Data Processing Addendum

1. Introduction

This Data Processing Addendum ("DPA") forms part of the agreement (whether a signed Order Form or our online Terms & Conditions) between Renterval LLC, operating as University Rec Rentals ("University Rec Rentals", "Processor"), and the Customer identified in that agreement ("Customer", "Controller", "you"). It governs University Rec Rentals' processing of Personal Data on Customer's behalf in connection with the University Rec Rentals platform (the "Service").

If you require a counter-signed copy of this DPA for your records, email info@universityrecrentals.com with the legal name of your entity.

2. Definitions

• "Personal Data", "Processing", "Controller", "Processor", "Data Subject", "Supervisory Authority" — have the meanings given in the GDPR.
• "Applicable Data Protection Law" — the GDPR, the UK-GDPR, the Swiss FADP, the CCPA/CPRA, and any other privacy or data-protection law that applies to the parties.
• "Customer Personal Data" — Personal Data that the Customer or its end-customers (Renters) submit to the Service.
• "Sub-processor" — a third party engaged by University Rec Rentals to process Customer Personal Data.
• "SCCs" — the Standard Contractual Clauses adopted by the European Commission under Decision 2021/914 of 4 June 2021.
• "UK IDTA" — the UK Information Commissioner's International Data Transfer Addendum to the SCCs.

3. Roles & scope of processing

For the Service, the parties acknowledge that:

• Customer is the Controller (and where applicable, a "Business" under the CCPA/CPRA) of Customer Personal Data.
• University Rec Rentals is the Processor (and where applicable, a "Service Provider" under the CCPA/CPRA) acting on Customer's documented instructions.
• Each party complies with its obligations under Applicable Data Protection Law.

The subject matter, duration, nature, purpose, types of Personal Data, and categories of Data Subjects are set out in Annex A.

4. Customer instructions

University Rec Rentals will process Customer Personal Data only on Customer's documented instructions, including transfers to a third country, unless required to do so by Union or Member State law to which University Rec Rentals is subject. The Service Agreement (including this DPA, the configuration choices Customer makes in the Service, and any written instructions Customer provides through the support channel) constitute Customer's complete and final instructions to University Rec Rentals.

If University Rec Rentals believes an instruction infringes Applicable Data Protection Law, it will notify Customer promptly and may suspend the relevant processing.

5. University Rec Rentals' obligations as Processor

University Rec Rentals will:

• Process Customer Personal Data only as set out in this DPA, the Agreement, and any documented Customer instructions.
• Implement the technical and organizational measures described in Annex B.
• Ensure that personnel authorized to process Customer Personal Data have committed to confidentiality or are under a statutory obligation of confidentiality.
• Not "sell" or "share" Customer Personal Data within the meaning of the CCPA/CPRA, and not use it for any purpose other than performing the Service or as expressly permitted by Applicable Data Protection Law.
• Provide reasonable assistance to Customer in meeting its obligations under Applicable Data Protection Law (data subject requests, impact assessments, prior consultations).
• Make available all information necessary to demonstrate compliance with this DPA.

6. Confidentiality

University Rec Rentals treats Customer Personal Data as Customer's Confidential Information. Access is granted on a need-to-know basis, with role-based access controls and audit logging. All University Rec Rentals personnel have signed a confidentiality agreement that survives termination of their relationship with University Rec Rentals.

7. Security of processing

Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, University Rec Rentals implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk. These measures include those described in Annex B and may be updated from time to time provided that the level of protection is not materially reduced.

8. Sub-processors

Customer authorizes University Rec Rentals to engage Sub-processors to process Customer Personal Data, subject to the terms of this DPA. The current list is in Annex C.

University Rec Rentals will:

• Enter into a written agreement with each Sub-processor that imposes data-protection obligations no less protective than those in this DPA.
• Remain responsible for the acts and omissions of its Sub-processors.
• Notify Customer of any new Sub-processor (by updating the list in Annex C and, on request, by email) at least 30 days before the new Sub-processor begins processing Customer Personal Data.
• Allow Customers to object on reasonable data-protection grounds within that 30-day window. If University Rec Rentals cannot reasonably address Customer's concerns, Customer may terminate the affected portion of the Service for cause.

9. International data transfers

University Rec Rentals may transfer Customer Personal Data outside the EEA, UK, or Switzerland to University Rec Rentals or a Sub-processor in the United States or another country, subject to one of the following safeguards:

• The European Commission's Standard Contractual Clauses (Module 2 or Module 3 as applicable, plus the UK IDTA where the transfer is from the UK), which are incorporated into this DPA by reference and take effect upon such transfer.
• The EU-US Data Privacy Framework (and UK extension) where the recipient is certified.
• An adequacy decision by the European Commission or the UK Secretary of State, where applicable.

Where the SCCs apply, the parties select: Module 2 (Controller-to-Processor) for transfers from Controller-Customer to Processor-University Rec Rentals; Option 2 / general written authorization for sub-processor changes (with 30 days' notice); Option 1 of Clause 17 (governing law of an EU Member State); and Option 1 of Clause 18 (jurisdiction of an EU Member State court). For UK transfers, the UK IDTA applies as an addendum to the SCCs.

