Get in touch

Data Processing Addendum

Version 1.0Effective August 26, 2026Version history

Version 1.0 — Effective August 26, 2026

This Data Processing Addendum (“DPA”) forms part of the agreement between Base509 LLC (“Base509”) and the pet-care business using PetAppro (“Provider”), consisting of the Provider Terms, incorporated Shared Platform Terms, and any applicable order form (the “Agreement”). It governs Base509’s Processing of Provider Personal Data on the Provider’s behalf.

By accepting the Agreement, the Provider enters this DPA for itself and, where applicable, its authorized Affiliates. If this DPA conflicts with the Agreement concerning Processing of Provider Personal Data, this DPA controls.

1. Definitions

In this DPA:

  • “Affiliate” means an entity controlling, controlled by, or under common control with a party.
  • “Applicable Data Protection Law” means a privacy, data-protection, or breach-notification law applicable to the Processing under this DPA, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”), the European Union General Data Protection Regulation (“EU GDPR”), the United Kingdom GDPR and Data Protection Act 2018 (“UK Data Protection Law”), and applicable United States state privacy laws.
  • “Controller” includes a “business” under the CCPA; “Processor” includes a “service provider” or “contractor” under the CCPA; “Data Subject” includes a “consumer”; “Personal Data” includes “personal information”; and “Process” or “Processing” has the meaning assigned by Applicable Data Protection Law.
  • “Provider Personal Data” means Personal Data that Base509 Processes on the Provider’s behalf through PetAppro. It excludes Personal Data for which Base509 independently determines the purposes and means of Processing, including Base509’s subscription billing, direct account security, direct support, and legal-compliance records.
  • “Security Incident” means a confirmed breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Provider Personal Data. It excludes unsuccessful attempts that do not compromise Provider Personal Data, such as blocked scans, pings, failed sign-ins, or denial-of-service attempts.
  • “Subprocessor” means another Processor engaged by Base509 to Process Provider Personal Data.

Terms not defined here have the meanings in the Agreement or Applicable Data Protection Law.

2. Scope and roles

The Provider is the Controller and Base509 is the Processor of Provider Personal Data. The Provider determines the purposes and essential means of Processing. Base509 will Process Provider Personal Data only:

  • to provide, secure, support, maintain, and improve the functions the Provider uses under the Agreement;
  • on the Provider’s documented instructions, including instructions expressed through authorized configuration and use of PetAppro;
  • as described in Annex I; or
  • as required by law, in which case Base509 will inform the Provider before Processing unless law prohibits notice.

Base509 will promptly inform the Provider if, in Base509’s opinion, an instruction infringes Applicable Data Protection Law. Base509 may suspend the affected Processing while the parties address the instruction.

The parties acknowledge that Providers are independent pet-care businesses and that Base509 does not determine the Provider’s purposes for collecting End Client, worker, pet, home-access, or service information.

3. Provider obligations

The Provider will:

  • comply with Applicable Data Protection Law and process Personal Data lawfully, fairly, and transparently;
  • give legally sufficient privacy, workforce, location-tracking, and consumer notices;
  • obtain any consent or other lawful basis required for Base509 and its Subprocessors to Process Provider Personal Data;
  • collect and instruct Base509 to Process only Personal Data reasonably necessary and proportionate for a disclosed purpose;
  • maintain accurate account and contact information and respond to Data Subject requests;
  • configure roles, permissions, retention, connected services, and exports appropriately;
  • protect exported or downloaded data after it leaves PetAppro;
  • ensure its instructions do not violate law or third-party rights; and
  • not submit Personal Data that the Agreement or Acceptable Use Policy prohibits.

The Provider is responsible for the lawfulness of its instructions, its relationship with Data Subjects, and the acts of its Authorized Users.

4. Base509 obligations

Base509 will:

  • Process Provider Personal Data only as permitted by Section 2;
  • ensure that personnel authorized to Process Provider Personal Data are bound by confidentiality obligations;
  • limit access according to role, tenant, and need;
  • implement and maintain the security measures in Annex II;
  • assist the Provider as described in this DPA with Data Subject requests, security, impact assessments, regulator consultations, and breach duties;
  • maintain records and provide information reasonably necessary to demonstrate compliance with this DPA; and
  • delete or return Provider Personal Data as described in Section 10.

