Data Processing Addendum

This Data Processing Addendum (the “DPA”) applies when a company or other organisation (the “Customer”) uses a Renew Reminder business workspace. It forms part of the agreement between the Customer and Renew Reminder under our Terms of Service (the “Terms”), and covers the Customer Personal Data that Renew Reminder processes to provide the workspace. The Customer accepts this DPA when the person who creates its workspace, its first Admin, accepts the Terms on its behalf. If the Customer needs a signed copy, it can ask us at support@renewreminder.com.

The parties to this DPA are:

• The Customer, identified by the details of its workspace's Admins and, once it pays for a plan, the billing details given at checkout; and
• Renew Reminder, meaning Onda Software Solutions LLC, the operator of the Services as the Terms define it, of 83 Chuparrosa Dr, San Luis Obispo, CA 93401-7411, USA.

This DPA does not cover a person's own personal account. For a personal account, Renew Reminder is the controller, as our Privacy Policy explains.

• “Data Protection Laws” means the laws on the processing of personal data that apply to a party's processing under the Terms. Depending on where the Customer and the people concerned are, these may include the EU General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”), the GDPR as it forms part of UK law together with the UK Data Protection Act 2018 (the “UK GDPR”), the Swiss Federal Act on Data Protection (the “FADP”), and US state privacy laws such as the California Consumer Privacy Act.
• “Customer Personal Data” means personal data that the Customer, or the people it invites to its workspace, put into the workspace, and that Renew Reminder processes on the Customer's behalf to provide it.
• “Admin” and “Member” are the two roles a person can hold in a workspace. Admins manage the workspace and its members. One Admin, the “Admin who handles billing”, holds the workspace's plan; they are the person who created the workspace or the person it was handed over to, and only they can change roles, remove members or delete the workspace.
• “Sub-processor” means a third party that Renew Reminder engages to process Customer Personal Data.
• “Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
• “SCCs” means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914.
• “Controller”, “processor”, “data subject”, “personal data”, “processing” and “supervisory authority” have the meanings the GDPR gives them. Other capitalised terms have the meanings the Terms give them.

For Customer Personal Data, the Customer is the controller, or a processor acting for another controller, and Renew Reminder is its processor, or sub-processor. Under the California Consumer Privacy Act and similar US state laws, Renew Reminder is the Customer's service provider or processor.

Renew Reminder is an independent controller, not a processor, of: the account details of each person who signs in to Renew Reminder; the workspace's billing and payment records; and the security, diagnostic and product-usage data we collect to run, protect and improve the Services. We handle that data under our Privacy Policy, not this DPA.

The Customer is responsible for having a lawful basis for the Customer Personal Data it puts into the workspace, for the instructions it gives us, and for giving the people whose data it adds any notice the law requires.

As a service provider under US state privacy laws, Renew Reminder will not sell or share Customer Personal Data; will not retain, use or disclose it for any purpose other than providing the Services to the Customer, or outside its direct business relationship with the Customer; and will not combine it with personal data it receives from other sources, except as those laws allow.

This section also completes Annex I.B of the SCCs where section 13 applies.

4.1Subject matter and duration

Providing the business workspace features of Renew Reminder to the Customer, for as long as the Customer has a workspace, and then until the data is deleted or returned under section 11. Processing is continuous while the workspace is in use.

4.2Nature and purpose

Storing, organising and showing to the workspace's members the Customer's vendors, subscriptions and contracts, and its recurring spend by owner and category; sending renewal and notice-period reminders by email and push notification to the workspace's Admins and to the Member who owns a vendor and, where reminders are turned on for an owner tag that has an email address, by email to the person named in it, who can answer Keep or Cancel; on the Business plan, telling the Admins when an owner has not answered, emailing the Admins a monthly spend report, flagging vendors that overlap, and sending text-message alerts to Admins who turn them on; managing the workspace's members, roles and invitations; matching charges from bank accounts and cards that Admins link to the workspace through Plaid; adding vendors from the rows of a spreadsheet the Customer imports; storing the contract documents (PDF files) the Customer attaches to a vendor and letting the members who can see that vendor download them; reading receipts and documents and answering questions with our AI assistant when a member chooses to use it; giving the Customer's own systems access through API keys its Admins create; and the support, security and troubleshooting needed to provide these.

4.3Categories of data subjects

• The workspace's Admins and Members, and people invited to join it.
• People named in owner tags, who need not use Renew Reminder themselves, such as the Customer's staff and contractors responsible for a vendor.
• Contacts at the Customer's vendors that it adds to a vendor record, such as an account manager or a billing contact.
• Any other people the Customer chooses to name in a vendor record, for example in its notes.

