Data Processing Addendum

Effective: October 30, 2026

Version 2026-11. Effective October 30, 2026.

This Data Processing Addendum ("DPA") is part of the Open & Run Terms of Service between Open and Run Inc. ("Open & Run", "Processor") and the Customer ("Customer", "Controller"). It applies whenever Open & Run processes Customer Personal Data. Terms not defined here have the meaning given in the Terms.

1. Definitions

Customer Personal Data: personal information within Customer Data, including information about the Customer's employees, former employees, applicants, contractors, witnesses and Authorized Users.
Data Protection Laws: all US federal and state privacy, data security and breach notification laws that apply to the processing, including, where they apply, the New York SHIELD Act (General Business Law sections 899-aa and 899-bb) and the California Consumer Privacy Act.
Security Incident: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
Subprocessor: a third party Open & Run engages to process Customer Personal Data.

2. Roles

The Customer is the controller (or "business") of Customer Personal Data and decides the purposes and means of processing. Open & Run is the processor (or "service provider") and processes it only on the Customer's behalf.
The Customer is responsible for having a lawful basis for collecting Customer Personal Data, for giving any notices and getting any consents its employees or others are owed, and for its own legal duties as an employer, including keeping personnel records for the periods the law requires.

3. Details of processing


Subject matter and duration	Providing the Service for the term of the Terms, plus the read-only and deletion periods in Section 10
Nature and purpose	Hosting, storing, organizing, displaying, printing, exporting, emailing and securing Customer Data so the Customer can run its operations (incident, accident and praise reporting, workers' compensation documentation, staff management, document storage, invoice and inventory management)
Categories of people	Customer's employees and former employees, managers and owners, witnesses and other people named in reports, Authorized Users, vendor contacts
Categories of data	Names, roles, locations, contact details, emergency contacts, start and termination dates and reasons, report contents and history, notes, employee statements and notification records, photos, documents and files, and invoices
Sensitive data	Health and injury information connected to accident and workers' compensation reports (injury details, treatment, lost time, medical answers, medical documents). The Service restricts treatment details, medical answers, medical documents and the workers' compensation claim to the Customer's admins; managers see the injury type and lost time for their own locations

4. Customer instructions

Open & Run processes Customer Personal Data only on the Customer's documented instructions. The Terms, this DPA and the Customer's use and configuration of the Service (including actions by its Authorized Users) are those instructions. Open & Run will tell the Customer if it believes an instruction breaks Data Protection Laws.

5. Service provider commitments

Open & Run will not:

sell or share Customer Personal Data, or use it for targeted or cross-context behavioral advertising;
keep, use or disclose it for any purpose other than providing, securing and supporting the Service, or as Data Protection Laws allow for service providers;
keep, use or disclose it outside the direct business relationship with the Customer;
combine it with personal information from other sources, except as Data Protection Laws allow.

Open & Run will comply with obligations that apply to it under Data Protection Laws and give the same level of privacy protection they require.

6. Confidentiality and our people

Everyone at Open & Run who can access Customer Personal Data is bound by confidentiality obligations.
Open & Run staff access Customer Data only when needed: to provide support the Customer asks for, to investigate or fix a problem or Security Incident, to carry out a Customer request (such as an export or deletion), or when required by law. Administrative access to customer accounts through our internal console is logged.

7. Subprocessors

The Customer authorizes Open & Run to use the Subprocessors listed at app.openandrun.com/subprocessors.
Open & Run has written agreements with each Subprocessor that require protections at least as strong as this DPA, and remains responsible for its Subprocessors.
Open & Run will update that page at least 30 days before adding or replacing a Subprocessor that processes Customer Personal Data and will email the billing owner. If the Customer reasonably objects on data protection grounds, the parties will discuss it in good faith; if they can't resolve it, the Customer may cancel and Open & Run will refund any prepaid fees for the period after cancellation.

8. Security

Open & Run maintains the administrative, technical and physical safeguards described in Annex 1, appropriate to the nature of the data, and reviews them at least once a year.

9. Security Incidents

Open & Run will notify the Customer without undue delay, and in any case within 72 hours, after confirming a Security Incident affecting the Customer's Customer Personal Data.
The notice will describe what happened, the data and people affected (as far as known), the steps taken, and a contact. Open & Run will update the Customer as it learns more.
Open & Run will reasonably help the Customer meet its own notification duties (for example notices to employees and regulators under the New York SHIELD Act). Unless the law requires otherwise, the Customer decides whether and how to notify its employees.
Notice of a Security Incident is not an admission of fault.

10. Return and deletion

During the subscription: admins can export an employee's file in the Service; the Customer can request a full company export, which Open & Run will provide within 30 days.
After cancellation: the account is read-only for 90 days so the Customer can export its records. Open & Run then permanently deletes Customer Personal Data.
On request: if the billing owner asks Open & Run to delete the account, Open & Run hides it immediately and deletes Customer Personal Data after 30 days.
Holds: Open & Run will extend these periods or keep data on legal hold if the Customer asks before deletion.
Backups: deleted data can remain in backups for up to 30 days until they expire, protected by the same safeguards.
Exceptions: Open & Run may keep data the law requires it to keep (for example billing and tax records), and its internal audit log of administrative actions (which can include copies of changed records) for security and legal purposes, protected by this DPA for as long as it is kept.

11. Help with requests from people

If someone asks Open & Run to access, correct, delete or copy Customer Personal Data, Open & Run will not respond on the Customer's behalf except to direct them to the Customer, and will tell the Customer about the request. The Service's features (employee file export, employee statements and notification records, archive, edit history) are provided so the Customer can respond to these requests and meet record-keeping duties. Open & Run will give other reasonable help when asked.

12. Audits

On written request, no more than once a year (or after a Security Incident), Open & Run will answer the Customer's reasonable written security questions and provide summaries of its security practices and its main Subprocessors' security certifications (for example SOC 2 reports, where the Subprocessor makes them available).

13. Government requests

If Open & Run receives a legal demand for Customer Personal Data, it will redirect the requester to the Customer where possible and notify the Customer before disclosing, unless the law prohibits it.

14. Order of precedence

If this DPA conflicts with the Terms about Customer Personal Data, this DPA controls. Liability limits in the Terms apply to this DPA.

Annex 1: Security measures

Encryption: HTTPS for all traffic with HSTS; data encrypted at rest (AES-256) by our hosting provider.
Hosting: database, authentication and file storage hosted in the United States (US East).
Access control: role-based access in the app (admin, manager, staff), with treatment details, medical answers, medical documents and workers' compensation claims limited to admins, and managers limited to their own locations; files served through signed links that expire; staff access to company documents limited by document visibility.
Server-side enforcement: data is accessed only through server code that checks the user's company, role and location; database row-level security blocks direct access from browsers.
Authentication: password hashing; optional Google sign-in; session expiry; refresh-token reuse detection; rate limiting on sign-up, sign-in, password and invitation flows.
Our team: two-factor authentication on every vendor account; least-privilege access; offboarding steps when someone leaves; confidentiality obligations; logged access to customer accounts through our internal console.
Records integrity: reports are archived rather than deleted, report edits and amendments are versioned (notes on a report are not), employee statements can't be edited or deleted.
Application security: security headers and a content security policy, dependency monitoring, and periodic security scanning.
Backups and recovery: daily database backups kept for 7 days; nightly backups of stored files to a separate project, with deleted files removed from the backup within 30 days.
Incident response: a written incident response plan, reviewed yearly.