Privacy Notice and Data Processing Addendum

Privacy Notice and Data Processing Addendum

Draft version KM-DPA-2026-09-10-DRAFT-1 • Not effective until approved and accepted

1 Scope and roles

Key Managing is responsible for personal information it uses to manage its own website, accounts, billing, support and security. For property, tenant and operational records processed on a Customer’s instructions, Customer determines the purpose and Key Managing acts as its processor or service provider. A payment institution or a service chosen independently by Customer may have its own legal role and privacy notice. These terms do not convert every vendor into a processor.

This notice is intended for business customers, users, website applicants and people whose information is handled in the service. The service is not directed to children. Customer must have a lawful reason for including any dependent or household information and must avoid unnecessary sensitive records.

2 Information and purposes

Account and inquiry information includes names, business contact details, role, organization, login identifiers, application and support requests. It is used to evaluate inquiries, authenticate users, administer access, deliver support and send necessary account notices.

Property and operational information may include addresses, units, leases, resident and owner contacts, maintenance reports, photos, files, ledger entries, payment status and authorized bank-connection data. It is processed to maintain Customer’s records, calculate and reconcile authorized transactions, carry out requested workflows and provide Customer-selected reporting and integrations.

Billing and consent information includes subscription choices, invoices, limited payment-method identifiers, authorization text, signer information, acceptance timestamps, document versions and evidence of changes. It supports billing, dispute resolution and proof of authorized service. Full card details should be entered only with the payment provider; bank login credentials should remain in the provider’s connection interface.

Technical and usage information may include IP address, device and browser details, session events, security logs, errors and service usage. It supports operation, reliability, abuse detection and investigation. Necessary session technologies may be used for sign-in and security. Optional advertising or tracking technology must not be added under this notice without an updated disclosure and any required choice.

Communications and AI information includes messages and delivery metadata, and content intentionally supplied to selected AI tools. Recording or transcription is processed only for an expressly enabled, lawfully authorized feature. Usage accounting should record counts and processing consumption without copying message or document contents into routine billing logs.

3 Sources and disclosures

Information comes from Customer, authorized users, the individual directly, operation of the service and providers Customer authorizes. Key Managing may disclose the minimum necessary information to contracted hosting, database, security, email, payment, banking, communications and AI providers for their assigned functions. Authorized members of Customer’s organization can see information allowed by their role. Key Managing may disclose information when lawfully required, to address fraud or security threats, or in a business transfer subject to equivalent protection and applicable notice.

Key Managing will not sell customer personal information, share it for cross-context behavioral advertising, or use private customer records to train a general-purpose AI model. Customer-selected AI providers must have compatible contractual and configuration controls before processing is enabled. This promise does not imply that every possible integration has already been vetted.

Data Processing Instructions and Rights

Privacy Notice and Data Processing Addendum continued

4 Processing instructions

Customer instructs Key Managing to collect, organize, store, retrieve and export the records described above; run Customer-selected property workflows, ledger and payment-status reconciliation; transmit authorized messages; process requested documents with selected AI tools; and delete data under Section 8. Processing lasts for the service term and the limited retention periods below. Customer supplies lawful instructions, notices and permissions and remains responsible for its property-management decisions.

Key Managing will process Customer personal information only for these purposes, documented instructions or a legal obligation. It will notify Customer if an instruction appears unlawful and may pause that instruction pending resolution. Access by personnel must be limited to their assigned duties and subject to confidentiality commitments. Key Managing will provide reasonable assistance with individual requests, security obligations, assessments and regulator inquiries relevant to its processing.

5 Service provider restrictions

Where California service-provider rules apply, the specified purposes above are the permitted business purposes. Key Managing will not sell or share the information, retain or disclose it outside the direct service relationship, or combine it with unrelated sources except as the applicable rules allow. It will provide the required level of privacy protection, notify Customer if it can no longer comply, and permit reasonable steps to verify compliance and stop or remedy unauthorized use. Key Managing confirms that it understands and will comply with these restrictions.

6 Subprocessors and international processing

Customer authorizes only the subprocessors identified in the vendor register supplied with the released agreement. The register must state each legal entity, task, processing location and relevant privacy or transfer terms. A category list alone is not the final register. Each subprocessor must be bound to appropriate written confidentiality, security and data-use restrictions. Key Managing remains responsible for its subcontracted performance under this agreement.

Key Managing will give at least 30 days’ notice of an intended new subprocessor handling Customer personal information. Customer may object on reasonable privacy or security grounds within 10 days. The parties will seek a practical solution; if none is available before the change, Customer may end the affected service and receive a refund of unused prepaid fees for that service. Urgent replacements needed for security or continuity will be explained promptly and remain subject to appropriate protections.

No exclusive US data residency or international-transfer certification is promised. Processing locations must be disclosed before release. If a transfer requires additional safeguards or contractual terms, those must be completed before the affected processing starts. This addendum alone is not an EU or UK international transfer mechanism.

