Data Processing Addendum

This Data Processing Addendum (the “DPA”) forms part of the Rushido Terms of Service (the “Agreement”) between Easy Global LLC, a New York limited liability company that operates the Rushido platform under the Easy Global Ventures brand (“Rushido”, “we”, “us”), and the company that accepts it (the “Company”, “you”). It applies whenever Rushido processes Company Personal Data while providing the Platform.

1. Roles of the parties

• The Company is the controller of the personal data that it, its franchise businesses, its branches and their users enter into or generate in the Company’s workspaces: for example data about franchise owners and applicants, branch managers and staff, workers on payroll, suppliers and end customers (“Company Personal Data”). The Company decides why and how this data is used.
• Rushido is the processor (and, where the California Consumer Privacy Act applies, a “service provider”) of Company Personal Data. Rushido processes it only to provide, secure and support the Platform for the Company.
• Rushido is a separate controller only of the account data it needs to run the Platform itself (sign-in, subscription billing to Rushido, fraud prevention, legal compliance and the evidence of consents), as described in the Privacy Policy.
• Franchise businesses and branches may, under their own franchise agreements with the Company, be controllers of some of their own data. Allocating responsibilities between the Company and its franchisees is a matter between them; Rushido follows the workspace permissions the Company and its network configure.

2. Processing on documented instructions

Rushido processes Company Personal Data only on the Company’s documented instructions, which are: the Agreement, this DPA, and the Company’s use and configuration of the Platform (for example the members it invites, the permissions it grants, and the exports it requests). Rushido will tell the Company if it believes an instruction breaks applicable law. Rushido does not sell Company Personal Data, does not share it for cross-context behavioural advertising, and does not combine it with other customers’ data except as needed to operate the Platform.

3. Details of the processing

• Subject matter and duration: providing the Platform for as long as the Company has an account, and for the return and deletion period in section 9.
• Nature and purpose: hosting, storing, organizing, displaying, transmitting, backing up and deleting data to run ordering, invoicing, payments, accounting, payroll, documents, notifications and franchise onboarding.
• Data subjects: the Company’s personnel and users; franchise owners and applicants; branch managers and staff; workers whose time and pay are recorded; suppliers and customers whose details are entered.
• Categories of data: names and contact details; account and role information; business, order, invoice, payment and accounting records; payroll and time records; documents uploaded by users; device and log data; identity-verification results (see section 6).
• Sensitive data: the Platform is not designed for health, biometric or other special categories of data, and the Company should not enter them except where a Platform feature requires it (for example identity verification, which is performed by Stripe).

4. Confidentiality and need-to-know access

Rushido personnel with access to Company Personal Data are bound by confidentiality obligations. Access is limited to what each person needs: platform staff do not browse tenant data; tenant data is read by platform staff only to provide support the Company asks for, to secure the Platform, or to meet a legal obligation, and private data such as identity details, billing terms and documents is restricted to platform super administrators. Rushido records administrative actions in audit logs.

5. Security measures

Rushido maintains the technical and organizational measures in Annex 2, appropriate to the risk. Rushido may update them as long as the overall level of protection is not reduced.

6. Identity verification data

Identity checks of company owners and franchise owners are performed by Stripe Identity. Stripe collects the identity document and selfie images directly; Rushido receives the result (verified or not, which checks passed, the date and a session reference), not the images. Within the Platform, identity details are visible only to the person concerned and, on a need-to-know basis, to Rushido’s platform super administrators; a Company sees only whether a person is verified and the details it needs to contract with its own franchise applicants and owners.

7. Subprocessors

The Company gives general authorization for Rushido to use the subprocessors listed in Annex 3. Rushido will give at least 30 days’ notice (by email or in the Platform) before adding or replacing a subprocessor. The Company may object on reasonable data-protection grounds within that period; if the parties cannot resolve the objection, the Company may terminate the affected service and stop paying for it from that date. Rushido imposes data-protection obligations on each subprocessor that are no less protective than this DPA and remains responsible for its subprocessors’ performance.

8. Security incidents

Rushido will notify the Company without undue delay and in any event within 72 hours after becoming aware of a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Company Personal Data (a “Security Incident”). The notice will describe, as far as then known, what happened, the categories and approximate number of people and records affected, the likely consequences, and the measures taken or proposed; Rushido will update it as more becomes known. Rushido will take reasonable steps to contain and remedy the incident and will cooperate with the Company’s own notification duties (for example under the New York SHIELD Act or other state breach laws). Unless the parties agree otherwise or the law requires Rushido to do so, the Company decides whether and how to notify affected individuals and regulators. Notifying the Company is not an admission of fault.

9. Return and deletion at termination

• At any time, and during at least 30 days after the Company asks to close its account, an authorized owner can download an export of the Company’s data from the Platform.
• After that period Rushido deletes or anonymizes Company Personal Data, including the personal fields of users who belong only to the Company’s network, within 90 days.
• Rushido keeps, isolated and access-restricted, only what the law requires or permits it to keep, and only for the retention period in its published retention schedule: financial and accounting records (7 years), payroll records (6 years), evidence of consents and signed agreements and identity-verification results (7 years after the account closes), and security logs (2 years). Backups containing deleted data are overwritten in the normal backup cycle.

10. Assistance

Taking into account the nature of the processing, Rushido will provide reasonable assistance to the Company in responding to requests from individuals exercising their rights (mainly through the Platform’s own view, edit and export tools), and with security, breach-notification and data-protection assessments where the law requires them.

11. Information and audits

On written request, and no more than once a year unless a Security Incident has occurred or a regulator requires it, Rushido will provide information reasonably necessary to show compliance with this DPA, such as a description of its security measures and subprocessors. Rushido does not currently hold a third-party security certification; if it obtains one, it will make the report available under confidentiality.

12. Location of processing

Company Personal Data is hosted in the United States. Subprocessors may process data in the countries listed in Annex 3.

13. Liability, law and precedence

Each party’s liability under this DPA is subject to the limitations in the Agreement. This DPA is governed by the laws of the State of New York, and the state or federal courts in New York County, New York have exclusive jurisdiction, as in the Agreement. If this DPA conflicts with the Agreement on the processing of Company Personal Data, this DPA controls.

Annex 1 — Accepting this DPA

This DPA is accepted electronically by an owner or administrator of the Company who confirms they are authorized to bind the Company. Rushido records the version accepted, a SHA-256 fingerprint of its exact text, the date and time, the account, the Company, the IP address and the device or browser used. The Company can see and download the version it accepted at any time.

Annex 2 — Security measures

• Encryption: all traffic to the Platform uses TLS; the database and file storage are encrypted at rest by the hosting provider (Supabase).
• Isolation between businesses: row-level security in the database separates every company, franchise business and branch; every request is checked against the workspace the user is acting in and the permissions granted there.
• Least privilege: internal functions cannot be called by users; private data (identity details, billing terms, documents, notes) is limited to the roles that need it.
• Authentication: passwords are handled by the authentication provider; repeated failed logins are limited; two-factor authentication can be required per account.
• Uploads: files are accepted only as PDF, PNG or JPEG, rebuilt to remove active content, stored under random names in private storage and served through short-lived signed links.
• Audit logs: money actions, permission changes, document views and downloads, and platform administrator actions are logged.
• Payments: card and bank details are handled by Stripe; Rushido never stores full card or bank account numbers entered for online payments.
• Environments and secrets: testing happens on a separate staging environment; production secrets are stored outside the code repository.
• Backups and continuity: database backups by the hosting provider and platform backups as configured by Rushido.
• People: access to production limited to named personnel; confidentiality obligations.

Annex 3 — Subprocessors