10. Data subject rights

Taking into account the nature of the processing, University Rec Rentals will assist Customer by appropriate technical and organizational measures, insofar as possible, in fulfilling Customer's obligation to respond to requests by Data Subjects exercising their rights under Applicable Data Protection Law. If University Rec Rentals receives a request from a Data Subject directly, it will not respond to the request itself but will forward it to Customer without undue delay.

11. Personal data breach

University Rec Rentals will notify Customer without undue delay (and in any event within 72 hours) of becoming aware of a Personal Data Breach affecting Customer Personal Data. The notification will include, to the extent reasonably available at the time: the nature of the breach, the categories and approximate number of Data Subjects and records concerned, likely consequences, and the measures taken or proposed to address the breach.

University Rec Rentals will provide reasonable assistance to customers in fulfilling its own obligations to notify Supervisory Authorities and Data Subjects under Applicable Data Protection Law.

12. Audits & inspections

University Rec Rentals will make available, upon Customer's reasonable request, information necessary to demonstrate compliance with this DPA, including third-party audit reports (e.g. SOC 2 Type II, ISO 27001) where available. If those reports are insufficient to verify compliance, Customer may, no more than once per twelve-month period and on at least 30 days' written notice, conduct an audit at Customer's expense. The audit may not unreasonably interfere with University Rec Rentals' business activities and must respect the confidentiality of other University Rec Rentals customers.

13. Return & deletion of Personal Data

On termination or expiry of the Service, Customer may export Customer Personal Data using the in-app export tool for up to 30 days. After that period, University Rec Rentals will delete or anonymize all Customer Personal Data (including copies held by Sub-processors), except where retention is required by Applicable Data Protection Law (e.g. for billing, anti-fraud, or legal-hold purposes), in which case University Rec Rentals will continue to protect that data in accordance with this DPA.

14. Liability

The liability of each party arising from or in connection with this DPA is subject to the limitations and exclusions of liability set forth in the underlying Service Agreement, except where prohibited by Applicable Data Protection Law.

15. Term & termination

This DPA takes effect on the effective date of the Service Agreement and remains in force for as long as University Rec Rentals processes Customer Personal Data. Sections that by their nature should survive termination (including §13) will survive.

16. General

• Governing law. The governing law and jurisdiction of the Service Agreement apply to this DPA, except where the SCCs or other Applicable Data Protection Law dictate otherwise.
• Modifications. University Rec Rentals may update this DPA from time to time provided the level of protection is not materially reduced.
• Severability. If any provision is unenforceable, the remainder remains in effect.

Annex A — Details of Processing

Subject matter

Provision of the University Rec Rentals rental management Service to Customer.

Duration

For the term of the Service Agreement plus the retention periods set out in §13 and the Privacy Policy.

Nature and purpose

Hosting, processing, transmitting, and supporting the Customer's use of the Service: account management, booking and inventory management, payment-related processing, customer communications, analytics, and security.

Categories of Data Subjects

• Customer's authorized users (employees, contractors, agents).
• Customer's end-customers (Renters) who interact with a University Rec Rentals-powered storefront.
• Customer's prospects and contacts entered into the CRM.

Categories of Personal Data

• Identifiers — name, email, phone, billing/shipping address.
• Account credentials — username, hashed passwords, MFA tokens.
• Transactional — order history, rental dates, payment status, tokenized card references (no full card numbers stored).
• Identification documents (only where Customer or its processor requires).
• Communications — email content, SMS content, in-app chat, support tickets.
• Technical metadata — IP address, device identifiers, log data.

Special categories

University Rec Rentals does not solicit special categories of Personal Data. Customers are responsible for not entering such data unless legally permitted and necessary.

Annex B — Technical & Organizational Measures

• Encryption — TLS 1.2+ in transit; AES-256 at rest for production databases and object storage.
• Access control — least-privilege, role-based access; mandatory MFA for all University Rec Rentals personnel; quarterly access reviews; immediate revocation on departure.
• Network security — VPC isolation, restrictive security groups, WAF, DDoS mitigation, no public database endpoints.
• Application security — secure SDLC, mandatory code review, automated dependency scanning, SAST and DAST, periodic third-party penetration testing.
• Vulnerability management — coordinated disclosure program, severity-based SLAs for patching, regular patching cadence.
• Backups & resilience — encrypted automated backups with tested restoration procedures; multi-AZ redundancy.
• Incident response — documented runbook, on-call rotation, post-incident reviews, breach-notification process aligned with §11.
• Personnel — security awareness training at hire and annually; background checks for personnel with elevated access.
• Vendor management — security review and DPA execution before onboarding any Sub-processor.
• Logging & monitoring — centralized logging, anomaly detection, immutable audit trails for access to Customer Personal Data.

Annex C — List of Sub-processors

University Rec Rentals uses the following Sub-processors. The list is updated as new Sub-processors are added or removed.

To request notification when this list changes, email info@universityrecrentals.com with the subject line "Sub-processor notifications".

17. Contact us

For DPA questions or to request a counter-signed copy:

• Email: info@universityrecrentals.com
• Phone: + (408) 728-8556

University Rec Rentals is committed to processing your customers' data with the same care we'd want for our own.