This addendum forms part of an agreement between Prebreak Inc. (“Prebreak”) and its identified business customer (“Customer”) that incorporates it. It governs personal information processed on Customer’s behalf in the Services (“Customer Personal Information”) under the California Consumer Privacy Act, as amended, and applicable regulations (“CCPA”). Statutory defined terms retain their meanings. This is a California addendum, not an EU/UK transfer instrument or a representation that every privacy law applies.
Roles, scope, and precedence
Customer determines its project purposes and lawful instructions and is the business where the CCPA so provides. Prebreak acts as service provider or contractor for covered processing according to its actual role and law. A Customer acting for another business must have authority to give the instructions and fulfill its upstream commitments. Labels do not override actual uses.
This addendum controls conflicting covered personal-data provisions. The main agreement governs other matters subject to mandatory law. Prebreak’s own-purpose website, sales, billing-contact and independent account-administration processing is described in the Privacy Policy. Customer project content may not be relabeled independent data to evade this addendum. Customer discloses information only for the limited, specific purposes below.
Specific purposes and instructions
Authorized purposes within purchased/enabled scope are hosting and organizing project records; authentication and permissions; secure file scanning/conversion; extracting and linking parcel, plan, requirement, correspondence and evidence information; supported entitlement, yield, schedule and financial computation for Customer; version and package management; authorized collaboration and external review; human-reviewable draft communications; exports; support and correction; and protection of the security/integrity of these functions.
Internal service-quality improvement is permitted only to the extent allowed by the CCPA and regulations §7050 and the agreement’s promised optional-use exclusions. Appropriate minimization and de-identification are authorized for permitted purposes. Eligible nonpersonal or properly de-identified, rights-cleared material is governed by the Data Use and Model Improvement Policy. No provision permits unrestricted cross-customer use of identifiable information, impermissible combining or an incompatible purpose. The default setting cannot supply required legal consent.
Instructions consist of the agreement, this addendum, enabled features, lawful settings and authorized written directions. Prebreak will notify Customer if it determines an instruction violates applicable data-protection law and may hold affected processing for resolution. New features or scope require agreement; mandatory assistance duties cannot be reduced through that process.
Restrictions and certification
Prebreak will not sell or share Customer Personal Information; retain, use or disclose it beyond the specific purposes stated here or otherwise permitted by the CCPA; retain, use or disclose it outside the direct business relationship except as expressly permitted; or combine it with another customer’s, another source’s or its own interaction information except as expressly permitted by the CCPA and regulations.
Prebreak will comply with applicable CCPA duties, provide the same level of privacy protection required by the CCPA and follow applicable processing restrictions. It certifies that it understands these restrictions and will comply. It will inform Customer if it can no longer meet its duties and allow reasonable and appropriate measures to stop and remediate unauthorized use. Customer may take reasonable and appropriate measures to ensure processing remains consistent with its CCPA obligations.
Processing must be reasonably necessary and proportionate to its permitted purpose. Neither party may waive individuals’ nonwaivable rights, obstruct regulators or manufacture rights Customer lacks. Appropriate notices, permissions and consents for collaborators, agency contacts and nonusers remain necessary.
Personnel and subprocessors
Access is limited to authorized personnel who need it and are subject to appropriate confidentiality obligations. Prebreak may use subprocessors identified in a current customer-accessible list after the required disclosure/authorization opportunity. Covered subprocessors must receive written flow-down restrictions and protections. Prebreak remains responsible for its subprocessor duties under this addendum subject to lawful liability allocation.
Before a new subprocessor receives covered information, Prebreak will ordinarily give at least 15 days’ notice through the agreed channel and a reasonable opportunity for a substantiated data-protection objection. Urgent replacements necessary for security or continuity receive notice as soon as practicable and a comparable objection opportunity. The parties will seek a reasonable alternative. If a material objection cannot be resolved, Customer may stop affected processing and terminate that portion without further penalty, with unused prepaid fees refunded. Stricter law or signed terms control.
Model/document providers act only on Prebreak’s behalf for authorized tasks, with documented training, retention, human-access and region terms. They may not train unrelated general-purpose models on Customer Personal Information. The improvement setting does not waive this restriction.
