Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the EquipDash Subscription Agreement between EquipDash Software LLC ("EquipDash", "Processor") and the subscribing business ("Customer", "Controller"). It applies whenever EquipDash processes personal data subject to the EU General Data Protection Regulation (GDPR) or UK GDPR on the Customer's behalf. By using the EquipDash services, the Customer agrees to this DPA.

1. Roles and scope

The Customer is the data controller of personal data relating to its end customers, participants, and staff that is entered into or collected through the EquipDash services (the "Customer Data"). EquipDash is the data processor of Customer Data and processes it only to provide, maintain, and support the services, and only on the Customer's documented instructions, including those given through the Customer's use of the services. The subject matter, duration, nature and purpose of processing, and the categories of data and data subjects are described in Annex 1.

2. Confidentiality

EquipDash ensures that persons authorized to process Customer Data are bound by confidentiality obligations.

3. Security

EquipDash implements appropriate technical and organizational measures to protect Customer Data, including encryption of data in transit (TLS), role-based access controls, environment segregation, and hosting on AWS infrastructure with industry-standard physical and network security. Payment card data is processed exclusively by PCI DSS Level 1 payment processors and never stored on EquipDash servers.

4. Sub-processors

The Customer authorizes EquipDash to engage the sub-processors listed at equipdash.com/subprocessors. EquipDash imposes data protection obligations on its sub-processors equivalent to those in this DPA and remains responsible for their performance. EquipDash will update the sub-processor page at least 30 days before adding or replacing a sub-processor; the Customer may object on reasonable data protection grounds, in which case the parties will work in good faith to find an alternative or the Customer may terminate the affected service.

5. Assistance with data subject rights

The services include self-service tools enabling the Customer to respond to data subject requests directly — per-customer data export (access and portability), permanent erasure ("Forget this customer"), rectification through standard editing, consent records, and automated marketing opt-out enforcement. Taking into account the nature of the processing, EquipDash will provide reasonable additional assistance where the Customer cannot fulfill a request using these tools.

6. Personal data breach notification

EquipDash will notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Data, and will provide information reasonably required for the Customer to meet its own notification obligations.

7. Data protection impact assessments

EquipDash will provide reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities, to the extent the required information is available to EquipDash.

8. International transfers

EquipDash Software LLC is located in the United States. To the extent the Customer's use of the services involves a transfer of personal data from the EEA, the parties incorporate by reference the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), Module Two (controller to processor), with the Customer as data exporter and EquipDash as data importer; optional Clause 7 applies, Clause 9(a) Option 2 (general authorization, 30 days' notice) applies, and the governing law and forum are those of Ireland. For transfers from the United Kingdom, the UK International Data Transfer Addendum to the SCCs applies. Annex 1 to this DPA serves as Annex I of the SCCs, and Section 3 (Security) serves as Annex II.

9. Audit

EquipDash will make available information reasonably necessary to demonstrate compliance with this DPA, including summaries of relevant third-party reports, and will allow audits by the Customer or its mandated auditor where required by law, on reasonable notice and no more than once per year unless required by a supervisory authority.

10. Deletion and return

Upon termination of the subscription, EquipDash will, at the Customer's choice, delete or return Customer Data, and delete remaining copies within 90 days, except where retention is required by law. During the subscription, the Customer can export Customer Data at any time using built-in export tools.

11. Liability and order of precedence

Each party's liability under this DPA is subject to the limitations of liability in the Subscription Agreement. In case of conflict between this DPA and the Subscription Agreement, this DPA prevails with respect to the processing of personal data; the SCCs prevail over both where they apply.

Annex 1 — Description of processing

• Data subjects: the Customer's end customers, booking participants, and staff members.
• Categories of personal data: name, contact details (email, phone, address), date of birth, booking and payment history (no card numbers), waiver and form responses (which may include signatures and, where the Customer collects them, health-related answers), communications (email/SMS), marketing consent records, and emergency contact details.
• Special categories: only where the Customer chooses to collect them in waivers or forms (e.g., medical fitness questions). The Customer is responsible for ensuring a lawful basis for such collection.
• Subject matter and nature: hosting, storage, transmission, and display of Customer Data to operate bookings, rentals, experiences, payments, waivers, and customer communications.
• Purpose: providing the EquipDash services per the Subscription Agreement.
• Duration: the subscription term plus the deletion window in Section 10.

This document was prepared by EquipDash based on standard industry processor terms and the EU Standard Contractual Clauses. A countersigned copy is available on request at support@equipdash.com.