Base509 will not combine Provider Personal Data with personal information received from another person or collected from Base509’s own consumer interaction except as permitted by Applicable Data Protection Law and necessary to provide the Service.

5. CCPA restrictions

For Provider Personal Data subject to the CCPA, Base509 acts as a service provider or contractor. Base509 will not:

  • sell or share Provider Personal Data;
  • retain, use, or disclose Provider Personal Data outside the direct business relationship with the Provider or for a commercial purpose other than the business purposes specified in the Agreement and this DPA;
  • retain, use, or disclose Provider Personal Data for a purpose other than the specific purposes stated in the Agreement and this DPA or otherwise permitted by the CCPA;
  • use Provider Personal Data for cross-context behavioral advertising; or
  • attempt to reidentify information that the Provider or Base509 has deidentified, except to test whether deidentification processes comply with law.

Base509 certifies that it understands and will comply with these restrictions. The Provider may take reasonable and appropriate steps to help ensure that Base509 uses Provider Personal Data consistently with the Provider’s CCPA obligations and may, after notice, take reasonable and appropriate steps to stop and remediate unauthorized use. Base509 will notify the Provider if Base509 determines it can no longer meet its applicable CCPA obligations.

6. Confidentiality and security

Base509 will implement appropriate technical and organizational measures designed to protect Provider Personal Data against a Security Incident, taking into account the state of the art, implementation cost, nature and scope of Processing, context, purposes, and risk to individuals. Current measures are described in Annex II.

The Provider acknowledges that security is a shared responsibility. The Provider must protect credentials and devices, require its users to follow authentication controls, assign least privilege, remove stale access, verify sensitive instructions, and maintain operational and emergency procedures.

Base509 may update its security measures as technology and risk change, provided that an update does not materially decrease overall protection during the Service term.

7. Security Incidents

Base509 will notify the Provider immediately after discovery when California law requires immediate notice and, in all other cases, without undue delay after becoming aware of a Security Incident affecting Provider Personal Data. Base509 will provide notice within 72 hours after becoming aware unless Applicable Data Protection Law requires earlier notice. An investigation may continue after the initial notice and does not delay a legally required notice.

The notice will provide information then reasonably available, which may include:

  • the nature of the Security Incident;
  • categories of affected Data Subjects and Provider Personal Data;
  • approximate number of affected records or individuals;
  • known or reasonably anticipated consequences;
  • containment and remediation measures; and
  • a contact for follow-up.

Base509 may provide information in phases as the investigation proceeds. Base509 will take reasonable steps to contain, investigate, and remediate the Security Incident and will reasonably assist the Provider with legally required notifications. Notice is not an admission of fault or liability.

The Provider is responsible for determining whether to notify Data Subjects, regulators, or others, unless law assigns that duty directly to Base509. Base509 will not notify the Provider’s Data Subjects on the Provider’s behalf without authorization unless law requires Base509 to do so.

8. Data Subject requests

Taking into account the nature of the Processing, Base509 will provide Service functions and reasonable assistance for the Provider to respond to verified requests to access, know, correct, delete, restrict, object, or export Provider Personal Data.

If Base509 receives a request concerning Provider Personal Data directly from a Data Subject, Base509 will direct the person to the applicable Provider or notify the Provider, where legally permitted. Base509 will not independently fulfill the request except on the Provider’s documented instruction or as required by law.

If requested assistance requires material custom work beyond standard Service functions, Base509 may charge a reasonable fee based on the work required, unless Applicable Data Protection Law requires the assistance without charge.

9. Assessments, audits, and regulatory assistance

Base509 will provide information reasonably necessary for the Provider to conduct a data-protection impact assessment or legally required prior consultation concerning the Provider’s use of PetAppro.

No more than once in any 12-month period, the Provider may request Base509’s then-current security documentation, summaries of relevant independent assessments, or a written questionnaire reasonably tailored to the Processing. The annual limit does not apply after a Security Incident materially affecting the Provider or when a regulator requires additional review.

If the supplied information is insufficient to establish compliance, the Provider may request an audit by an independent, qualified auditor bound by confidentiality. The parties will agree in advance on scope, timing, duration, evidence handling, and security. The audit must avoid access to another customer’s data and unreasonable disruption. The Provider bears its audit costs unless the audit establishes Base509’s material breach of this DPA.

