Data Processing Addendum (DPA)

This Data Processing Addendum ("DPA") is part of the Rennt Terms of Service between Bynum Enterprises ("Rennt," "we" or "us") and the rental company using the Service ("Customer" or "you"). It covers personal information about your customers and staff that Rennt processes on your behalf.

How it takes effect. This DPA is accepted when you create an account or use the Service, and lasts as long as we process Customer Personal Data. If you need a signed copy for your records, email support@rennt.app and we will send you a countersigned copy of this DPA. If this DPA conflicts with the Terms, this DPA controls for personal data.

1. Definitions

• "Customer Personal Data" means personal information that you or your customers submit to the Service and that Rennt processes on your behalf.
• "Data Protection Laws" means U.S. privacy and data security laws that apply to the processing, including the California Consumer Privacy Act as amended (CCPA/CPRA), the Texas Data Privacy and Security Act (TDPSA), and similar state laws.
• "Subprocessor" means a vendor Rennt uses that processes Customer Personal Data.
• "Security Incident" means a confirmed breach of security leading to accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Customer Personal Data.
• "Controller," "processor," "business," "service provider," "consumer" and similar terms have the meanings given in the Data Protection Laws.

2. Roles

You are the controller (or "business") for Customer Personal Data. Rennt is your processor (or "service provider"). You are responsible for having a lawful basis and any notices and consents needed for the data you put into the Service, including consent for any text messages you send.

3. Details of the processing

• Subject matter and purpose: providing the Rennt booking platform — storefronts, availability, bookings, quotes, rental agreements and e-signatures, payments tracking, deliveries, messaging, AI assistance, analytics and support — as described in the Terms.
• Nature of processing: collecting, storing, organizing, displaying, transmitting, analyzing, backing up and deleting data.
• Duration: for the term of your account, plus the deletion period in section 10.
• People involved: your customers and prospective customers (renters), people who chat with your storefront assistant, and your staff and team members.
• Types of data: names, email addresses, phone numbers, delivery and event addresses, event dates and details, booking and quote history, notes and documents you upload, e-signature data (typed name, optional drawn signature image, date and time), text-message consent records, chat transcripts, storefront usage data, and payment status with card brand and last four digits. Rennt does not process full card numbers. The Service is not designed for sensitive data such as health information, government ID numbers or financial account numbers, and you agree not to submit them.

4. Processing only on your instructions

Rennt will process Customer Personal Data only to provide the Service and on your documented instructions. The Terms, this DPA, and your settings and actions in the Service are your instructions. If we believe an instruction breaks the law, we will tell you. We may also process data where the law requires it; if so, we will tell you first unless the law forbids it.

5. Confidentiality

Anyone at Rennt who can access Customer Personal Data is bound by a duty of confidentiality and accesses it only as needed to provide, secure or support the Service.

6. Subprocessors

• You authorize Rennt to use the Subprocessors listed on our Subprocessors page.
• We will give at least 30 days' notice before adding or replacing a Subprocessor, by updating that page and emailing account owners.
• You may object on reasonable data-protection grounds within that 30 days. If we cannot reasonably address the objection, you may cancel the affected Service and receive a refund of any prepaid fees for the period after cancellation.
• Each Subprocessor is bound by written terms that protect the data at least as well as this DPA. Rennt remains responsible for its Subprocessors' performance.
• Tools you connect yourself (for example your own Stripe, Twilio, Mailchimp, QuickBooks or Google Analytics account) are your vendors, not Rennt's Subprocessors.

7. Security

Rennt maintains reasonable administrative, technical and physical safeguards appropriate to the nature of the data, as described on our Security page, including database-level isolation of each customer's data (row level security), encryption in transit and at rest, least-privilege access to production keys, rate limiting, backups, and monitoring. These safeguards also apply to data processed through Rennt's AI features. We may improve these measures over time but will not materially reduce the overall level of protection.

8. Security Incident notice

Rennt will notify you without undue delay and within 72 hours after confirming a Security Incident affecting your Customer Personal Data, by email to your account owner. We will tell you, as far as we know: what happened, the types of data and approximate number of people involved, the likely consequences, what we have done and will do to contain it, and a contact for more information. We will update you as we learn more and reasonably help you meet your own notice duties to individuals and regulators (for example, Texas requires notice to individuals within 60 days and to the Attorney General within 30 days when 250 or more Texans are affected). Our notice is not an admission of fault.

9. Helping you respond to requests

• The Service lets you view, edit, export and delete customer records yourself. If you need more help responding to a consumer's request to access, correct, delete or port their data, or to opt out, we will help within a reasonable time.
• If a consumer contacts Rennt directly about your data, we will forward the request to you and will not respond ourselves except to direct them to you, unless the law requires otherwise.
• We will give you information reasonably needed for any data protection assessment you must perform, and help with the security of data processed by our systems, including our AI features.

10. Deletion and return

You can export your bookings, customers and inventory as CSV files at any time. Within 30 days after your account ends, Rennt will delete Customer Personal Data from our active systems, or return it to you first if you ask in writing before the account ends. Copies in encrypted backups are deleted as those backups expire on our providers' normal schedule and are protected under this DPA until then. We may keep data where the law requires it, and will continue to protect it.

11. Audits

Once a year (or after a Security Incident), you may ask us to complete a reasonable written security questionnaire about our handling of Customer Personal Data, and we will answer it in good faith within 30 days. Where available, we will also share our vendors' security reports or summaries that they permit us to share. If the law requires more, we will cooperate with a reasonable, mutually agreed assessment at your cost, on reasonable notice and under confidentiality.

12. Where data is processed

Customer Personal Data is stored in the United States (our primary database is hosted in a U.S. region). Some Subprocessors may process data in other locations as described on the Subprocessors page. The Service is designed for U.S. businesses; if you need to transfer data from outside the United States, contact us first.

13. California, Texas and other state-law terms

To the extent Data Protection Laws apply, Rennt:

• processes Customer Personal Data only for the limited and specified business purposes in section 3;
• will not sell or share it (as those terms are defined in the CCPA), or use it for targeted advertising;
• will not keep, use or disclose it outside our direct business relationship with you or for any purpose other than those in this DPA, except as the law permits;
• will not combine it with personal information we get from other sources, except as the law permits for service providers;
• will comply with applicable Data Protection Laws and provide the same level of privacy protection they require;
• will tell you if we decide we can no longer meet our obligations, and you may then take reasonable and appropriate steps to stop and remediate unauthorized use;
• grants you the right to take reasonable steps to ensure we use the data consistently with your obligations; and
• flows these obligations down to Subprocessors by written contract.

For the Texas Data Privacy and Security Act, this DPA sets out the instructions, nature and purpose of processing, types of data, duration, confidentiality, deletion and return, assistance, audit (section 11) and subcontractor terms required of a processor.

14. Liability

Each party's liability under this DPA is subject to the limitations in the Terms, except where the law does not allow it.

15. Contact

Bynum Enterprises (Rennt), Texas, United States · support@rennt.app (privacy questions, signed copies and security notices).