Data Processing Addendum (DPA)

Last Updated: December 8, 2025

This Data Processing Addendum ("DPA") is part of the Master Service Agreement (MSA) or Terms of Service between Homezai, Inc. ("Processor") and the customer ("Controller"). This DPA describes data protection obligations relating to Homezai's processing of personal data.

1. Definitions

"Personal Data" means any information relating to an identified or identifiable individual processed through the Services.

"Processing," "Controller," and "Processor" are defined consistent with standard privacy laws (GDPR-style alignment).

"Subprocessor" means any third party engaged by Homezai to assist with processing Personal Data.

2. Roles

The customer acts as Controller. Homezai acts as a Processor. Customer determines the nature and purpose of data processed through the Services.

3. Processor Obligations

Homezai shall:

  • process Personal Data only on documented instructions from Customer,
  • implement industry-standard technical and organizational security measures,
  • ensure personnel are bound by confidentiality,
  • assist Customer with data subject requests,
  • notify Customer of any confirmed Personal Data breach within 72 hours,
  • return or delete Personal Data at termination unless legally required to retain it.

4. Subprocessors

Homezai may engage Subprocessors for hosting, messaging, analytics, scheduling, and support.

Homezai will:

  • use only vetted Subprocessors under written agreements,
  • ensure equal or stronger data protection obligations,
  • maintain an updated list of Subprocessors upon written request.

5. Cross-Border Data Transfers

Personal Data may be transferred to the United States or other jurisdictions where Homezai or its Subprocessors operate. All transfers will comply with applicable privacy laws.

6. Security Measures

Homezai shall maintain safeguards including:

  • encryption at rest and in transit,
  • access controls and authentication,
  • monitoring and logging,
  • data minimization,
  • disaster recovery and backup practices.

7. Data Subject Requests

Homezai will assist Customer in responding to requests regarding:

  • access,
  • correction,
  • deletion,
  • restriction of processing,
  • data portability.

Customer is responsible for verifying identity and legality of all requests.

8. Audit Rights

Upon reasonable notice, Customer may request security documentation, certifications, or summaries of audit reports.

On-site audits may be permitted once per year and at Customer's expense, provided they do not disrupt operations or expose platform source code or proprietary information.

9. Retention & Deletion

Upon termination of Services, Homezai will:

  • delete Personal Data within 60 days, or
  • return it if requested by Customer before deletion,

unless retention is required by law.

10. Liability

Liability limits in the MSA apply to this DPA.

11. Term

This DPA remains in effect as long as Homezai processes Personal Data on behalf of the Customer.

Contact

For questions regarding this Data Processing Addendum:
Email: contact@homezai.com
Company: Homezai.com (HomeEZY, LLC.)
Address: 255 Alhambra Circle, Suite 700, Coral Gables, Florida 33135 USA