Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the agreement (whether a signed Order Form or our online Terms & Conditions) between Renterval LLC, operating as RentMy ("RentMy", "Processor"), and the Customer identified in that agreement ("Customer", "Controller", "you"). It governs RentMy's processing of Personal Data on Customer's behalf in connection with the RentMy platform (the "Service").

If you require a counter-signed copy of this DPA for your records, email hello@rentmy.co with the legal name of your entity.

• Personal Data, Controller, Processor, Data Subject, Processing, and Personal Data Breach have the meanings given in applicable Data Protection Law.
• Data Protection Law means all laws applicable to RentMy's processing of Personal Data under the agreement, including the EU GDPR, UK GDPR, Swiss FADP, California Consumer Privacy Act (CCPA/CPRA), and other US state privacy laws.
• Customer Personal Data means Personal Data processed by RentMy on Customer's behalf to provide the Service.
• Sub-processor means any third-party processor engaged by RentMy to assist in providing the Service.

The parties acknowledge that Customer is the Controller (or a Processor acting on behalf of a third-party Controller) and RentMy is a Processor of Customer Personal Data. Annex A describes the duration, nature, purpose, data categories, and data subject types.

RentMy will process Customer Personal Data only in accordance with Customer's documented instructions — which include the agreement, this DPA, and Customer's configuration and use of the Service — unless required by applicable law. If RentMy believes an instruction violates Data Protection Law, it will inform Customer promptly.

RentMy will take reasonable steps to ensure the reliability and competence of personnel authorized to process Customer Personal Data.

RentMy will ensure that persons authorized to process Customer Personal Data are bound by appropriate obligations of confidentiality.

RentMy implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as detailed in Annex B.

Customer provides general authorization for RentMy to engage Sub-processors. Annex C lists current Sub-processors. RentMy will enter into written agreements with each Sub-processor imposing data-protection obligations no less protective than those in this DPA, and remains liable to Customer for performance of those obligations.

When transferring Customer Personal Data out of the EEA, UK, or Switzerland to countries not recognized as providing an adequate level of data protection, RentMy will rely on EU Standard Contractual Clauses (2021/914 Module 2/3), the UK International Data Transfer Addendum, or the EU-US Data Privacy Framework.

Taking into account the nature of processing, RentMy will assist Customer by appropriate technical and organizational measures, insofar as possible, to fulfill Customer's obligation to respond to requests from Data Subjects exercising their rights under Data Protection Law.

RentMy will notify Customer without undue delay (and in any event within 48 hours) after becoming aware of a confirmed Personal Data Breach affecting Customer Personal Data, and will provide reasonable cooperation and information to assist Customer with its notification obligations.

RentMy will make available to Customer information reasonably necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits conducted by Customer or an independent auditor mandated by Customer, subject to reasonable notice and confidentiality safeguards.

Upon termination of the Service, RentMy will, at Customer's choice, delete or return all Customer Personal Data within 30 days, unless applicable law requires continued retention.

Each party's liability under this DPA is subject to the exclusions and limitations of liability set forth in the agreement.

This DPA will remain in effect for as long as RentMy processes Customer Personal Data on Customer's behalf.

In the event of any conflict between this DPA and the underlying agreement, the terms of this DPA will prevail regarding data-protection obligations.

Subject matter & duration: Provision of the RentMy rental-management platform during the agreement term.
Categories of data: Contact details, order histories, booking preferences, rental communications, payment tokens.
Data subjects: Customer employees, team members, and end-renters.

Encryption in transit (TLS 1.2+) and at rest (AES-256), regular vulnerability scanning, multi-factor authentication, strictly controlled staff access, and continuous security monitoring.

AWS (infrastructure), Google Cloud (analytics & storage), Postmark/SendGrid (transactional email), Stripe/Square (payment processing), HubSpot (customer support).

For questions or counter-signed DPA requests, email hello@rentmy.co.