Legal & Compliance

Legal Changelog

Home Watch IT, LLC  |  Newest first
Every substantive change to the Data Processing Agreement, Master Services Agreement, and Privacy Policy is recorded here. Archived PDFs of prior versions are on the legal documents index.

7 September 2026

Data Processing Agreement — version 1.2

  • Clause 2 (Services) and clause 4 (Nature of Processing; Purposes): AI-assisted report completion (“AI Fill”) added to the description of the Services and of the processing.
  • New clause 14, Artificial Intelligence Features and Model Training: Customer Data submitted to AI features is used solely to generate the requested output (14.1); Customer Data is not used to train, fine-tune, develop or improve any model (14.2); AI Sub-Processors are contracted on terms prohibiting use of Customer Data for model training, and HWIT will not opt in to any model-improvement, feedback-sharing or fine-tuning programme (14.3); any new AI Sub-Processor is introduced only under clause 5.4 and subject to the same prohibition (14.4).
  • Clause 7: the competent supervisory authority is now determined in accordance with Clause 13 of the SCCs — the authority of the EU Member State in which the Controller (data exporter) is established — replacing the fixed designation of the Irish Data Protection Commission. Irish governing law for the SCCs is unchanged.
  • Clause 10: the circular cross-reference to the Service Agreement’s general liability cap is removed. Liability for breaches of the DPA or of Applicable Law is now governed solely by the separate data protection limit in §9 of the Service Agreement.
  • Schedule A: the Supervisory Authority (EU) row is restated per Clause 13(a) of the SCCs; a new row describes the AI Fill processing (dictation transcribed on the user’s own device by the operating system keyboard, no audio transmitted, no Customer Data transmitted to the AI Sub-Processor).
  • Schedule B: new “Model training” column, populated for every Sub-Processor; OpenAI Ireland Ltd.’s role updated to “AI-assisted report completion (AI Fill) and document search”.
  • Version footer added (version, effective date, superseded version, link to the /legal archive).

Master Services Agreement — version 1.1

  • §4: OpenAI Ireland Ltd.’s stated purpose updated to AI-assisted report completion (AI Fill) and document search.
  • §9: new third paragraph setting a data protection sub-cap for carve-out (a) — the greater of three times twelve months’ fees actually paid and US $2,500. Liability for death or personal injury caused by negligence and for fraud remains unlimited; the sub-cap governs claims between the parties only and does not affect any right of a data subject under Article 82 GDPR or the powers of any supervisory authority. The general twelve-month cap and the carve-out are unchanged.
  • §12: the competent supervisory authority for EU data protection matters is that of the EU Member State in which the Customer is established, replacing the fixed designation of the Irish Data Protection Commission. Texas as primary governing law, and Irish law for the DPA, are unchanged.
  • New §14, Changes to these Terms: at least thirty days’ written notice by email before a material change takes effect; the version in effect when a subscription commences continues to apply to that subscription until its next renewal; prior versions remain available in the /legal archive.
  • Version footer added.

Privacy Policy — version 1.1

  • §1: the United Kingdom statement is restated to reflect the Article 3(2) UK GDPR position — HWIT is not established in the UK, does not offer its services to UK-established customers, and does not direct its services at individuals located there.
  • §4: new paragraph stating that customer content is not used to train or improve artificial intelligence models, that AI-assisted features use content solely to produce the requested output, and that AI service providers are contractually prohibited from using it for model training or improvement.
  • §6: OpenAI Ireland Ltd.’s stated purpose updated to AI-assisted report completion (AI Fill) and document search.
  • §13: the “European Union — Irish Data Protection Commission” row is replaced by the supervisory authority of the Member State in which the individual lives or works, together with the option of raising a concern through HWIT’s EU representative in Slovenia. The Portugal, France, Slovenia and United Kingdom rows are unchanged.
  • Version footer added.

All documents

  • This /legal index and changelog published, with a permanent PDF archive of versions 1.0 and 2.0.

6 September 2026

Data Processing Agreement — version 1.1

  • New clause 12, EU Representative (Article 27 GDPR): Home Watch IT d.o.o., Pod Jeseni 16, Ljubljana, designated as the Processor’s representative in the European Union. The former clause 12, General Provisions, became clause 13.
  • Clause 12 also records that the Services are not offered to customers established in the United Kingdom and that no UK Article 27 representative has been appointed; UK transfer mechanisms are retained for EU controllers processing UK data subjects’ data.
  • Clause 9 rebuilt as “Data Return and Deletion” (formerly “Data Retention and Deletion”): return and/or deletion at the Controller’s choice, with a complete machine-readable export at no additional charge on written request received before termination (Article 28(3)(g)); deletion on delivery of the export or 30 days after termination, whichever is first.
  • New clause 5.6, Assistance with Controller Obligations (Articles 32–36 GDPR, Article 28(3)(f)). The former clause 5.6, Audit Rights, became clause 5.7 and was widened to include audits and inspections (Article 28(3)(h)).
  • Cloudflare, Inc. added as a Sub-Processor, in both the clause 7 transfer table and Schedule B.
  • PDFShift’s Schedule B role corrected from “Workflow automation” to “PDF document generation”.
  • Schedule A retention row updated to reflect the return-or-delete choice.
  • Data Protection Contact block: Home Watch IT d.o.o. identified as EU Representative under Article 27 GDPR.
  • First version number assigned to the Master Services Agreement and Privacy Policy (v1.0); the Data Processing Agreement moved from v1.0 to v1.1.

Master Services Agreement — version 1.0

  • §4: Cloudflare and PDFShift added to the Sub-Processor list. The exclusion of HWIT liability for Sub-Processor failures narrowed to operational outages and service interruptions, with HWIT remaining fully liable for its Sub-Processors’ processing of personal data under the DPA.
  • §9: liability cap changed from fees paid to date excluding monthly subscription fees, to the total fees — expressly including monthly subscription fees — actually paid in the twelve months preceding the event giving rise to the claim.
  • §10: new pre-termination data export at no additional charge; deletion timing aligned to delivery of the export or 30 days after termination, whichever is first.
  • §11: HWIT’s commitments updated to include the machine-readable export before deletion.
  • §12: Texas stated as the primary governing law of the relationship; the DPA (Irish law) carve-out scoped to customers established in the European Union and to personal data matters only.

Privacy Policy — version 1.0

  • §1: entity table corrected to “Home Watch IT d.o.o.” with its Ljubljana address, and the entity designated as EU representative of Home Watch IT, LLC under Article 27 GDPR. New paragraph setting out the Article 27 designation and the UK representative position.
  • §6: Cloudflare, Inc. and PDFShift added to the sub-processor table.

April 2026

Data Processing Agreement — version 1.0

  • Initial publication.

Master Services Agreement

  • Initial publication (published without a version number).

Privacy Policy

  • Initial publication (published without a version number).
© 2026 Home Watch IT, LLC  |  Legal changelog