Rentavoq data processing addendum

This Data Processing Addendum ("DPA") supplements and forms part of the Operator Subscription Agreement and/or the Terms of Service (the "Agreement") between Rentavoq [final legal entity name to be confirmed] ("Rentavoq," "Processor/Service Provider") and the operator customer ("Operator," "Business/Controller"). In case of conflict on data-protection matters, this DPA controls.

1. Definitions

• "Applicable Data Protection Laws" — U.S. state privacy laws applicable to the processing, including the CCPA/CPRA and the Indiana Consumer Data Protection Act, and any other laws that apply.
• "Personal Information" / "Personal Data" — information relating to an identified or identifiable individual (including renters) processed by Rentavoq on Operator's behalf.
• "Sensitive Personal Information" — includes precise geolocation, government-ID data, and biometric information as defined by Applicable Data Protection Laws.
• "Processing," "Business," "Service Provider," "Controller," "Processor," "Sale," "Share," "Consumer" — as defined by Applicable Data Protection Laws.
• "Subprocessor" — a third party engaged by Rentavoq to process Personal Information.
• "Renter Personal Data" — Personal Information about Operator's renters and end users.

This DPA assumes U.S.-based processing under U.S. state privacy laws; it is not a GDPR-complete DPA. See Section 12 for non-U.S. data.

2. Roles and scope

2.1 For Renter Personal Data processed under the Agreement, Operator is the Business/Controller and Rentavoq is the Service Provider/Processor.

2.2 Rentavoq will process Personal Information only on Operator's documented instructions (including as set out in the Agreement and Documentation) to provide the Platform, and for no other purpose.

2.3 Details of processing (subject matter, duration, nature and purpose, categories of data and data subjects) are described in Annex A.

3. Service provider / processor obligations

Rentavoq will:

3.1 Not sell or share Personal Information, and not retain, use, or disclose it (a) for any purpose other than the business purposes specified in the Agreement, or (b) outside the direct business relationship, except as permitted by Applicable Data Protection Laws.

3.2 Not combine Personal Information received from Operator with data from other sources, except as permitted for a service provider under Applicable Data Protection Laws.

3.3 Comply with obligations applicable to a service provider/processor and provide the same level of privacy protection required of Operator.

3.4 Notify Operator if Rentavoq determines it can no longer meet its obligations, and Operator may take reasonable steps to stop and remediate unauthorized processing.

3.5 Assist Operator with (a) responding to consumer rights requests; (b) security, breach notification, and, where applicable, data-protection impact assessments; and (c) reasonable steps Operator takes to ensure Rentavoq's compliant use of Personal Information.

4. Consumer rights requests

4.1 Rentavoq will, taking into account the nature of processing, provide reasonable assistance to enable Operator to fulfill renter requests to access, correct, delete, port, opt out, or limit use of Sensitive Personal Information.

4.2 If Rentavoq receives a request directly from a renter, it will forward the request to Operator and not respond except to confirm receipt or as legally required.

5. Confidentiality and personnel

Rentavoq will ensure personnel authorized to process Personal Information are bound by confidentiality and receive appropriate training, and will limit access on a need-to-know basis.

6. Security

6.1 Rentavoq will implement and maintain reasonable and appropriate administrative, technical, organizational, and physical safeguards designed to protect Personal Information, including encryption in transit and at rest, access controls, logging and monitoring, secure development, vulnerability management, and vendor risk management.

6.2 Security measures are further described in Annex B. Rentavoq may update measures provided protection is not materially diminished.

7. Subprocessors

7.1 Operator authorizes Rentavoq to engage Subprocessors to process Personal Information. Current Subprocessors are listed in Annex C.

7.2 Rentavoq will (a) impose data-protection obligations on each Subprocessor no less protective than this DPA, and (b) remain responsible for its Subprocessors' performance.