4.4Categories of personal data

• Names, email addresses and roles (Admin or Member) of workspace members and invitees, who invited them and when, any department labels the Customer gives them, and the phone numbers of Admins who turn on text-message alerts.
• Owner tags: the name of the person responsible for a vendor and, if the Customer adds it, their email address, whether reminders to them are turned on, whether they have unsubscribed, and their answers (Keep or Cancel) to renewal notices.
• Vendor contacts: up to ten per vendor, each with a name and, if the Customer adds them, a role, an email address and a phone number. We do not contact them; they are shown to the workspace's members so they can reach the vendor.
• Vendor records: the vendor, its cost and currency, billing cycle, renewal date, notice period, category, contract details, who owns it, and any notes, decisions and change history recorded on it.
• If an Admin links a bank account or card to the workspace: account names, types and balances, and transaction history (merchant, amount and date).
• The rows of a spreadsheet imported to add vendors (the file itself is read in the browser and not sent to us), receipts and documents uploaded to add vendors, and messages sent to our AI assistant in the workspace.
• Contract documents attached to a vendor: the PDF file itself, which may name the people who signed it or are named in it, and its file name, size, the date it was added and who added it. We store them privately and never read or change their contents.
• Reminders, escalations and spend reports sent about workspace vendors: to whom, by which channel and when.

4.5Sensitive data

The workspace is not designed for special categories of personal data, such as health data, or for government identifiers, and the Customer agrees not to put them in it.

Renew Reminder processes Customer Personal Data only on the Customer's documented instructions. Those instructions are: the Terms and this DPA; the Customer's use and configuration of the workspace, including the choices its Admins make in it; and any other written instruction the Customer gives that we agree is consistent with the Terms. We may also process Customer Personal Data where the law requires us to; if so, we will tell the Customer before we do, unless that law forbids it.

We will tell the Customer promptly if, in our opinion, an instruction infringes Data Protection Laws, and we may decline to follow it until it is withdrawn or changed.

Renew Reminder makes sure that everyone it authorises to process Customer Personal Data, including its staff and contractors, is bound by a duty of confidentiality, and gives access only to those who need it to provide, support or secure the Services.

Renew Reminder implements appropriate technical and organisational measures to protect Customer Personal Data, taking into account the state of the art, the cost of implementation, the nature, scope, context and purposes of the processing, and the risks to people. Our current measures are described on our Security page, which, with this section, completes Annex II of the SCCs. They include:

• Encryption of every connection to the Services with TLS.
• Storage in MongoDB Atlas, which encrypts stored data with 256-bit AES.
• Passwords stored only as bcrypt hashes.
• Bank-connection tokens and Google account tokens encrypted with AES-256-GCM, under keys kept outside the database.
• Read-only bank access through Plaid. We never receive bank credentials.
• Access to workspace data checked on the server, on every request, against the person's membership of that workspace and their role in it.
• Email verification at sign-up, rate limits on sign-in, registration, verification codes and password resets, an email when a new device signs in, and every other session signed out when a password changes.

We may update these measures over time, provided an update does not lower the overall level of protection. As our Security page says, we do not yet hold a SOC 2 report or another third-party certification.

The Customer gives Renew Reminder general authorisation to engage Sub-processors. Our current Sub-processors, with what each does, the data it handles and where, are listed on our sub-processors page, which completes Annex III of the SCCs.

We put each Sub-processor under data protection obligations that protect Customer Personal Data to the standard this DPA requires, and we remain responsible to the Customer for how each Sub-processor meets them.

We will give notice of a new Sub-processor, or of a material change in what an existing one does, at least 30 days before it starts processing Customer Personal Data, by updating the sub-processors page and emailing the Admins of each workspace. The Customer may object on reasonable data protection grounds by writing to us within that period. We will then work with the Customer in good faith to resolve the objection. If we cannot, the Customer may end its business plan, and we will refund any fees it has paid for the period after the change takes effect.

If a Sub-processor has to be replaced urgently to keep the Services running or secure, we may give shorter notice, and will give it as soon as we reasonably can.

Inside the Services, while the workspace has a plan or a free trial running, its Admins can view, correct and delete its vendor records and owner tags. At any time, Admins can withdraw invitations, the Admin who handles billing can remove members, and a person tagged as a vendor's owner can stop renewal notices with the unsubscribe link in any of them. An address that has unsubscribed stays on the workspace's unsubscribe list, so that it is not emailed again, until the workspace is deleted. Taking into account the nature of the processing, we will also help the Customer, by appropriate technical and organisational measures, to respond to requests from people exercising their rights under Data Protection Laws.

If we receive such a request directly and it concerns Customer Personal Data, we will pass it to the Customer without undue delay. We will not answer it ourselves, other than to tell the person to contact the Customer, unless the Customer authorises us to or the law requires it.

We will also give the Customer reasonable help, taking into account the information available to us, with data protection impact assessments and prior consultations with supervisory authorities that concern the workspace.

If we become aware of a Security Incident, we will notify the Customer without undue delay, by email to the workspace's Admins. The notice will describe, as far as we then know: the nature of the incident; the categories and approximate number of people and records concerned; its likely consequences; and the measures we have taken or propose to take. Where we cannot give all of this at once, we will give it in stages as we learn it. We will take reasonable steps to contain and investigate the incident and to reduce its effects, and we will help the Customer meet its own obligations to notify supervisory authorities and the people affected.

Notifying the Customer of a Security Incident is not an admission of fault. Attempts that do not compromise the security of Customer Personal Data, such as blocked sign-in attempts, are not Security Incidents.