7 Individual privacy requests

Send access, correction, deletion or other applicable privacy requests to info@keymanaging.com. Key Managing will verify identity proportionately without asking for passwords or full payment credentials. Where Customer controls the records, requests will be directed to Customer with appropriate assistance; Key Managing will handle information it controls itself. Available rights, exceptions, appeals and response deadlines depend on the law that applies. Requests will be handled within those deadlines, with an explanation of any lawful refusal or extension and any applicable appeal route. No retaliation is permitted for exercising protected rights.

Retention Security and Accountability

Privacy Notice and Data Processing Addendum continued

8 Retention and ending service

During service, Customer controls the business records it chooses to retain, subject to capacity and lawful holds. Customer is responsible for its own legally required property and financial retention. Key Managing will not erase records merely because a tenant balance remains unpaid or a subscription is canceled.

After service ends, Customer may request an export of retained Customer records for 30 days. Key Managing will provide an available, commonly readable format or reasonably assist with retrieval; it does not promise that every report has a self-service export. Subject to legal holds and agreed exceptions, Customer content will be deleted from active systems within 90 days after termination or an earlier verified deletion request. Customer-requested earlier deletion may end remaining access.

Residual backup copies will expire on a rotation no longer than 90 days after deletion from active systems. They will remain protected and unavailable for ordinary use. If a backup is restored, applicable deletion requests must be reapplied. A legal hold must be limited to necessary records, reviewed periodically and removed when its basis ends.

Agreement and consent evidence is retained for at least three years or one year after termination, whichever is later, and longer where required by law. Necessary invoices, tax, security and dispute records may be retained for their documented legal or operational purpose, with access restricted. At the end of the applicable period they will be deleted or irreversibly deidentified. Routine technical logs will use the shortest retention reasonably needed for their documented purpose. A released retention register must record the actual limits for each log and provider.

9 Safeguards and incident handling

Key Managing will maintain reasonable safeguards appropriate to financial, tenant and personal information, including encrypted transport, protected storage, company isolation, access controls, session revocation, restricted administrative access, secret management, security patching and protected backups. It will test recovery procedures periodically and avoid placing secrets or full customer records in routine logs. Customer must secure its own devices, accounts and exports.

Key Managing will notify Customer without undue delay and no later than 48 hours after becoming aware of a security incident involving unauthorized access to, disclosure, loss or alteration of Customer personal information. The initial notice may be incomplete and will be updated as facts become available. It will describe known affected information, likely impact, containment and contact details. Notification is not an admission of liability. The parties will cooperate on mitigation and any legally required notices; each remains responsible for its own legal duties.

10 Verification and return of information

On a reasonable written request, Key Managing will provide relevant security and processing information sufficient to assess these commitments, subject to confidentiality and protection of other customers. Routine reviews may be coordinated annually; an incident or legal requirement may justify additional review. Any audit must minimize disruption and avoid unauthorized penetration testing or exposure of another customer’s records.

The parties will document completed return or deletion upon reasonable request. Neither a backup nor a legal retention exception authorizes unrelated use of retained information. No certification, absolute security guarantee, recovery-time commitment or verified deletion capability is asserted by this draft before operational review.

Activity and privacy disclosure Key Managing processes account, company and necessary security and transaction records to operate and protect the service. Separately, each signed-in user can choose whether to share a limited history of the system sections they visit for product support and improvement. If they allow it, this optional history contains their verified account email, display name, company, section name and visit time. It is visible only to the Key Managing platform owner. It does not capture screen recordings, keystrokes, document contents, bank details, tenant records or activity on other websites. Signing this agreement does not turn on optional activity tracking or authorize it for other employees. Users can choose Keep off when asked, or use Activity & privacy choices in the workflow website footer and select Turn off & delete my usage history. This immediately stops new optional collection and deletes their optional history from the active database; the latest privacy choice is retained so it can be honored. Global Privacy Control and Do Not Track signals also prevent this optional collection. Reports exclude events older than 90 days; expired events are deleted when an activity or privacy request or owner report next runs. Necessary security, contract, billing and transaction records have their separate purposes and retention requirements. On the public client website, Key Managing keeps daily aggregate counts of main-page loads and advertising-link opens, grouped by publication or campaign. These counts contain no visitor name, account email, IP address, unique visitor identifier or browsing history. Repeat visits may count again; these are traffic estimates, not an exact count of people. Aggregate reporting covers 365 days, with older totals removed on the next counter or report request. Website traffic privacy in that website’s footer provides a pause choice stored in a simple preference cookie; Global Privacy Control and Do Not Track are also honored. Publication links identify the advertisement source, not the person visiting. Questions or privacy requests: info@keymanaging.com. Further details: https://workflow.keymanaging.com/privacy/activity and https://clients.keymanaging.com/privacy/traffic.