10. Return, deletion, and retention

During the Service term, the Provider may use available export functions. After Provider closure, Base509 will provide a 30-day read-only export period. At the Provider’s choice, Base509 will return or delete Provider Personal Data after the Service ends, unless law requires retention.

Base509 will delete Provider Personal Data from active systems within 30 days after the export period ends. Backup copies will be overwritten or rendered inaccessible through the regular backup cycle within 90 days after active-system deletion. Until deleted, backup and legally retained data remains protected by this DPA and is not returned to active use except for recovery, security, or legal necessity.

Base509 may retain minimized, access-restricted records necessary for accounting, automatic-renewal compliance, security, fraud prevention, payment disputes, legal claims, or another legal obligation. Precise service-location coordinates are deleted 90 days after the service, after which only a non-precise service summary may remain.

11. Subprocessors

The Provider gives general written authorization for Base509 to use the Subprocessors listed in Annex III. Base509 will impose written data-protection obligations that provide substantially equivalent protection appropriate to the Subprocessor’s services. Base509 remains responsible for a Subprocessor’s performance of its obligations to the extent required by Applicable Data Protection Law.

Base509 will give at least 30 days’ advance notice before authorizing a new Subprocessor that will Process Provider Personal Data. The Provider may object during that period on reasonable data-protection grounds. The parties will work in good faith on a commercially reasonable alternative. If no alternative is reasonably available, the Provider may terminate the affected Service before the new Subprocessor begins Processing and receive a prorated refund of prepaid Base509 subscription fees for the unused terminated period. An objection does not permit continued use of a Service that cannot be provided without the Subprocessor.

Emergency replacement needed to protect security, availability, or legal compliance may occur on shorter notice. Base509 will notify the Provider as soon as reasonably practicable.

12. Government and legal requests

Unless prohibited by law, Base509 will notify the Provider before disclosing Provider Personal Data in response to a government or third-party legal demand. Base509 will review the demand for facial validity, challenge unlawful or overbroad demands where there are reasonable grounds, and disclose only information legally required. Base509 may preserve data when lawfully required while a demand is evaluated.

13. International transfers

Provider Personal Data may be Processed in the United States and in other countries where authorized Subprocessors operate.

If the EU GDPR applies to a restricted transfer from the European Economic Area to Base509 in a country without an applicable adequacy decision, the parties incorporate the European Commission’s then-current Standard Contractual Clauses as follows:

  • Module Two applies to a Controller-to-Processor transfer, and Module Three applies when the Provider is a Processor and Base509 is its Subprocessor;
  • the optional docking clause applies;
  • Clause 9 uses Option 2 with a 30-day notice period;
  • the optional language in Clause 11 does not apply;
  • Clause 17 uses the law of Ireland;
  • Clause 18 selects the courts of Ireland;
  • Annexes I, II, and III of this DPA complete the corresponding SCC annexes; and
  • signatures to the Agreement constitute signatures to the SCCs.

For a restricted transfer governed by UK Data Protection Law, the United Kingdom International Data Transfer Addendum to the EU SCCs is incorporated and completed using the information in this DPA; the exporter may terminate the Addendum if a change to it creates a substantial, disproportionate increase in cost or risk and the parties cannot agree on a lawful alternative.

For transfers governed by Swiss law, the SCCs apply with references adapted to the Swiss Federal Act on Data Protection and the competent Swiss authority, and Data Subjects in Switzerland may enforce applicable rights in Switzerland.

If a required transfer mechanism becomes invalid, the parties will cooperate in good faith to implement another lawful mechanism. Nothing in this Section expands the territorial scope of a law that otherwise does not apply.

14. Liability and general terms

Each party’s liability arising from this DPA is subject to the exclusions and limits in the Agreement to the maximum extent permitted by Applicable Data Protection Law. Nothing in this DPA limits a Data Subject’s rights or a party’s liability to the extent it cannot lawfully be limited.

This DPA terminates when Base509 no longer Processes Provider Personal Data, except that provisions concerning confidentiality, security, deletion, audits, legal demands, liability, and international transfers survive for retained data.

The governing-law and dispute terms in the Agreement apply to this DPA, except where the SCCs or Applicable Data Protection Law require otherwise.

