Data Processing Addendum

North Carolina Land Ops LLC · nclandops.com
Effective date: 2026-07-01 · Last Update: 2026-10-23

This Data Processing Addendum ("this Addendum") is part of the agreement it is attached to (the "Agreement") between North Carolina Land Ops LLC, a North Carolina limited liability company ("the Company"), and the other party named in the Agreement ("the Counterparty"). It states how personal data is handled when one party processes it for the other. Where the Agreement and this Addendum differ on the handling of personal data, this Addendum controls. Words with a defined meaning are listed in section 12.

Both parties process personal data only in the United States under the Agreement. Nothing in this Addendum contemplates processing, storage or transfer anywhere else, and no provision for it is included.

1 Roles

1.1 Three situations. This Addendum applies in whichever of these the Agreement creates, and Annex A names which:

The Company as Processor. The Counterparty supplies the Company with personal data about third parties, such as its clients, buyers, tenants, occupants or the owners of record of properties, so that the Company can assess, plan, schedule, perform and document work at those properties. The Counterparty is the Controller of that data ("Customer-Supplied Data") and the Company is its Processor.
A service provider as Processor. The Counterparty provides the Company a platform or service that processes the Company's own customer, inquiry, job or personnel data on the Company's behalf, such as customer-relationship management, telephony and messaging, payments, data hosting, email, or speech and AI services. The Company is the Controller of that data ("Company Data") and the Counterparty is its Processor.
Independent Controllers. Each party collects and uses personal data for its own purposes under its own notices, for example a licensed trade that contracts directly with a client, or the Company's own job record. This Addendum does not govern a party's independent processing, and neither party is the other's Processor for it.

1.2 The Company's own data. The Company's job records, site disclosures, photographs, estimates, completion records, communications and production data are collected for the Company's own purposes and are governed by its Privacy Policy and its record-keeping obligations. Nothing in this Addendum transfers ownership of them, and nothing in it makes the Company a Processor of its own customers' data.

1.3 Ownership of Company Data. Where a service provider is the Processor, all Company Data, and the configuration the Company has built on the provider's platform, belong to the Company. The Processor acquires no right in them beyond what is needed to provide the service.

2 Obligations of the Controller

The party that is the Controller:

collects the personal data lawfully and gives the notices its own law requires, so that the Processor's processing under the Agreement is lawful;
gives its instructions in writing, which are the Agreement, the written plan or work order, and Annex A, and any later written instruction;
keeps the data accurate and tells the Processor of corrections;
supplies no Sensitive Data unless the Agreement expressly requires it and Annex A names it; the Company's services never require it, and the Company asks no Processor to hold it;
is responsible for its own obligations under Data Protection Laws and for responding to its own data subjects, with the Processor's help under section 7.

3 Obligations of the Processor

The party that is the Processor:

processes the personal data only on the Controller's documented instructions and only for the purposes in Annex A, and tells the Controller promptly if it believes an instruction is unlawful or if it cannot comply;
ensures that every person it authorizes to process the data is bound to confidentiality;
implements and maintains the security measures in Annex C;
engages Subprocessors only as section 4 allows;
helps the Controller respond to requests from data subjects under section 7;
tells the Controller of a Security Breach under section 6;
returns or deletes the personal data at the end of the services under section 8;
does not sell the personal data, share it for advertising, combine it with data it holds for anyone else, or use it for its own purposes, except as section 8(c) allows for De-identified Data;
demonstrates its compliance on request: by written answers to the Controller's reasonable questions, no more than once a year and after any Security Breach, and by providing the security documentation its own providers make available.

4 Subprocessors

4.1 Those authorized. The Controller authorizes the Subprocessors listed in Annex B by role. The Processor keeps the list current and provides it on request.

4.2 Changes. The Processor gives the Controller written notice, by email to the address in the Agreement, at least thirty days before a new Subprocessor begins processing the personal data. If the Controller objects in writing within that period on reasonable grounds relating to data protection, the parties work to resolve the objection; if they cannot, the Controller may terminate the affected services without penalty, and section 8 applies.

4.3 Flow-down and responsibility. The Processor binds each Subprocessor in writing to obligations no less protective than this Addendum, and remains responsible to the Controller for the Subprocessor's performance.

