Data Processing Addendum (DPA)

1. Definitions

“Applicable Data Protection Laws” means all data protection and privacy laws applicable to the processing under this DPA, including (as applicable) GDPR (EU/UK/CH), PIPEDA/PIPA and Quebec Law 25 (Canada), and US state privacy laws (e.g., CCPA/CPRA, Colorado, Virginia). “Personal Data”, “Process/“Processing”, “Controller”, and “Processor” have the meanings given in such laws. “Sub-processor” means a processor engaged by Nova to process Personal Data on behalf of Operator.

2. Scope & Roles

As between the parties, Operator is the Controller and Nova is the Processor of Personal Data submitted to the Service within Operator’s workspace. Operator instructs Nova to process Personal Data as necessary to provide, secure, and improve the Service, as further described in Annex I.

3. Operator Instructions

Nova will process Personal Data only on documented instructions from Operator, including those set forth in the Agreement, this DPA, and Operator’s configuration and API usage. Nova will notify Operator if an instruction appears unlawful.

4. Confidentiality

Nova ensures personnel authorized to process Personal Data are bound by confidentiality and receive appropriate privacy/security training.

5. Security

Nova implements technical and organizational measures (“TOMs”) appropriate to the risk, as outlined in Annex II and on our Security & Compliance page, including encryption in transit and at rest, access controls, logging, backups, and periodic testing.

6. Sub-processors

Operator authorizes Nova to engage Sub-processors listed in Annex III and any others reasonably required for the Service. Nova imposes data protection obligations on Sub-processors no less protective than those in this DPA and remains responsible for their performance.

7. Data Subject Requests

Taking into account the nature of processing, Nova will assist Operator by appropriate technical and organizational measures to respond to requests to exercise data subject rights (access, rectification, erasure, restriction, portability, objection). Operator is responsible for verifying identity and responding to requests relating to its workspace.

8. Personal Data Breach

Nova will notify Operator without undue delay after becoming aware of a Personal Data Breach affecting Operator Personal Data, providing information reasonably available to assist Operator in meeting legal obligations. Nova will take appropriate steps to contain, investigate, and remediate the breach.

9. International Transfers

Where Personal Data is transferred to a country without an adequacy decision, the parties agree the relevant Standard Contractual Clauses (SCCs) apply, including the UK Addendum where applicable. Details and TOMs are set out in Annexes I–II.

10. Audits

Nova will provide information necessary to demonstrate compliance with this DPA and allow for audits by Operator or its mandated auditor once per year (and after a Personal Data Breach), subject to reasonable notice, confidentiality, and minimal disruption. Independent reports or certifications may satisfy this requirement where appropriate.

11. Return & Deletion

Upon termination or expiry of the Agreement, Nova will, at Operator’s choice, return or delete Personal Data after a reasonable retention window unless storage is required by law or to defend legal claims. Backups cycle out per standard retention schedules.

12. Cooperation

Nova will assist Operator in meeting obligations under Applicable Data Protection Laws, including security, breach notifications, DPIAs, and consultations with supervisory authorities, considering the nature of processing and the information available to Nova.

13. Liability

Parties’ aggregate liability under this DPA is subject to the limitations of liability in the Agreement, except where not permitted by law.

14. Order of Precedence

If there is a conflict between this DPA and the Agreement, this DPA prevails to the extent of the conflict on matters of data protection and privacy.

15. Governing Law

This DPA is governed by the laws specified in the Agreement. Where SCCs apply, their governing law and forum terms control for transfers covered by the SCCs.

16. Contact

Privacy: privacy@novatelematics.com · Security: security@novatelematics.com

Annex I — Details of Processing

Subject Matter	Provision of the Nova RentalHub Service to Operator.
Duration	Term of the Agreement, plus any legally required retention.
Nature & Purpose	Hosting, storage, transmission, analysis, and other processing necessary to provide, secure, and improve the Service and related support.
Categories of Data Subjects	Operator staff (Authorized Users); Operator customers/renters and drivers; Operator vendors/contacts; site visitors.
Categories of Personal Data	Identifiers (name, email, phone), account data, reservation/contract data, billing metadata, usage logs, telematics metadata where enabled (e.g., GPS, odometer), images (e.g., license photos), and other content uploaded by Operator. Sensitive data is not required by the Service but may be processed if submitted by Operator; Operator is responsible for lawfulness.
Special Categories	Not intended or required. If processed, only per Operator instructions and applicable law.
Processing Operations	Collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure by transmission, alignment, combination, restriction, erasure, and destruction as required for the Service.

Annex II — Technical & Organizational Measures (Summary)

• Access Control: Role-based access, least privilege, SSO/MFA support where available, session management.
• Encryption: TLS 1.2+ in transit; encryption at rest (e.g., AES-256 via cloud provider).
• Logging & Monitoring: Centralized logs, alerting for anomalous activity, audit trails.
• Resilience: Backups and restoration, point-in-time recovery where supported, disaster recovery runbooks.
• Secure SDLC: Code review, dependency scanning, secrets management, change management.
• Vendor Management: Security due diligence, contractual DPAs/SCCs where appropriate.
• Testing: Vulnerability scanning and periodic penetration testing; remediation tracking.
• Data Minimization & Retention: Controls to limit collection, retention settings, export/delete tooling.

A detailed TOMs description is available upon request and on our Security & Compliance page.

Annex III — Authorized Sub-processors

• Google Cloud Platform (Cloud Run, Firestore, Cloud Storage) — hosting and data processing (primary region us-central1).
• Stripe — payment processing and billing.
• Telephony/Messaging (e.g., Twilio/WhatsApp) — messaging where enabled.
• Telematics Providers (e.g., Geotab, Navixy) — vehicle/telematics data where enabled.
• Analytics & Error Monitoring — product analytics/crash reporting, if enabled.

Operator can subscribe to Sub-processor change notifications by contacting privacy@novatelematics.com.

Annex IV — Standard Contractual Clauses

Where required for international transfers, the applicable EU SCCs (2021/914/EU) and the UK Addendum (as updated) are incorporated by reference. Operator is the data exporter and Nova is the data importer; Annex I–II above serve as the Appendices to the SCCs. For the SCCs: Module Two (Controller→Processor) applies by default; Module Three (Processor→Processor) may apply for Sub-processors.

Annex V — Regional Terms (US/Canada)

• US (CCPA/CPRA and similar): Nova acts as a “service provider”/“processor.” Nova will not sell or share Personal Information, will not combine it with other data except as permitted for the Service, and will assist with consumer rights requests as described above.
• Canada (PIPEDA/PIPA, Quebec Law 25): Nova acts as “processor/agent.” Operator designates a privacy contact; Nova’s privacy contact is listed below. Cross-border transfers rely on contractual and organizational safeguards.

Privacy Officer: privacy@novatelematics.com