Annex I — Processing details

Subject matter and purpose

Base509 Processes Provider Personal Data to provide multi-tenant pet-care business software, including client and pet records, booking, scheduling, care documentation, communications, invoicing, Provider-connected payment records, staff administration, live service-location features, support, security, export, and related functions selected by the Provider.

Duration and frequency

Processing is continuous or as initiated by users during the Agreement term and the deletion periods in Section 10.

Categories of Data Subjects

  • Provider owners, administrators, managers, staff, contractors, and applicants entered by the Provider;
  • End Clients, household members, emergency contacts, and other persons included in Provider records;
  • veterinarians and other care or emergency contacts; and
  • persons appearing in communications, photographs, reports, invoices, or service records.

Categories of Provider Personal Data

  • names, contact details, account identifiers, roles, and business relationships;
  • service and billing addresses, emergency contacts, and home-access instructions;
  • pet profiles, photographs, veterinarian information, medications, behavior, and care instructions;
  • booking, schedule, assignment, check-in, check-out, report-card, communication, invoice, tip, tax, refund, and dispute records;
  • limited payment metadata and Provider-connected payment status;
  • staff availability, assignment, and active-service precise location coordinates;
  • device, session, access, security, and audit information associated with Provider use; and
  • support content and attachments submitted for the Provider.

Sensitive data and safeguards

Provider Personal Data may include precise location, home-access information, private communications, financial metadata, and information concerning pet health or medications. Safeguards include tenant isolation, row-level security, role-based access, multi-factor authentication for privileged roles, limited retention, access-controlled files, and encryption described in Annex II.

Annex II — Technical and organizational measures

Base509’s measures include:

  • a multi-tenant data model with business_id scoping and database row-level security for tenant data;
  • role-based access for Staff, Manager, Administrator, and Owner permissions;
  • time-based one-time-password multi-factor authentication required for Owners and Administrators;
  • recent reauthentication or verification for sensitive account actions;
  • encryption in transit using current transport security and encryption at rest supplied by infrastructure providers;
  • access-controlled or signed delivery for private stored files;
  • least-privilege production access, confidentiality duties, and access revocation;
  • environment separation and protection of service secrets from client applications and source control;
  • input validation, typed server boundaries, authorization checks, dependency review, code review, and test gates;
  • security, authentication, access, and change logging appropriate to the function;
  • monitored backups and restoration procedures with deletion through regular backup cycling;
  • tenant-isolation and authorization testing for protected data paths;
  • incident triage, containment, investigation, remediation, and notification procedures; and
  • vendor assessment and written data-protection terms appropriate to the service and risk.

Annex III — Authorized Subprocessors

Subprocessor Service Provider Personal Data and processing location
Supabase, Inc. Database, authentication, storage, Edge Functions, and backend infrastructure Account, Provider, client, pet, booking, file, location, and application data; United States and configured service regions
Vercel Inc. Web hosting, content delivery, and serverless infrastructure Request, account, application, and diagnostic data; United States and global delivery locations
Stripe, Inc. and affiliates Base509 subscription billing and Provider-connected payment processing Billing identity, transaction metadata, fraud, and payment data; locations described by Stripe
Resend, Inc. Transactional email delivery Names, email addresses, message content, delivery, and diagnostic data; United States
Google LLC Google Workspace, Google Maps Platform, authentication, and device-platform services Support communications, map inputs, coordinates, identifiers, and authentication data; global locations described by Google
Apple Inc. Authentication, application distribution, and device-platform services Account identifiers, application, device, and notification data; global locations described by Apple
650 Industries, Inc. (Expo) Mobile build, update, delivery, and notification infrastructure Application, device, account identifier, notification, and diagnostic data; United States and global infrastructure locations
Functional Software, Inc. (Sentry) Error, crash, and performance monitoring Pseudonymous account, tenant, role, device, application, error, and diagnostic data; United States and configured locations

Stripe, Google, and Apple may act as independent Controllers for portions of payment, fraud-prevention, identity, app-store, mapping, or platform Processing governed by their own terms. Listing those functions here does not change their legally assigned role.

Contact

Base509 LLC, 1875 Mission Street, Suite 103 #660, San Francisco, California 94103, United States
support@base509.com

Data Processing Addendum · Base509