1. Parties, application and precedence
This Data Processing Addendum supplements an effective NeighborEase service agreement between the individual or business identified as Operator in the verified service identity and the subscribing association when expressly incorporated into that agreement and accepted by their authorized representatives. The operator may be an individual sole proprietor; no LLC is required or presumed. Publication of this prepared text does not complete the service identity or activate this addendum. The operator’s verified legal identity, business address, privacy contact, effective date and approved infrastructure details must be completed before activation.
This addendum governs personal data processed by the operator on the association’s behalf. It takes precedence over conflicting general service terms concerning that processing. It does not reduce rights or duties that applicable law makes mandatory. Where Texas Business & Commerce Code Section 541.104 applies, the parties’ processing contract must satisfy its requirements; this prepared addendum is not a representation that either party qualifies for an exemption or that every applicable legal requirement has been fulfilled.
2. Roles and documented instructions
The association determines the purposes of its membership, property, community communication and informal-poll records and the people entitled to access them. For those purposes the operator processes association personal data only on the association’s documented instructions, including authorized settings and actions in the service and authenticated written requests. The association is responsible for the lawfulness of its instructions, required notices and permissions, and the authority of its representatives. A platform role does not independently establish legal authority.
The operator will not sell association personal data or use it for targeted advertising, independent profiling or unrelated purposes. If a binding legal obligation requires processing outside the association’s instructions, the operator will inform the association before that processing unless law prohibits doing so. The operator will promptly identify an instruction it reasonably believes violates applicable data-protection law and may pause that instruction while the parties resolve the issue. For separately determined account administration, service security and billing purposes, the operator’s actual independent responsibilities are described in the privacy notice rather than reclassified by this addendum.
3. Subject matter, purpose, data and duration
Optional Finance processing also covers property/member snapshots and annual simulated charges, amounts and due dates, simulated payments and receipt references, reasoned reversals and voids, private reminder content and read state, explicit finance permissions, reviewed simulated subscription selections and private pricing inquiries with counts, preferred intervals, messages and timestamps. Its current purpose is simulation recordkeeping, access control and handling of the Association’s pricing inquiry, not moving money. Finance manager and owner visibility follows current permissions and assignment; the association must not instruct a simulation record to be represented as a real settlement or statutory collection notice.
Organizer records include the declared board office and the versioned authorization declaration for the named association, its language, organizer identity and server timestamp. They support membership assignment and a traceable creation history, without independently verifying the declaration. The original creation declaration remains in the audit if a member’s role later changes. The association also stores its separately designated Community Admin; recorded office, access and administrator transfers retain the affected memberships, previous and new values, reason and server time.
Architectural administration also processes owner contact details and property-address snapshots, proposals and selected PDF or image attachments, submitted revisions, committee appointments and eligibility reasons, references and feedback, human decisions, records of external notices and hearings, appeals and development updates. Draft and submitted-record visibility is limited by the application’s permissions. These records and files are included in scoped returns when authorized and in encrypted operational backups; retained history and attachments are not automatically erased when an application is withdrawn.
The subject matter is hosting and operating a Texas association administration service. Processing includes receiving, organizing, storing, retrieving, displaying to authorized users, correcting, backing up, restoring and, when instructed and lawful, returning or deleting records. Its purpose is to provide membership and property administration, configurable entitlements for informal nonbinding polls, proposals, forums and moderation, meetings and agendas, minutes, announcements, text documents, in-app notices, personal notification preferences and associated audit history. It does not provide official, secret or legally binding elections.
Data subjects include adult members, owners, board representatives, authorized association contacts and other people whose information is lawfully included in association records. Data may include names and contact details; membership roles, status and verification; property or lot labels, addresses and owner links; poll entitlements and recorded choices; user content, meeting links and moderation reasons; timestamps and audit identifiers. Processing lasts for the applicable service relationship and the limited return, preservation and deletion activities described below. The service is not intended for Social Security numbers, full payment-card details, identification scans, medical records, children’s information or other unnecessary sensitive data. The association must not instruct the operator to process such data without a separately approved lawful arrangement.
4. Authorized personnel and confidentiality
The operator will permit access to association personal data only to personnel and approved providers who need it for authorized service, security, support or legal tasks. The operator will ensure that people it authorizes to process that data are subject to appropriate confidentiality obligations and receive instructions proportionate to their access. Administrative access must be limited, reviewed and removed when no longer needed.
The association controls the access it gives its own representatives and members and must promptly update those permissions. The operator will maintain the service’s role and tenant restrictions; they do not prevent an authorized recipient from making a separate copy or disclosing information outside the service. Neither party may disclose confidential association data except for authorized performance, the other party’s documented instruction or a lawful obligation.
5. Security measures and service limitations
The operator will maintain reasonable technical and organizational safeguards appropriate to the data and processing risks. The current implementation includes authenticated sessions, salted password hashing, hashed session and recovery tokens, role and tenant access checks, request-origin checks, HTTPS at the public address, restricted deployment permissions and protected backup archives. These measures reduce risk and do not guarantee uninterrupted service or the prevention of every incident. Authorized administrators can access service data; it is not end-to-end encrypted, and no representation is made that the live database is encrypted at rest.
