Data Processing Addendum

Ohh BeeHave, LLC d/b/a Stinger Industries
Effective: October 5, 2026
Last updated: October 5, 2026

This Data Processing Addendum ("DPA") is part of the Stinger Terms of Service for business customers. It applies when Stinger processes personal information that a customer enters into the Services about its own customers, employees, or contacts. If this DPA conflicts with the Terms on data processing, this DPA controls.

1. Roles

• Customer (the business that holds the Stinger account) is the controller of Customer Data. Customer decides what data goes into the Services and why.
• Stinger is the processor. Stinger processes Customer Data on Customer's behalf and under Customer's instructions.

"Customer Data" means personal information that Customer or its users enter into, upload to, or connect with Command Center, the Stinger app family, SINET, Teams, Forge, or Creator. It does not include information Stinger collects for its own account management, billing, and marketing, which is covered by the Privacy Policy.

2. Purpose and Instructions

Stinger processes Customer Data only to provide, support, secure, and maintain the Services for Customer, and as otherwise instructed by Customer in writing or through its use of the Services. The Terms, this DPA, and Customer's settings in the Services are Customer's instructions.

Stinger does not sell Customer Data, does not use it for advertising, and does not use it to train public AI models.

If Stinger believes an instruction breaks the law, it will tell Customer.

3. Types of Data and People

Customer Data may include names, contact details, addresses, job and service records, invoices, proposals, schedules, photos, documents, signatures, call and meeting transcripts, and messages. It may relate to Customer's customers, prospects, employees, contractors, and document signers.

Customer will not enter sensitive data the Services are not designed for, such as Social Security numbers, full payment card numbers, or health records.

4. Customer Responsibilities

Customer is responsible for:

• Having a lawful basis and any required notices or consents for the Customer Data it enters
• Getting consent required by law for text messages, call recording, and electronic signatures sent through the Services
• The accuracy of Customer Data
• Managing who in its business has access to its account

5. Confidentiality

Stinger limits access to Customer Data to personnel who need it to provide the Services, and those personnel are bound by confidentiality obligations.

6. Subprocessors

Customer authorizes Stinger to use subprocessors to provide the Services. The current list of subprocessors, and what each one does, is kept in the Privacy Policy and the Trust Center. Stinger uses subprocessors under terms that protect Customer Data at least as much as needed for their role.

Stinger will update that list before adding a new subprocessor that processes Customer Data. If Customer objects on reasonable data protection grounds, the parties will discuss it in good faith, and Customer may cancel the affected Services under the Terms.

7. Security

Stinger maintains reasonable technical and organizational safeguards for Customer Data. These include HTTPS enforced in transit, encryption at rest for connected credentials and for stored photos and documents, hashed passwords, login and rate-limit protections, and separation of each business's records in how the system reads and writes them. The Trust Center describes these measures.

This DPA does not claim SOC 2, HIPAA, ISO 27001, or any other certification.

8. Security Incidents

If Stinger becomes aware of unauthorized access to Customer Data in its systems, it will notify Customer without undue delay, share the information it reasonably has about the incident, and take reasonable steps to contain it.

9. Help With Requests

If a person asks Stinger to access, correct, or delete Customer Data, Stinger will refer them to Customer. Stinger will give Customer reasonable help responding to these requests, using the tools in the Services or manually where needed.

10. Deletion and Return

Customer may delete Customer Data through the Services or ask Stinger to delete it at any time. On termination, Customer may request an export of its data. Stinger will delete Customer Data from the live system right away on Customer's request or after the account is closed. Copies in backups are gone within 12 months as backups roll off. The exceptions are where the law requires Stinger to keep it, or where a retention rule described in the Privacy Policy applies (such as jobsite evidence photos kept for the Florida statute of repose period).

11. Location

Our servers and databases are in the United States. The AI providers we use process requests on their own systems. Stinger is based in Florida.

12. Information and Review

On reasonable written request, Stinger will answer Customer's questions about its processing of Customer Data and its safeguards, no more than once a year unless an incident has occurred.

13. Liability and Law

The limitation of liability in the Terms applies to this DPA. This DPA is governed by Florida law, with venue in St. Lucie County, Florida, as set out in the Terms.

14. Contact

StingerIndustries1@gmail.com · (772) 529-4144 · Port St. Lucie, FL