RENEW Data Processing Addendum

Version 1.0 — Effective 2026-09-14

This Data Processing Addendum ("DPA") forms part of the RENEW SaaS Terms and applies where RENEW processes personal data on behalf of a Customer that is a controller of that data.

1. Roles

The Customer is the controller. RENEW (Cultural Capital Holdings Ltd) is the processor, acting on the Customer's documented instructions to provide the Service.

2. Categories of data

RENEW may process authorised-user account and business-contact information, authentication, security and audit information, publication and workflow materials uploaded by the Customer, and names, images, biographies, comments or metadata appearing within those materials.

3. Not intended data categories

This DPA does not cover member or customer databases, payment-card data, special-category personal data, criminal-offence data, children's data or large-scale personal datasets. Such categories require a separate written agreement and appropriate safeguards before being uploaded.

4. Subprocessors

RENEW uses third-party services to host and operate the Service. The current list of configured subprocessors is published on the Subprocessor List page.

5. International transfers

Any international transfer of personal data takes place only with a lawful basis and appropriate safeguards. Specific transfer mechanisms and hosting locations are confirmed in our admin verification checklist and are not committed to here until verified.

6. Security

We maintain security controls appropriate to the data we process. Specific control descriptions are confirmed in our admin verification checklist and are not committed to here until verified.

7. Retention and deletion

We retain personal data only as long as necessary to provide the Service and meet legal obligations. Current retention periods are confirmed in our admin verification checklist and on request.

8. Your rights and assistance

We assist the Customer in responding to data-subject rights requests where applicable. The Customer's data can be exported and removed in accordance with the signed agreement.

9. Order of precedence

The signed Order Form or Free Trial Agreement governs the Customer-specific service. If it conflicts with this DPA, the order of precedence stated in the signed agreement applies.