5 Security

The Processor implements the measures in Annex C and reviews them regularly. Payment card data is never held by either party; it is entered with, and held by, the payment processor.

6 Security Breach

The Processor notifies the Controller of a Security Breach affecting the personal data without unreasonable delay after discovering it, and in any event within three business days. The notice describes what happened, the kinds of personal data involved, the persons affected so far as known, the steps taken to contain and prevent recurrence, and a contact for more information, and is supplemented as more becomes known. The Processor cooperates with the Controller's investigation and its notices to affected persons and to the North Carolina Attorney General's Consumer Protection Division where the law requires them. The Processor does not notify data subjects or regulators on the Controller's behalf unless the Controller instructs it or the law requires it of the Processor directly.

7 Requests from data subjects

If the Processor receives a request from a person to see, correct, delete or stop the use of their personal data, it forwards the request to the Controller within five business days and does not answer it on the Controller's behalf unless instructed. The Processor gives the Controller the help it reasonably needs to respond, and the Controller bears any reasonable cost of help beyond what the services already include.

8 Retention, return and deletion

8.1 At the end. When the services under the Agreement end, the Processor returns the personal data to the Controller in a structured, commonly used format, or deletes it, at the Controller's choice, within thirty days, and deletes remaining copies, except:

(a) records the Processor must keep under tax, contractor, lien or other law, which it keeps only for that purpose and only as long as that law requires; (b) records the Processor needs to perform or defend the Agreement, including a plan, an estimate, a completion record or an invoice; (c) De-identified Data, from which no person can reasonably be identified, which the Processor may keep; and (d) copies in backups that expire in the ordinary course and are not restored for use.

8.2 Certification. On request, the Processor confirms deletion in writing.

8.3 Export. Where the Processor provides a platform to the Company, the Company may export all Company Data at any time, in a structured, commonly used format, through a documented interface, without restriction or additional charge.

9 Location

All processing under this Addendum takes place in the United States. If either party learns that a data subject or a Subprocessor is outside the United States, it tells the other before any processing of that person's data or by that Subprocessor begins, and the parties decide in writing how to proceed.

10 Liability, precedence and term

Each party's liability for a breach of this Addendum is governed by the Agreement. This Addendum prevails over the Agreement and over either party's privacy policy on the handling of personal data under the Agreement. It lasts as long as the Processor holds the personal data, and sections 3, 6, 8 and 10 survive the end of the Agreement.

11 Signatures

North Carolina Land Ops LLC: ______________________________ Title: Manager Date: __________

The Counterparty: __________________________ Printed: ____________________ Title: __________ Date: __________

12 Definitions

Agreement means the written agreement this Addendum is attached to, including the plan, work order or statement of services under it.

Company Data means personal data the Company collects for its own purposes and entrusts to a Processor under the Agreement: its inquirers, customers, referrers, vendors and personnel, and the records about them.

Controller means the party that determines why and how personal data is processed. It includes a business, a controller and a third party as those words are used in the state privacy laws of the United States.

Customer-Supplied Data means personal data about third parties that the Counterparty supplies to the Company so that the Company can perform the services.

Data Protection Laws means the laws of the United States and its states that apply to a party's processing of personal data under the Agreement, including Section 5 of the Federal Trade Commission Act, the North Carolina Identity Theft Protection Act, the Telephone Consumer Protection Act, the CAN-SPAM Act, and any state consumer privacy law to the extent it applies to that party. No law of any other country applies.

De-identified Data means data from which the person cannot reasonably be identified, held by a party that commits in writing not to re-identify it and that contractually forbids its recipients from doing so.

Personal Data means information that identifies, relates to, or could reasonably be linked to an identified or identifiable person. It includes personal information as the state privacy laws of the United States define it.

Processing means any operation performed on personal data, such as collecting, recording, storing, using, disclosing, transmitting or deleting it.

Processor means the party that processes personal data on the Controller's behalf and on its instructions. It includes a service provider, a contractor and a processor as those words are used in the state privacy laws of the United States.

Security Breach means unauthorized access to and acquisition of personal data held by a party or its Subprocessor that creates a material risk of harm to a person, including an incident the North Carolina Identity Theft Protection Act defines as a security breach, and extends to every category of personal data under this Addendum.

Sensitive Data means government identification numbers, financial account and card numbers with their access codes, health information, biometric data, precise geolocation beyond a property address, and information about a person's race, religion, sexual orientation or immigration status.

