Data Processing Addendum

For personal data processed through the Service, the roles are generally as follows:

• Operator as controller. You determine why and how personal data relating to your rental business is processed — including data about your staff, your end customers (renters or bookers), bookings, payments you collect, and documents you upload. You are responsible for having a lawful basis, providing required notices to data subjects, and responding to their requests where you are the controller.
• Kasura as processor. When we store, transmit, display, or otherwise handle personal data solely on your instructions and for the purpose of providing the Service, we act as a processor (or service provider) on your behalf.
• Kasura as independent controller. For certain processing — such as billing your subscription, securing and operating the platform, preventing abuse, and complying with law — Kasura acts as an independent controller. That processing is described in our Privacy Notice and is outside the scope of this DPA.
• End customer relationship. Your end customers interact with your public booking pages and customer portal under your brand. Their contractual relationship for the rental is with you, not with Kasura.

Subject to your subscription plan and configuration, Kasura may process the following categories of personal data on your behalf:

• Identity and contact details for your team members and invited users
• End customer identity, contact, and profile information you collect or they submit
• Booking, rental, and operational records (dates, assets, locations, notes, status)
• Payment-related metadata processed through integrated payment providers (not full card numbers stored by Kasura)
• Documents, images, and messages you or your end customers upload or generate in the Service
• Identity and driving-licence details, dates of birth, addresses, signatures, passport or identity images where submitted for supported rental workflows
• AI prompts, relevant operational context, generated responses, submitted image or PDF attachments, audio for transcription, and evidence of proposed or confirmed operational actions where those features are used
• Technical logs necessary to deliver, secure, and support your workspace

Processing activities include hosting, backup, synchronization, display in dashboards and portals, email or notification delivery you configure, search and reporting within your workspace, and support assistance at your request. We do not sell personal data processed on your behalf.

Kasura processes personal data on your behalf while providing processing services and completing the instructed return or deletion. Subscription cancellation, deactivation, pending account deletion and completed active-data deletion are separate events. Any continued retention must have a specific lawful purpose and remain limited to the data needed for that purpose; it is not a general permission to retain all rental records.

Kasura will process personal data only on documented instructions from you, except where required by applicable law. Your instructions are reflected in:

• Your use of the Service and workspace settings
• The Terms of Service and this DPA
• Written requests to support@kasura.app or legal@kasura.app for specific processing actions

If we believe an instruction infringes applicable data protection law, we will inform you promptly. You are responsible for ensuring that your instructions — including forms, public booking flows, and communications sent through Kasura — comply with law and your privacy obligations toward end customers.

Instructions include supported AI-assisted processing requested by authorised Users. Customer profiles may be shared within one business account; workspace-scoped actions do not create independent controller boundaries. Where law requires processing or disclosure, we will inform you before it occurs where permitted and required by applicable data-protection law. No independent use of rental content is authorised merely by labelling it as support, diagnostics or product improvement.

Operators are responsible for ensuring they have the necessary rights, permissions, and lawful basis to provide personal data to Kasura for processing under this DPA.

Taking into account the nature of the processing and the information available to us, Kasura will provide reasonable assistance to help Operators comply with applicable data protection obligations where required by law. This may include assistance relating to data subject requests, security incidents, data protection impact assessments (where applicable), and reasonable requests from supervisory authorities concerning processing carried out on the Operator's behalf.

Kasura ensures that personnel authorized to process personal data on your behalf are bound by confidentiality obligations appropriate to the nature of the Service. Access is limited to those who need it to operate, maintain, secure, or support the platform, or to comply with law.

We treat personal data processed under this DPA as confidential business information. We do not disclose it to third parties except as permitted by this DPA, the Terms, our Privacy Notice, or applicable law.

Confidentiality obligations continue after employment, contractual relationships, or access rights have ended.

Kasura implements technical and organizational measures designed to protect personal data against unauthorized access, loss, or alteration. These measures are described on our Security page, including access controls, encryption in transit, infrastructure practices, and monitoring.

Kasura personnel access personal data only where reasonably necessary to operate, maintain, secure, support, or improve the Services, investigate security incidents, or comply with applicable legal obligations.

Security is a shared responsibility. You are responsible for safeguarding your account credentials, configuring appropriate team access, and using strong authentication practices. You should only grant workspace access to individuals who need it.

Kasura periodically reviews and updates its technical and organizational measures as the platform evolves, taking into account operational requirements, security risks, and changes to the Services.

You authorize Kasura to engage subprocessors — third-party service providers that process personal data on our behalf — to deliver the Service. Current subprocessors, their roles, and regions are listed on our Subprocessor List page.

We impose binding data-processing obligations on subprocessors requiring appropriate technical and organizational measures to protect personal data and comply with applicable data protection obligations. We remain responsible to you for subprocessors' performance of their data protection obligations, subject to the limitations in the Terms.

We will notify your designated account or privacy contact of intended additions or replacements at least thirty (30) days before a new subprocessor processes your personal data under the regular procedure, identifying its role and relevant locations. We will also update and archive the Subprocessors list. You may raise a reasonable data-protection objection within thirty (30) days of notice. A change must not remove the opportunity to object before the affected processing begins. Contact legal@kasura.app. We will work with you in good faith; if we cannot resolve the objection, you may terminate the affected Service. Kasura will refund the unused prepaid portion of that affected Service for the remaining period, without removing mandatory remedies or applicable transaction rights. Legally required or urgent security changes may need a shorter procedure, with notice as soon as legally permitted, documented reasons and an effective opportunity to raise concerns.