Current scheduled backup archives are encrypted and restore-checked. Fourteen scheduled snapshots are retained on the same server; separate pre-update snapshots may also exist. No off-server copy is currently configured. A single server loss or compromise can affect both live data and its backups. The association must keep its authoritative records independently and maintain alternative means to provide required notices and records. Material changes that would reduce agreed safeguards require advance disclosure and any agreement required by applicable law.
6. Requests, assessments and security incidents
Taking account of the nature of processing and information available to it, the operator will provide reasonable assistance with authenticated data-rights requests, required security measures, legally required incident notifications and any data-protection assessment applicable to this processing. The operator will route a request concerning association-controlled records to the association unless law requires the operator to respond directly. Neither party may condition the exercise of a nonwaivable right on payment of the software subscription. Instructions and identity or authority checks must use the verified channels identified at activation.
The operator will notify the association without undue delay after becoming aware of a security incident affecting association personal data, provide the information then reasonably available, and supplement it as the investigation develops. Information should address the nature and known scope, likely consequences, mitigation and a contact for follow-up. The parties will cooperate in containment, preservation of relevant evidence, remediation and lawful notices. This clause does not extend a statutory deadline or transfer a party’s independent notification duties to the other party.
7. Subprocessors, infrastructure and international access
No live payment provider is connected. If Stripe or another processor is later enabled, the parties must first identify its actual role, data categories, security arrangements and applicable contract or independent notice in the approved provider schedule. The intended flow processes payments through the Association’s own verified connected account and pays available funds to its designated verified bank account; it does not pool community funds in the Operator’s operating account. Payout and verification timing, returns and provider holds remain relevant. This statement describes a planned arrangement, not an active data disclosure, completed onboarding, provider certification or money-services exemption.
The current installation uses the product owner’s OVHcloud server. Before activation, the operator must identify the contracted hosting entity, server and backup locations, other subprocessors and authorized administration or support locations in an approved infrastructure schedule available to the association. The specific OVHcloud contracting entity and region have not yet been verified for this addendum. Development or support access from Germany must be assessed and disclosed according to the actual arrangement. This text does not promise that data remains exclusively in Texas or the United States.
The association authorizes only subprocessors identified in the agreed schedule and approved changes. The operator will give advance notice of an intended addition or replacement, allow a reasonable opportunity to object on data-protection grounds, and resolve the objection or stop the affected processing before proceeding. The operator will enter written contracts requiring each subprocessor to meet the relevant duties imposed on the operator, including confidentiality and appropriate safeguards, and will remain responsible as required by applicable law. The operator will not begin processing through a subprocessor before securing the necessary contracts; this addendum does not certify that contracts or international-transfer safeguards already exist. Any GDPR applicability or transfer mechanism requires a separate assessment, and no certification or standard contractual clauses are implied.
8. Return, deletion and lawful preservation
On termination of the processing services or an authenticated instruction, the operator will, at the association’s choice and subject to applicable law, return or delete personal data processed on its behalf and delete remaining copies unless retention is legally required. The parties will agree a usable return format and secure delivery method proportionate to the records. The current application provides association-scoped requests with review history and authorized JSON-copy downloads. Correction and deletion require verified handling; submitting a ticket does not erase records or close a whole account automatically. The operator must establish a workable return and deletion procedure and a disclosed retention schedule before activation.
A payment restriction does not automatically delete data or remove the ability to request return through the verified operator channel. Required confidentiality checks and other persons’ rights remain applicable. If law or a binding preservation duty requires continued retention, the operator will limit retained data and access to that purpose and delete it when the lawful basis ends. Backup rotation and separate pre-update snapshots must be addressed in the agreed retention schedule; fourteen scheduled backups do not establish a universal fourteen-day deletion promise. If preserved data is restored, applicable deletion and access restrictions must be reapplied.
9. Information, assessment and accountability
The operator will make information reasonably necessary to demonstrate its processing obligations available to the association and allow and cooperate with reasonable assessments by the association or a designated assessor, as required by applicable law. The parties may first use current documentation or a suitably qualified independent assessment where that adequately addresses the request. Any assessment must protect other tenants’ information, infrastructure security, legally privileged material and confidential third-party information without defeating a mandatory right to verify compliance.
The parties will coordinate reasonable scope, timing and secure evidence handling. They will not require disclosure of passwords, private keys or unrelated customer records when another appropriate means can establish the relevant facts. If an assessment identifies a material failure, the operator will cooperate in a proportionate remediation plan. No private audit arrangement restricts a regulator’s lawful powers or a party’s obligation to provide information required by law.
10. Changes, instructions and protected rights
Changes to processing purposes, data categories, provider arrangements or safeguards must be documented and communicated before they take effect, with any additional agreement or consent required by applicable law. Neither party may treat silence about a new independent purpose as authorization to use association data for that purpose. The operator will inform the association if it can no longer meet this addendum so that the parties can remedy the issue or lawfully end the affected processing.
The effective service agreement governs commercial matters only to the extent consistent with this addendum and applicable law. No provision waives nonwaivable privacy, consumer, property, records-access or regulatory rights. English is the drafting original; the Spanish text is an unofficial convenience translation. Both language versions and the completed infrastructure schedule must be reconciled before activation.