Data processing terms

9.1 It is yours. As between us, you own all data you or your users put into the Service, and the records the Service creates from it for you, including information about your customers, property managers, residents, employees and installers, and your jobs, quotes, invoices, books, documents and photos ("Company Data"). We do not own Company Data.

9.2 Who is responsible for what. For personal information in Company Data, you are the "business" or "controller" and we are your "service provider" or "processor" (as those words are used in US state privacy laws). You are responsible for: (a) having a lawful right to collect the information and put it in the Service; (b) giving your own customers, residents, employees and others any privacy notices and getting any consents the law requires of you, including telling them you use service providers like us; (c) the accuracy of Company Data; and (d) your own compliance with the laws that apply to your business and to how you use the Service, including privacy, consumer protection, employment, tax, marketing and contractor-licensing laws.

9.3 Your instructions. We process personal information in Company Data only to provide, secure, support, maintain and improve the Service, to create de-identified data under 9.8, as the law requires, and as you otherwise instruct through the Service or in writing. These Terms and your use of the Service are your instructions. We may use automated tools, including artificial intelligence and machine learning provided by us or by our subprocessors, for these purposes.

9.4 Sensitive data you may store. We expect your account to hold vendor and installer tax IDs for 1099 reporting, bank and check details used in reconciliation, and employee time and pay records. You may store these for those purposes only. Section 8 lists data you must not store.

9.5 State-privacy-law service-provider terms. For personal information in Company Data, we will not: (a) sell it or share it for cross-context behavioral advertising; (b) keep, use or disclose it for any purpose other than the business purposes in 9.3, or outside our direct business relationship with you; or (c) combine it with personal information we receive from others, except as the law allows a service provider to do. We will comply with the privacy laws that apply to us as a service provider, give the same level of protection those laws require, and tell you if we decide we can no longer meet our obligations under them. You may take reasonable steps, on written notice, to stop and fix any unauthorized use. We understand and will comply with these restrictions.

9.6 Our people and subprocessors. Our staff and contractors who can access Company Data are bound to keep it confidential. You authorize us to use the subprocessors listed in section 13 and on our subprocessors page. Each is bound by written terms that protect Company Data at least as much as these Terms require, and we remain responsible for their handling of it. We will give at least 30 days' notice (by email or in the app) before adding a subprocessor that will process Company Data. If you reasonably object on data-protection grounds, tell us within that period; if we cannot address the objection, you may cancel and we will refund any prepaid fees for the unused period.

9.7 Requests from individuals and regulators. If someone asks us about information we hold for you (for example, one of your customers asks to see or delete it), we will send them to you and help you answer using the Service's tools. If a government or court demands Company Data, we will send it to you where possible and tell you about the demand unless the law forbids it.

9.8 Aggregated and de-identified data. We may create aggregated or de-identified data from Company Data and from use of the Service. That data will not identify, and cannot reasonably be linked to, you, your customers, your employees, or any other person or household, and we combine data across multiple companies before sharing it outside Turn One. We own that data and may use, share, license or sell it for any lawful purpose, during and after this agreement. We will keep it in de-identified form, we will not try to re-identify it, and we will contractually forbid anyone we share it with from trying to re-identify it. We do not sell Company Data, or any personal information, in identifiable form.

9.9 Usage information. We collect information about how the Service is used (for example, which features are used, page timings, errors, and the device and browser) to run, secure and improve it, as the Privacy Policy describes.

9.10 Imports. If you import data from another system, you promise you have the right to do so and that it does not break that system's license. We do not guarantee an import is complete; the import tool shows what it matched and what it did not.

9.11 Where data is kept. We store Company Data in the United States. Some providers, such as our network provider, may process data in transit through other locations.

9.12 Records you must keep. Records you place under a legal hold in Turn One cannot be deleted while the hold is in place. You remain responsible for keeping the financial, tax and employment records the law requires of you; the Service is a tool for doing that, not your records custodian.

9.13 Information about our compliance. On reasonable written request (no more than once a year, unless after a Security Incident or a regulator requires it), we will answer reasonable written questions about our security and privacy practices. Any information we give is our confidential information.