Kasura and its providers may process personal data outside the individual's country, including Singapore, the United States and other locations used for provider delivery and support. Where applicable law requires safeguards for an international transfer, appropriate safeguards required by that law apply. The published Google Cloud, Stripe, Sentry and Resend data-processing terms describe Standard Contractual Clauses and applicable jurisdiction-specific arrangements. Provider terms do not establish that every transfer or every Kasura account uses the same mechanism. No universal adequacy, Data Privacy Framework participation or zero-retention assurance is given. Contact privacy@kasura.app for information about the safeguards applicable to the relevant processing.

If Kasura becomes aware of a personal data breach affecting personal data we process on your behalf, we will notify your designated account or privacy contact without undue delay after becoming aware of the breach, to the extent permitted by law. Our notification will include information we reasonably have available to help you meet your obligations toward supervisory authorities and data subjects.

We will not wait for completion of the full investigation or a risk assessment before notifying you. Available information includes the nature of the breach, affected categories and approximate numbers of individuals and records, likely consequences, measures taken or proposed, and a contact point. Information may be supplied in stages without undue further delay as it becomes available.

You are responsible for assessing whether a breach must be reported to authorities or data subjects under applicable law, and for making those notifications. Report suspected security incidents involving your workspace to security@kasura.app promptly.

Where data subjects (including your end customers or team members) exercise rights under applicable data protection law — such as access, correction, deletion, restriction, or portability — requests directed to you as controller should be handled by you.

Kasura will provide reasonable assistance through the Service features (for example, export, correction, or deletion tools in your workspace) and, where necessary, through support, so you can respond to such requests. If a request is sent directly to Kasura and clearly relates to data we process on your behalf, we will forward it to you or advise the individual to contact you, unless we are required by law to respond directly.

For requests about data for which Kasura is an independent controller (such as your Kasura account billing data), see our Privacy Notice.

You may use available exports and request a complete return through authenticated support, including original files and records not covered by the product's limited CSV exports. After processing services end, we will, at your choice, delete or return personal data processed on your behalf and delete remaining copies unless applicable law requires storage. Account deletion currently includes a fourteen-day recovery window before irreversible active-data erasure. This is separate from subscription cancellation and from:

• Provider backup, versioning and soft-delete recovery copies subject to the current configurations described in Security and their applicable expiry and lawful retention restrictions
• Legal obligations to retain certain records
• Data aggregated or anonymized such that it no longer identifies individuals
• Data you have exported or migrated before termination

You may request deletion assistance before or after termination by contacting support@kasura.app. A request for a complete return is not refused solely because the paid plan has ended or a UI export omits data. Requests must be authorised, protect others' information and exclude credentials or secrets. Retained exceptions remain confidential, are not used for unrelated purposes and are reviewed against the particular legal requirement. Recovery copies must not reintroduce deleted data into operational use. Active-data completion does not certify immediate expiry of provider recovery copies.

Audit notice periods, frequency limits and alternative evidence do not restrict an audit or inspection required by applicable law, a binding regulator requirement or applicable mandatory transfer clauses. Alternative documentation must actually allow verification of the relevant processing obligations.

Subscription cancellation, account closure, deletion of active records and expiry of recovery copies are separate events. Personal data is retained only for the specific purposes and periods reasonably necessary to provide the Service, fulfil documented processing instructions, comply with legal and accounting duties, handle disputes or protect security. These purposes are not authority to retain all rental records indefinitely. Active data is deleted or anonymised when the applicable purpose ends, subject to lawful exceptions. Backups, versioned objects, soft-deleted copies and technically necessary residual copies may persist until their applicable expiry. Retained exceptions remain protected and limited to their purpose; recovery must not reintroduce deleted data into ordinary operational use.

Operators may request complete return of their authorised workspace records and original files through support@kasura.app, including after cancellation and before irreversible deletion. Delivery requires authority verification and protection of other persons' information; credentials, secrets and unrelated customer data are excluded. A limited CSV export is not a complete return. Requests under applicable data-protection law are handled within the applicable legal requirements, not an invented universal retention or deletion deadline.

Kasura will make available information reasonably necessary to demonstrate compliance with this DPA, including the Security page and Subprocessors list. Upon written request, we will respond to reasonable questionnaires about our processing practices related to your workspace.

If you require an audit beyond published documentation, you must give at least thirty (30) days' notice, conduct it no more than once per twelve (12) months (unless required by law or following a confirmed breach), and accept confidentiality and security restrictions. Onsite audits may be replaced by third-party reports or additional documentation where available. You bear your own costs unless applicable law requires otherwise.

Audits must be conducted in a manner that does not unreasonably interfere with Kasura's operations or compromise the security, confidentiality, or availability of the Services or other customers' data.

For questions about this DPA, data processing, or subprocessors:

• Legal and DPA inquiries: legal@kasura.app
• Privacy and data subject matters: legal@kasura.app
• Security incidents: security@kasura.app
• General support: support@kasura.app
• Questions regarding international data transfers: legal@kasura.app

If there is a conflict between this DPA and the Terms regarding processing of personal data on your behalf, this DPA prevails. If there is a conflict between this DPA and the Privacy Notice, this DPA prevails for processor activities; the Privacy Notice governs where Kasura acts as an independent controller, except where mandatory applicable law requires otherwise.

Monetary liability between Kasura and the Operator follows the Terms only to the extent legally permitted. DPA precedence does not itself create a different monetary cap. Nothing limits affected individuals' statutory rights, regulators' powers, nonmonetary data-protection performance or rights and obligations under applicable mandatory transfer clauses, including their liability provisions.

Related documents: Privacy Notice, Security, Subprocessor List, Terms of Service.

Kasura LLC, 30 N Gould St Ste N, Sheridan, WY 82801, United States. Legal: legal@kasura.app. Privacy: privacy@kasura.app. Billing: billing@kasura.app. Support: support@kasura.app. Security: security@kasura.app. These contact channels do not provide a 24/7 service, guaranteed response time or service-level agreement.