Data Processing Addendum

Last updated: October 7, 2026

This addendum forms part of the agreement between Storage Reservations ("Processor") and the facility ("Controller").

Scope

Processor processes renter and prospect personal data (names, contact details, rental and billing records, optional ID documents, messages) solely to provide the service and on the Controller's documented instructions.

Processor commitments

  1. Confidentiality obligations for all personnel with access.
  2. Appropriate technical and organizational security measures (see Security).
  3. Use of sub-processors only under written terms with equivalent protections. Current categories: cloud hosting (United States), email delivery, SMS delivery (Flowroute), payment processing (the Controller's own gateway).
  4. Assistance with data-subject requests, security and breach obligations.
  5. Notice of a personal-data breach without undue delay, and in any event within 72 hours of confirmation.
  6. Return or deletion of personal data at the end of the service, after a 30-day export window, except where retention is legally required.
  7. Making available information reasonably necessary to demonstrate compliance.

Controller commitments

The Controller has a lawful basis and gives any required notices for the data it collects, and configures retention (for example ID-document retention) appropriately.

Data location

Data is hosted in the United States.