Subprocessor means a third party engaged by the Processor to process personal data on the Controller's behalf.

13 Photographs of your property

We photograph our work at assessment, during the job and at completion, for the job record. We publish a photograph of a client's property only with the client's agreement, and we leave out house numbers, vehicles and faces unless you agree otherwise.

Annex A - Description of the processing

Schedule 1. The Company as Processor for a business customer.

Subject matter: personal data about the Counterparty's clients, buyers, tenants, occupants and the owners of record of properties, supplied so that the Company can assess, plan, schedule, perform and document land work at identified properties.

Nature and purpose: contacting people about access and scheduling; recording site disclosures; documenting the work with photographs; producing the plan, estimate, completion record and invoice; meeting the Company's legal duties on the job.

Data subjects: property owners, buyers, tenants and occupants; the Counterparty's staff.

Categories of data: names, telephone numbers, email and mailing addresses, property addresses and parcel data, site disclosures, photographs of the property, communications about the job.

Sensitive Data: none.

Duration and retention: the term of the Agreement, then section 8.

Schedule 2. A service provider as Processor for the Company.

Subject matter: Company Data: inquiries, contacts and opportunities, conversations including call recordings and transcripts, bookings, payment confirmations and the last digits of cards, documents exchanged with customers, and the Company's configuration on the platform.

Nature and purpose: providing the platform or service and its features to the Company at the Company's direction; no other use.

Data subjects: the Company's inquirers, customers, referrers, vendors and personnel.

Categories of data: names, telephone numbers, email and mailing addresses, property addresses and parcel data, the content of communications, scheduling and payment metadata, and the inputs and outputs of the Company's online assessment tool.

Sensitive Data: none; card data is held only by the payment processor.

Duration and retention: the term of the Agreement; export under section 8.3 at any time; return or deletion under section 8.1 at the end.

Annex B - Subprocessors, by role

Where the Company is the Processor (Schedule 1), the Company's Subprocessors are: its customer-relationship, telephony and messaging platform (HighLevel, under the M3 Digital LLC agency account described in Annex D) and that platform's own providers for telephony, text-message delivery and speech and AI services; its payment processor (Stripe); its database and computing provider (Supabase, United States region); its email provider (Microsoft 365, through GoDaddy); its domain registrar and DNS provider (GoDaddy). Public records services the Company queries, including NC OneMap and federal elevation data, receive the property location and no personal data and are not Subprocessors.

Where a service provider is the Processor (Schedule 2), its Subprocessors are those it names in its own list, which it provides on request and updates under section 4.

Annex C - Security measures

Access to personal data is limited to the Company's own people and to the Subprocessors in Annex B, each for its role.
Every account through which personal data is reached is held in the Company's name, protected by a strong, unique password and two-factor authentication, and listed in the Company's credentials inventory with its registered owner.
The operating database enforces row-level security on every table, default-deny, with no automatic provisioning of accounts and with production records, classification histories and audit trails that cannot be altered or backdated.
Data is encrypted in transit and at rest as the platform providers supply, and the providers' own security attestations are available on request.
Payment card data is tokenized and held by the payment processor and never by the Company or its platform.
A failure in any automated process is queued, retried and surfaced to a person; silent failure is prohibited.
A Security Breach is handled under section 6 and the Company's incident procedure, and documented.

Annex D - Intercompany schedule: M3 Digital LLC

Parties and role. M3 Digital LLC holds the HighLevel agency account under which the Company's location runs. It is a service provider and Processor to the Company under Schedule 2; the Company is the Controller.
Ownership. The location, its data, its configuration, its telephone numbers and its registrations belong to North Carolina Land Ops LLC. M3 Digital LLC acquires no right in them.
Access and use. M3 Digital LLC accesses the location only to administer it at the Company's direction. It does not use Company Data for itself or for any other client, and does not combine it with any other client's data.
Transfer. On the Company's request, M3 Digital LLC transfers the location, with all its data and configuration, to an agency account the Company designates, and cooperates with the transfer at no charge beyond the platform's own fees.
Subprocessors. HighLevel and its providers are M3 Digital LLC's Subprocessors for this schedule.
Consideration and term. The Company pays M3 Digital LLC for the agency account.