-directed recipient of information sent through that integration. Customer is responsible for its relationship with that provider. If Strelve engages that provider to process information as a Subprocessor, Strelve will include it in the notice process above.

5. Individual requests and privacy assistance

Customer is responsible for responding to requests from individuals about Customer Personal Information. If Strelve receives such a request, it will, where legally permitted, refer the person to Customer and notify Customer without undue delay. Strelve will provide reasonable assistance so Customer can respond, taking account of the information available to Strelve and the nature of the request.

Strelve will also provide reasonable assistance with Customer's privacy impact assessments and regulator consultations where required by applicable law and where the request relates to Strelve's processing.

6. Privacy incidents

Strelve will notify Customer without undue delay after becoming aware of a security incident that may involve unauthorised access to, disclosure, alteration, or loss of Customer Personal Information. The notice will include information reasonably available to help Customer assess the incident and meet its legal obligations. Strelve will provide material updates as its investigation progresses and take reasonable steps to contain and address the incident.

Customer is responsible for deciding whether to notify individuals or a regulator about an incident, except where Strelve is independently required by law to notify. Strelve will not notify on Customer's behalf without Customer's agreement unless the law requires it.

7. Overseas processing

Strelve's Subprocessors may process or store information outside New Zealand and Australia. Locations depend on each provider and its service settings. On request, Strelve will provide information reasonably available to it about relevant processing locations and safeguards. Strelve will take the steps required by applicable law before making a transfer that requires additional safeguards. Customer is responsible for any notices or permissions required for its own disclosures and for destinations Customer selects.

Where a law requires prescribed processor or transfer terms, including where the GDPR applies, the parties will put those terms in place before the relevant processing or transfer.

8. Return, deletion, and retention

Customer may ask Strelve to return or delete Customer Personal Information by emailing support@strelve.co.nz. At the end of the Service, Customer may choose return of information available in Strelve's systems or deletion. Strelve will provide a copy in a commonly used format where reasonably available and will handle deletion without undue delay, subject to information it is required or permitted by law to retain.

Cancelling a subscription does not itself delete Customer or lead records. Until Customer asks for return or deletion, Strelve retains information as described in the Privacy Policy. Any information retained for a legal, security, or audit purpose remains protected and will not be used for another purpose.

9. Records and audits

On reasonable written request, Strelve will provide information reasonably available to it about its processing under this Addendum. If that information is not enough to meet a specific audit requirement imposed by applicable law, the parties will agree a proportionate audit process. Any audit must protect Strelve's security, confidential information, and other customers' information.

10. Term and precedence

This Addendum applies for as long as Strelve processes Customer Personal Information for Customer. It supplements the Terms. If this Addendum and the Terms conflict about processing Customer Personal Information, this Addendum controls for that processing. The Terms continue to apply to the rest of the Service, including their liability provisions, subject to rights and obligations that cannot lawfully be excluded or limited. Provisions that need to continue to protect information retained after the Service ends will survive termination.

Schedule 1: Processing details and Subprocessors

Subject matter and duration: Hosted enquiry capture, estimate forms, lead management, follow-up, related business records, and customer-requested integrations, for the period Strelve provides the Service and any subsequent retention allowed by the Terms, this Addendum, and applicable law.

Nature and purpose: Collecting, recording, organising, storing, retrieving, displaying, and transmitting information so Customer can respond to enquiries and manage its sales process, and providing support, security, and maintenance for the Service.

Individuals: Homeowners and other people who make enquiries; Customer's staff and account users; and other individuals whose information Customer submits.

Information: Names, email addresses, phone numbers, property or service addresses, enquiry answers, estimate details, job timing, incomplete estimate information, activity and message records, uploaded files, completed-job and maintenance information, and related identifiers. The Service is not intended for sensitive or special-category information unless the parties agree appropriate safeguards in writing.

Current Subprocessors: The following providers may process Customer Personal Information as part of the Service:

• Supabase: database, authentication, and file storage, including lead records and attachments.
• Vercel: application hosting and related service operations.
• Resend: delivery of lead and operator emails, including the recipient details and message content needed to send them.
• Google Maps Platform: address search text and selected place details when address autocomplete is used.
• Upstash: rate limiting, including short-lived IP address processing.
• Sentry: error monitoring. User email and IP address are stripped from events before transmission. Free-text connector errors are also scrubbed for common contact details and known lead values, as described in the Privacy Policy.
• PostHog: product analytics for aggregate funnel and usage measurement. Events may contain generated lead IDs, business context, and operator user IDs and roles; lead names, email addresses, phone numbers, and submitted answers are not sent.
• TNZ: SMS delivery when a message is requested through the Service. TNZ receives the destination phone number, message text, and delivery reference needed to send and track the message.
• Telegram: delivery of internal new-lead alerts to Strelve's allowlisted administrator chat. An alert can contain the lead's name, email address, phone number, estimated value, and enquiry source.

Customer-directed integration recipients: When Customer connects these services, Strelve sends the information below to Customer's own account. They are recipients chosen by Customer, as described in section 4, rather than Subprocessors engaged by Strelve.

• Tradify: when Customer has configured a Tradify enquiries address and requests a handoff, Strelve emails the lead's name, email, phone, property address and location, preferred call time, estimate and other lead details, selected questionnaire answers, and internal notes when present to that inbox.
• Fergus: lead name, email, phone, property address and location, preferred call time, estimate and other lead details, selected questionnaire answers, and internal notes when present. Status updates send the lead reference, Strelve link, and status.
• Simpro: lead name, email and phone for a customer record; property address and location for a site record; and lead status, estimate and other job details, selected questionnaire answers, and internal notes when present for a lead record.
• Customer-configured webhooks: Strelve sends signed lead-created and lead-status event payloads to the endpoint Customer configures. A lead-created event can include lead and estimate-form IDs and names, lead name, email, phone, suburb, estimate minimum, source and campaign attribution, external reference, status, and duplicate indicator. A status-change event includes the lead and form identifiers, previous and new status, and the actor where applicable. These are Customer-selected recipients, not Subprocessors engaged by Strelve; Customer controls the endpoint and any copy stored there.

Stripe processes Customer's account and billing information for Strelve's own subscription relationship. A Customer may configure Google Ads conversion tracking for its own acquisition measurement. The tag may receive a page-view signal and a conversion event with a generated lead ID as its transaction ID, as described in the Privacy Policy. Google Ads is selected by Customer and is not a Subprocessor engaged by Strelve under this Addendum.

Schedule 2: Security measures

Strelve maintains security measures appropriate to the nature of the Service and the information it handles. Current measures include:

• database Row-Level Security policies to separate each customer's records;
• encryption at rest for secrets and OAuth tokens, and workspace access controls for uploaded files;
• access to Customer Personal Information limited to what is needed to provide requested support or investigate a security issue;
• removal of user email and IP address from Sentry events before transmission.

These measures do not guarantee that the Service will be uninterrupted or that unauthorised access can never occur.

Contact

For questions about this Addendum or to request return or deletion of Customer Personal Information, email support@strelve.co.nz.

Read the Terms of Service and Privacy Policy.