Data Processing Agreement

3.1 Subject Matter

This DPA governs the processing of Personal Data by Rosewood on behalf of the Operator in connection with the delivery of the Services, specifically the generation of compliance notices, management of compliance workflows, and delivery of certified mail on behalf of the Operator.

3.2 Nature of Processing

Rosewood processes Personal Data solely to provide the Services to the Operator. Processing activities include:

• Storing tenant records entered by the Operator
• Generating compliance documents using tenant data
• Transmitting mailing addresses to certified mail providers
• Tracking delivery status and proof of service
• Maintaining compliance audit trails and workflow records
• Automating notice workflows through integrated platforms

3.3 Categories of Personal Data

• Tenant full names
• Tenant lot numbers and service addresses
• Lease information and tenancy details
• Notice history and compliance workflow records
• Delivery addresses for certified mail
• Lienholder names and contact information
• Military status information where legally required

3.4 Categories of Data Subjects

Data Subjects include tenants of the Operator's mobile home park, lienholders, and any other third parties whose personal information is entered into the Services by the Operator.

3.5 Duration of Processing

Rosewood processes Personal Data for the duration of the Operator's active subscription and retains it for 7 years following account cancellation or termination, in accordance with the Rosewood Privacy Policy and applicable Canadian law.

5.1 Instructions

Rosewood will process Personal Data only on documented instructions from the Operator, as set out in the Terms of Service and this DPA, unless required by applicable law to process data for other purposes.

5.2 Confidentiality

Rosewood will ensure that all personnel authorized to process Personal Data are subject to appropriate confidentiality obligations and are trained on applicable privacy requirements.

5.3 Security Measures

Rosewood will implement and maintain appropriate technical and organizational security measures including:

• 256-bit encryption for data in transit and at rest
• Access controls limiting Personal Data access to authorized personnel only
• Secure server infrastructure with regular security monitoring
• Documented security policies and incident response procedures

5.4 No Sale or Independent Use

Rosewood will not sell, rent, trade, or otherwise use Personal Data for any purpose other than providing the Services to the Operator.

5.5 Aggregated and Anonymized Data

Rosewood may use aggregated or fully anonymized data that cannot reasonably be used to identify any individual for the purpose of improving system performance and developing new features.

5.6 Assistance with Data Subject Rights

Rosewood will provide reasonable assistance to the Operator in responding to Data Subject requests for access, correction, or deletion of Personal Data, to the extent technically feasible and within the scope of the Services.

5.7 Assistance with Compliance Obligations

Rosewood will provide reasonable assistance to the Operator in meeting its obligations under PIPEDA, including obligations relating to security, breach notification, and privacy impact assessments.

6.1 Authorized Sub-Processors

The Operator hereby provides general authorization for Rosewood to engage the following Sub-Processors:

6.2 New Sub-Processors

Rosewood will provide the Operator with at least 30 days written notice before engaging any new Sub-Processor that will process Personal Data.

6.3 Sub-Processor Obligations

Rosewood will impose data protection obligations on each Sub-Processor that are no less protective than those contained in this DPA. Rosewood remains fully liable to the Operator for the acts and omissions of its Sub-Processors.

6.4 Cross-Border Transfers

All Sub-Processors listed above are located in the United States, with the exception of Make.com which is incorporated in Germany. By accepting this DPA, the Operator acknowledges and consents to the transfer of Personal Data to these jurisdictions.

7.1 Notification Obligation

In the event that Rosewood becomes aware of a Security Incident involving Personal Data processed under this DPA, Rosewood will notify the Operator without undue delay and in any event within 72 hours of becoming aware of the incident.

7.2 Notification Content

The notification will include to the extent available:

• A description of the nature of the Security Incident, including the categories and approximate number of Data Subjects affected
• The categories and approximate volume of Personal Data records affected
• The likely consequences of the Security Incident
• The measures taken or proposed to address the Security Incident
• Contact information for the Rosewood point of contact for further information

7.3 Operator Notification Responsibilities

The Operator is responsible for assessing whether notification to Data Subjects, the Office of the Privacy Commissioner of Canada, or any other regulatory authority is required under applicable law.

9.1 Retention During Service

Rosewood will retain Personal Data for the duration of the active subscription and for 7 years following cancellation or termination of the account.

9.2 Deletion on Request

Upon written request from the Operator following termination of the Services, and subject to any legal retention obligations, Rosewood will securely delete or anonymize the Operator's Personal Data within 90 days of receiving the written request.

9.3 Legal Retention Obligations

Rosewood may retain Personal Data beyond the requested deletion period where required by applicable Canadian law. Rosewood will notify the Operator of any such retention and the legal basis for it.