Security and incidents
Prebreak will maintain reasonable security appropriate to the information and risks, including measures verified and described in the completed schedule. Control domains include access and tenant separation; encryption in transit/at rest for covered systems; secure ingestion; vulnerability/change management; response; backups/restoration; access logs; and retention/deletion. Listing a domain is a duty to implement appropriate measures, not an assertion of a completed certification.
Prebreak will notify Customer without undue delay after becoming aware of a security breach leading to unauthorized access, disclosure, loss, alteration or destruction of Customer Personal Information within its responsibility. Initial notice may be supplemented as facts develop. It will provide available information reasonably needed for legal duties, including nature, affected data, likely consequences, response and contact, and cooperate in mitigation and required notices. Stricter statutory deadlines control. Unsuccessful attacks without compromise do not alone trigger breach notice.
Customer controls its notices unless Prebreak has an independent legal duty. Neither may delay a required notice awaiting the other’s approval. Incident notice is not an admission of fault or unlimited liability. Nonwaivable responsibilities remain.
Rights requests and compliance assistance
Prebreak will reasonably assist Customer with applicable access, deletion, correction, portability and other requests, including identifying records and propagating valid instructions to subprocessors. For direct individual requests concerning customer-directed information, it will act as authorized or explain the appropriate Customer route, unless law independently requires another response. Verification must be proportionate and not used for unrelated purposes.
Prebreak will make available information reasonably needed to demonstrate compliance and assist applicable CCPA risk assessments and cybersecurity audits, including relevant information in its possession, custody or control without material misrepresentation. It will allow reasonable assessments, reviews, testing or audits, initially through documentation/independent assurance where adequate. Reasonable notice, confidentiality, non-disruption and protection of other customers may apply, but cannot defeat required legal access or a justified investigation. A blanket annual frequency limit does not defeat regulator or material-incident needs.
Extraordinary assistance may carry agreed reasonable fees when lawful; mandatory cooperation cannot await an unresolved fee negotiation or miss a statutory deadline. Customer must provide timely lawful instructions and relevant information.
Return, deletion, and duration
Processing lasts through the service and lawful wind-down/retention periods in the completed schedule. At lawful request or termination, Prebreak will return or delete information as agreed and legally required, subject to legitimate preservation duties. Required exclusions/deletions propagate to attributable working copies, indexes, embeddings, previews, training/evaluation queues and instructed providers. Customer may request confirmation and identification of retained classes and reasons.
Backups expire on a documented cycle. Where immediate selective deletion is not reasonably feasible, copies remain isolated from ordinary use until expiry except lawful recovery, and deletions are reapplied after restoration. Legal holds must be scoped, restricted, reviewed and released when no longer needed. Hold, security or backup retention does not authorize optional training.
Raw personal information is not an irrevocable training contribution. Survival of generalized learning applies only where lawful and consistent with this addendum; it cannot defeat valid deletion or permit retention of memorized identifiable information. Security, confidentiality, use limits and deletion duties survive for retained Customer Personal Information.
Processing description and service schedule
People: Customer personnel and users; owners, applicants, consultants, agency/utility contacts, counterparties, invited reviewers and other individuals incidentally represented in lawful project records. Children’s or specially regulated information is not an intended input class.
Categories: business identity/contact and role information; account/permission details; project communications and attachments; signatures/professional information; property/case-linked personal information; and associated service, access, review, correction and security activity. Sensitive information is limited to necessary, lawful supported functions; default shared-learning exclusions remain.
Activities: collection on instruction, hosting, organization, retrieval, conversion, extraction, analysis, computation, controlled disclosure, review, support, minimization, permitted de-identification, export, archive and deletion. This list does not enlarge purposes.
Complete before live processing: Customer and order identity; supported functions and restrictions; instructions and settings; subprocessor legal names/roles; processing/storage countries and required transfer mechanisms; verified safeguards; incident contacts; retention periods for working files, packages, claims, logs, prompts, improvement records and backups; export/wind-down periods; deletion and confirmation; and schedule approval/version. Unfilled schedules do not establish provider facts or authorize unsupported processing.
General
The main agreement’s lawful liability and dispute provisions apply without waiving statutory rights, regulator powers or nonwaivable duties. This addendum does not authorize restricted international transfers or serve as standard contractual clauses. Changes must preserve required protection and cannot silently broaden purposes.
Contact: hello@prebreak.com, subject “Data Processing”; Prebreak Inc., 700 E Redlands Blvd U172, Redlands, CA 92373.
All policies