Data Processing Addendum

Version 1.0 · Effective date: October 12, 2026 · Contact: [email protected]

Plain-language summary. The information your venue keeps about couples, guests, coordinators and vendors is yours, and you are responsible for it. Oikos handles it only to run Oikos Venue for you. This addendum is the contract that says so. It applies automatically; you do not need to sign anything.

1. What this is, and when it applies

1.1 This Data Processing Addendum ("DPA") forms part of the Oikos Venue Terms of Service ("Terms") between Oikos United LLC ("Oikos") and the venue business that agreed to them ("Customer," "you"). It governs Oikos's processing of personal data on your behalf, and it is written to meet the processor-contract requirements of the Virginia Consumer Data Protection Act (Va. Code § 59.1-579), the California Consumer Privacy Act as amended (service-provider requirements), and comparable US state privacy laws.

1.2 It applies automatically whenever your use of the Service involves personal data about anyone other than your own account users. No request or signature is needed.

1.3 If you need a countersigned copy for your records, email [email protected] from an owner's account address naming your legal entity, and we will return this DPA signed by Oikos United LLC. The terms are the terms published here.

2. Definitions

"Customer Personal Data" means personal data in Your Data that Oikos processes on your behalf. "Controller," "processor," "personal data," "processing," "data subject" and "sub-processor" have the meanings given in applicable US state privacy law; where the CCPA applies, "business," "service provider," "sell" and "share" have the meanings given there. Other capitalized terms are defined in the Terms.

3. Roles

3.1 You are the controller (the "business" under the CCPA) of Customer Personal Data. You decide what you collect about your Clients and others, why, and for how long, and you are responsible for your lawful basis, your notices, and your consents, including text-message consent.

3.2 Oikos is your processor (your "service provider"). Your documented instructions are the Terms, this DPA, and your configuration and use of the Service.

3.3 Oikos is a controller only for its own account, billing, security and business records, which the Privacy Policy covers and this DPA does not.

4. Oikos's obligations

Oikos will:

4.1 process Customer Personal Data only on your documented instructions, unless the law requires otherwise, in which case we will tell you first unless the law forbids it;

4.2 not sell or share Customer Personal Data; not retain, use or disclose it outside the direct business relationship with you or for any purpose other than providing the Service; not combine it with personal data from other sources except as the law allows; and not use it to train AI models;

4.3 ensure everyone who processes it is bound by a duty of confidentiality, with access limited to those who need it;

4.4 maintain the security measures in Annex II;

4.5 engage sub-processors only under Section 6;

4.6 help you, taking into account the nature of the processing, to respond to data subject requests (Section 7), to keep data secure, to handle breaches (Section 8), and to carry out any data protection assessment you are required to make;

4.7 delete or return Customer Personal Data under Section 9;

4.8 make available the information reasonably needed to show compliance with this DPA, and allow reasonable assessments under Section 10; and

4.9 tell you if we believe an instruction from you infringes the law, or if we can no longer meet our obligations under applicable privacy law.

5. Your obligations

You will give data subjects the notices the law requires; obtain and record the consents your messaging needs; put into the Service only data you are entitled to process; not put into it the categories Section 7(d) of the Terms excludes; and respond to data subject requests addressed to you.

6. Sub-processors

6.1 You authorize Oikos to use the sub-processors in Annex III.

6.2 Each sub-processor is bound by data protection obligations no less protective than this DPA, and Oikos remains responsible to you for its performance.

6.3 We will notify account owners by email at least 30 days before a new or replacement sub-processor begins processing Customer Personal Data, and update Annex III and the Privacy Policy at the same time.

6.4 You may object on reasonable data protection grounds within 30 days of the notice. If we cannot reasonably accommodate the objection, you may terminate the affected subscription and we will refund prepaid fees for the period after termination.

7. Data subject requests

7.1 Owners can find, correct, export and delete Client records directly in the Service. Deleting a prospect's record removes it with its messages, tours, unsigned documents, files and portal access.

7.2 If a data subject contacts Oikos directly about Customer Personal Data, we will forward the request to you within 5 business days and will not respond to it ourselves except to acknowledge it and say we have passed it to you.