7.3 Rentavoq will provide advance notice of new or replacement Subprocessors [notice channel and period to be confirmed], and Operator may object on reasonable data-protection grounds; the parties will work in good faith to resolve the objection, and absent resolution Operator may terminate the affected service.

8. Security incidents

8.1 Rentavoq will notify Operator without undue delay — with a 72-hour target, or as required by law [timing to be confirmed with counsel] — after becoming aware of a security incident affecting Operator's Personal Information.

8.2 Notice will include available information about the nature of the incident, the categories and approximate number of records affected, likely consequences, and remediation. Rentavoq will reasonably cooperate with Operator's investigation and legally required notifications.

8.3 Rentavoq's notice is not an acknowledgment of fault or liability.

9. Audits and compliance

9.1 Rentavoq will make available information reasonably necessary to demonstrate compliance, which may be satisfied via third-party audit reports or certifications where available.

9.2 On reasonable prior notice, and subject to confidentiality, Operator may conduct or commission a reasonable audit limited in scope and frequency, at Operator's expense, in a manner that does not disrupt operations.

10. Sensitive data (biometric, geolocation, ID)

10.1 The parties acknowledge processing of Sensitive Personal Information, including biometric identifiers (from ID and selfie verification), precise geolocation and telematics data, and government-ID data.

10.2 Operator is responsible for providing required notices and obtaining any required consents from renters and drivers for Sensitive Personal Information. Rentavoq will process such data only as needed to provide the Platform and per any applicable retention limits.

11. Data retention, return, and deletion

11.1 Rentavoq will retain Personal Information only for the duration necessary to provide the Platform or as required by law.

11.2 Upon termination, Rentavoq will, at Operator's option, return and/or delete Personal Information within 30 days, except where retention is required by law or for backups deleted on a rolling basis.

12. International transfers

This DPA assumes U.S.-based processing. If Personal Information originating outside the U.S. (for example EU or UK data) is in scope, the parties will execute an addendum incorporating applicable transfer mechanisms (for example Standard Contractual Clauses).

13. Liability and term

13.1 Each party's liability under this DPA is subject to the limitations of liability in the Agreement.

13.2 This DPA is effective for as long as Rentavoq processes Personal Information on Operator's behalf and survives termination until deletion or return is complete.

Annex A — details of processing

• Subject matter: provision of the Rentavoq rental-operations Platform.
• Duration: the Subscription Term plus the retention and deletion period.
• Nature and purpose: hosting, storing, and processing renter and rental data to enable bookings, payments, identity and insurance verification, telematics, inspections, claims, messaging, and analytics.
• Categories of data subjects: renters and end users; operator personnel; drivers.
• Categories of Personal Information: identifiers and contact data; driver's license and government-ID data; biometric or biometric-derived identifiers (verification); insurance data; payment data (tokenized via Stripe); booking and rental records; inspection, damage, and claims data; precise geolocation and telematics data; communications (SMS and email); device and usage data.
• Sensitive data: biometric identifiers, precise geolocation, government-ID data.

Annex B — technical and organizational security measures

Rentavoq's measures include, at minimum, the safeguards described on the security page:

• Tenant isolation enforced with Postgres row-level security below the ORM, with an automated multi-tenant isolation test that runs in CI and fails the build on any cross-tenant leak.
• Append-only, immutable evidence and audit records for verification checks, claims, and privileged admin actions; MFA is required on all admin logins.
• Encryption in transit (TLS 1.2+) and at rest (AES-256); column-level encryption for sensitive fields such as driver's-license numbers and dates of birth; secrets kept in a vault with rotation.
• PCI SAQ A payment posture: card data is entered into and stored by Stripe; Rentavoq never stores full card numbers.
• Biometric data minimization: verification biometrics remain with the verification provider and are referenced by identifier, not copied into Rentavoq.

[The complete annex is being finalized with counsel and will be published before execution.]

Annex C — authorized subprocessors

[Entity legal names, purposes, and locations to be confirmed before execution.]