While the workspace has a plan or a free trial running, its Admins can see the Customer Personal Data in it and delete it at any time, and can download a PDF of its vendor records from the app. If the Customer wants a copy of its workspace data in another commonly used electronic format, it can ask us at support@renewreminder.com and we will provide one.

Only the Admin who handles billing can delete the workspace. When they do, its plan is cancelled and everyone loses access to it. Each vendor record still in it leaves the workspace, without its owner tag, vendor contacts or contract documents (the documents are deleted), and stays in the personal account of the member who holds it, usually the person who added it or took it over, as our Privacy Policy describes. Bank accounts and cards linked to the workspace, with the transactions imported from them, go back to the personal accounts of the people who linked them, and conversations with our AI assistant held in the workspace go back to the people who had them. The workspace's budgets, categories, usage records and unsubscribe list are deleted, and its API keys and open invitations are cancelled. By deleting the workspace, the Customer instructs us to leave those records with those members.

Two records remain after a workspace is deleted: a list of who was a member of it or was invited to it, with their role and the dates, kept as an audit trail; and a log of each reminder, escalation and report we sent for it, saying to whom, by which channel and when, which is deleted automatically 400 days after each send.

If the Customer wants Customer Personal Data deleted instead, it should delete the records before deleting the workspace, or ask us in writing before it deletes the workspace, and we will delete them, together with the two records above, within 30 days of the request.

If the Customer's free trial or business plan ends without the workspace being deleted, the workspace becomes read-only until the Admin who handles billing chooses a plan, and nothing in it is deleted. While it is read-only, Admins cannot edit or delete individual vendor records, but members can still be removed, records can be moved out of it, and the workspace can still be deleted; the Customer can also ask us to delete Customer Personal Data as this section describes. Renewal reminders keep going to its Admins and to Members who own a vendor, but not to people named in owner tags. If a free trial ends without a plan being chosen, bank and card connections linked to the workspace may be disconnected at the end of a calendar month, at least seven days after we email the Admin who handles billing that the trial has ended. The transactions already imported from them are kept.

Copies held by Sub-processors under their own retention, such as email delivery logs, are deleted on their normal cycle, and copies in our database backups are removed as those backups expire. We may keep Customer Personal Data where the law requires us to, and then only for as long as it requires; we will keep it confidential and process it for no other purpose.

We will make available to the Customer the information reasonably necessary to demonstrate compliance with this DPA and with Article 28 of the GDPR. In the first instance we do this by answering a reasonable written security or privacy questionnaire, once a year, or more often if a Security Incident or a supervisory authority requires it.

If that information is not enough to demonstrate compliance, or a supervisory authority requires it, the Customer may audit our compliance with this DPA, itself or through an independent auditor bound by confidentiality. Audits need at least 30 days' written notice, take place during normal business hours, must not disrupt our operations or give access to other customers' data, and are at the Customer's own cost. Sub-processors are audited through the information and reports they make available.

Renew Reminder is based in the United States, and its Sub-processors process Customer Personal Data in the places listed on our sub-processors page, which include the European Union and the United States. Where processing involves a transfer of Customer Personal Data that Data Protection Laws restrict, from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, the parties agree to the following.

• From the European Economic Area: the SCCs are incorporated into this DPA by reference, using Module Two (controller to processor) where the Customer is a controller, and Module Three (processor to processor) where it is a processor. Clause 7 (the docking clause) applies. In Clause 9, Option 2 (general written authorisation) applies, with the notice period in section 8. The optional wording in Clause 11 does not apply. In Clause 13, the competent supervisory authority is the one that Clause 13 identifies for the Customer. In Clauses 17 and 18, the governing law and the courts are those of Ireland. Annex I is completed by sections 1 and 4 of this DPA, Annex II by section 7 and our Security page, and Annex III by our sub-processors page.
• From the United Kingdom: the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner (version B1.0) applies, completed with the information above. Either party may end it as its Section 19 allows.
• From Switzerland: the SCCs apply with the changes the FADP requires. References to the GDPR are read as references to the FADP where it applies, the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for transfers under the FADP, and “member state” includes Switzerland, so that people there can bring claims where they live.

If the SCCs conflict with this DPA, the SCCs prevail for the transfers they cover. If a transfer mechanism is invalidated or replaced, we will work with the Customer to put an appropriate alternative in place.

This DPA applies for as long as Renew Reminder processes Customer Personal Data, and ends when that processing ends under section 11. If this DPA conflicts with the Terms, this DPA prevails as to the processing of Customer Personal Data.

Except as section 13 provides for the SCCs, this DPA is governed by the law, and disputes about it are resolved in the courts, set out in section 21 of the Terms.

We may update this DPA as the law or the Services change. We will not reduce the protection it gives Customer Personal Data without the Customer's agreement unless the law requires it, and we will tell workspace Admins about a material change in the way section 22 of the Terms describes.

Questions about this DPA, a request under it, or a request for a signed copy: write to support@renewreminder.com. This is also our contact for data protection matters.