7.3 Where you cannot complete a request yourself in the Service, for example removing one person across several records, we will do it on your written instruction within 15 days.

8. Personal data breaches

8.1 Oikos will notify you without undue delay, and in any event within 72 hours, after becoming aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.

8.2 The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of people and records concerned, the likely consequences, and the measures taken or proposed. We will supplement it as we learn more.

8.3 We will cooperate with you to meet any notification obligations you have to individuals or regulators, including under Virginia Code § 18.2-186.6. Notifying your Clients is your decision and obligation as controller; we will not notify them without your instruction unless the law requires us to.

9. Deletion and return

9.1 You can export Your Data at any time.

9.2 After your subscription ends, your workspace stays read-only for 90 days so you can export it. We then delete Customer Personal Data from the live systems, and it leaves backups as they expire on our database provider's rolling schedule. On your written request we delete sooner.

9.3 We may keep data longer only where the law requires it, and then only for that purpose and under this DPA's confidentiality and security terms.

10. Information and assessments

On written request, no more than once a year (or after a breach, or where a regulator requires it), Oikos will answer a reasonable written questionnaire about its compliance with this DPA, and will make available the information needed to show it. Where the law gives you a right to an assessment by a qualified independent assessor, you may arrange one at your cost, on 30 days' notice, during business hours, under confidentiality terms, and without access to other customers' data.

11. Location

Customer Personal Data is stored and processed in the United States.

12. Liability and precedence

12.1 Each party's liability under this DPA is subject to the limitations in the Terms.

12.2 If this DPA conflicts with the Terms on the processing of Customer Personal Data, this DPA controls.

12.3 This DPA lasts as long as Oikos processes Customer Personal Data for you. We may update it to reflect changes in law or in the Service, with 30 days' email notice for material changes.

Annex I: details of the processing

Subject matter and duration: providing Oikos Venue, for the term of the subscription and the deletion period in Section 9.

Nature and purpose: storing, organizing, displaying, transmitting and deleting records so the venue can manage inquiries, tours, proposals, contracts and e-signatures, payment schedules and payment records, event planning, event-day operations, incident records and communications; sending texts and emails the venue configures; and, where the venue enables Oikos AI, generating replies and answers.

Categories of data subjects: the venue's prospects and clients (couples and event hosts) and their partners; guests and contacts they name (day-of contacts, emergency contacts); coordinators; vendors; the venue's staff.

Categories of personal data: names; email addresses; phone numbers; city and state; event details (date, type, guest count, budget range, alcohol service, whether children attend a tour); form and questionnaire answers; accessibility needs disclosed for a tour; messages; contracts, signatures and signing records; payment amounts, methods and references (no card or bank account numbers); staff notes; incident reports, which may describe injuries; messaging consents and opt-outs; vendor insurance certificates.

Sensitive data: the Service is not designed to hold sensitive data. Incident reports and accessibility needs may reveal health information; venues should record only what is necessary.

Annex II: security measures

• Encryption: TLS in transit; encryption at rest by the database and file-storage provider.
• Tenant separation: row-level security in the database separates each venue's data from every other venue's; client and coordinator portal access is scoped to a single event record.
• Access control: role-based access (owner, staff, read-only, coordinator, client); booked revenue visible to owners only by default; coordinators cannot see payment information; deleting a prospect record is owner-only and refused while a booking or completed signature depends on it.
• Files: stored in a private bucket, served only to authorized users.
• Signatures: a frozen copy of each document is signed; the document, signers and events are sealed with a SHA-256 digest that fails verification if anything changes; signed records cannot be deleted while a booking depends on them.
• Payments: card data is entered only into Stripe's hosted fields; the Service never receives full card numbers.
• Messaging: opt-outs are recorded per venue and checked again immediately before every send.
• Records management: retention categories, legal hold, and deletion that leaves an audit record of what was disposed of.
• Personnel: access to production data limited to Oikos personnel who need it to operate and support the Service.

What we do not claim: we do not hold a SOC 2 report or ISO 27001 certification, and we do not run a 24-hour security operations center.

Annex III: sub-processors

Oikos United LLC, Commonwealth of Virginia, USA (mailing address available on request) · [email protected]