Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms and Conditions between Traista, Inc. ("Traista") and each organization that uses Traista (the "Organization"). It applies automatically when the Organization accepts the Terms. If the Organization has a separate signed agreement with Traista that covers data protection, that agreement prevails where the two conflict.

1. Definitions

• Organization Personal Data — personal information that the Organization or its users put into Traista, or that Traista creates for the Organization while providing the Services: found-item records and photos, guest contact and shipping details, recovery claims created on a guest's behalf using information supplied by the Organization for shipping rates or labels, notes, messages its staff send, pickup records and signatures, chain-of-custody history, and reports and exports.
• Data Protection Laws — the US federal and state privacy and data protection laws that apply to the processing, including the California Consumer Privacy Act as amended (CCPA) and other US state privacy laws.
• Security Incident — a breach of security that leads to the accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of or access to Organization Personal Data.
• Sub-processor — a third party Traista engages to process Organization Personal Data.

Other capitalised terms have the meaning given in the Terms.

2. Roles

For Organization Personal Data, the Organization is the business (or controller) and Traista is its service provider (or processor).

Claims that a person files with the Organization themselves through Traista are handled by Traista as described in its Privacy Policy, and shared with the Organization so it can handle the claim. The Organization may use them only to handle that claim, to return or dispose of the item, and to keep its own records.

3. Traista's obligations

Traista will:

• process Organization Personal Data only to provide the Services, on the Organization's documented instructions — which are the Terms, this DPA, and the Organization's use and configuration of the Services — or as the law requires (in which case Traista will tell the Organization first, unless the law forbids it);
• not sell or share it (as those terms are defined in the CCPA), not keep, use or disclose it for any purpose other than providing the Services, or outside the direct business relationship with the Organization, and not combine it with personal information from other sources except as Data Protection Laws allow a service provider to;
• comply with the Data Protection Laws that apply to it as a service provider, give the same level of privacy protection they require, and tell the Organization if it decides it can no longer meet its obligations;
• allow the Organization to take reasonable and appropriate steps to stop and remedy any unauthorised use of Organization Personal Data; and
• ensure that everyone at Traista who can access Organization Personal Data is bound by confidentiality.

Traista certifies that it understands and will comply with these restrictions.

Traista may create de-identified and aggregated data from the Services, as described in the Terms, and will not try to re-identify it.

4. The Organization's obligations

The Organization will:

• have a lawful basis, and give any notices and obtain any consents needed, to collect Organization Personal Data and have Traista process it;
• give only lawful instructions;
• follow the rules in the Terms for photos, exports and items in its custody; and
• protect reports and exports once it downloads them.

5. Security

Traista keeps technical and organisational measures appropriate to the risk, including:

• hosting and storage in the United States using cloud hosting and database service providers; a provider's audit or certification does not certify Traista itself;
• encryption of data in transit (TLS) and at rest in the database and file storage;
• private storage for photos, shipping labels and signatures, served only to authorised users;
• passwords stored as one-way hashes;
• role- and location-based access, so the Organization's staff see only the locations they are assigned to and its administrators see all of its locations;
• access by Traista personnel limited to those who need it.

Traista may update these measures as long as the overall level of protection does not decrease.

6. Sub-processors

The Organization authorises Traista to use Sub-processors in the service categories described in section 12. The current list of Sub-processor names is available to the Organization on request at support@traista.com. Traista will:

• bind each Sub-processor by written contract to data protection obligations at least as protective as this DPA, as they apply to the service it provides;
• remain responsible for its Sub-processors' performance of those obligations.

Traista may add or replace Sub-processors to provide the Services, subject to Data Protection Laws and any separate signed agreement with the Organization. This DPA does not establish a fixed advance-notice period or routine change-notification emails. Where applicable law or a separate signed agreement requires notice, authorisation or an opportunity to object, Traista must meet those requirements.

7. Requests from individuals

If Traista receives a request from a person about Organization Personal Data (for example, to access or delete it), Traista will pass it to the Organization without undue delay and will not answer it itself, except to tell the person that it has been passed on, or as the law requires. Traista will help the Organization respond, through the features of the Services (such as exports) and, where those aren't enough, through support.

8. Security Incidents

Traista will notify the Organization of a Security Incident affecting Organization Personal Data within the time required by Data Protection Laws or any separate signed agreement with the Organization. This DPA does not establish a blanket 72-hour notification deadline. The notice will describe, as far as Traista knows at the time, what happened, the data and people affected, the likely consequences, and what Traista is doing about it; Traista will send updates as it learns more. Traista will take reasonable steps to contain and remedy the incident and will help the Organization meet its own notification obligations. Unless the law requires Traista to, the Organization decides whether to notify the people affected or any authority. A notice is not an admission of fault.

9. Retention, return and deletion

• While the Organization uses Traista, Organization Personal Data is kept according to the Organization's use of the Services and the retention periods in the Privacy Policy.
• After account closure, the Organization may contact support@traista.com to request return or deletion of Organization Personal Data. Traista will assess and respond to the request under Data Protection Laws and any separate signed agreement, including identifying data that must be retained and the applicable reasons. Account closure does not itself delete or anonymise records.
• Any required return or deletion, treatment of backup copies, and written confirmation will follow Data Protection Laws and any separate signed agreement. This DPA does not promise an automated anonymisation feature or a separate deletion certificate.

10. Information and audits

Traista will provide information and cooperation required by Data Protection Laws or any separate signed agreement to demonstrate compliance with its data protection obligations. This DPA does not include an annual or post-incident security questionnaire service. Information disclosed under this section is subject to applicable confidentiality obligations, without limiting disclosures required by law.

11. Where data is processed

Traista stores Organization Personal Data with cloud hosting and database service providers in the United States. Sub-processors may process it in the United States and other countries where they operate.

12. Sub-processors

Carriers (such as USPS, UPS and FedEx) receive the shipping details needed to deliver a parcel. They act under their own terms as independent carriers, not as Traista's Sub-processors.

13. General

• Term. This DPA lasts as long as Traista processes Organization Personal Data.
• Liability. Each party's liability under this DPA is subject to the limitations of liability in the Terms.
• Precedence. If this DPA conflicts with the Terms on data protection, this DPA prevails.
• Changes. Traista may update this DPA to reflect changes in the law or the Services, as long as the update doesn't reduce the protection of Organization Personal Data, and will give notice of material changes as described in the Terms.