Legal · Mutual NDA

Client NDA · Rental Growth Advisors · Version 1.0 (25 August 2026) · Governed by Spanish law

This English version is the binding text. The Spanish and Portuguese versions are courtesy translations. This is the agreement you accept when you tick the NDA box at checkout. RGA sends you the completed copy, with your details in Annex A, in your confirmation email.

BETWEEN

RENTAL GROWTH ADVISORS CONSULTANCY, S.L., a limited liability company (sociedad de responsabilidad limitada) incorporated under the laws of Spain, with registered office at Calle Lepant 270, Bajos, 08013 Barcelona, Spain, holding Spanish Tax ID (NIF) B93915577, registered with the Commercial Registry (Registro Mercantil) of Barcelona, Sheet (Hoja) 662060, EUID ES08005.000753523, email admin@rentalgrowthadvisors.com (hereinafter, "RGA"). RGA acts through its joint directors (administradores mancomunados), whose appointment and powers of representation are recorded in the public Commercial Registry entry identified above. RGA's execution of this Agreement is evidenced as set out in Clause 15.

And the client identified in the Client Schedule (Annex A) with the details provided at checkout, acting through the person who completes the checkout, who confirms that he or she is authorised to bind the Client (hereinafter, the "Client").

RGA and the Client may be referred to individually as a "Party" and jointly as the "Parties". In each disclosure of information, the Party disclosing it is the "Disclosing Party" and the Party receiving it is the "Receiving Party"; each Party may act in either capacity.

The Client confirms that it acts in a business or professional capacity, as an owner, operator or manager of short-term rental accommodation, and not as a consumer. The Parties acknowledge that they have sufficient legal capacity to enter into this Mutual Non-Disclosure Agreement (the "Agreement") and, to that end,

RECITALS

I. RGA provides advisory, diagnostic, optimisation and training services to owners, operators and managers of short-term rental accommodation, including listing and portfolio diagnostics, visibility programmes, rating recovery and the RGA Academy (the "Services"), as described at rentalgrowthadvisors.com and in RGA's Terms of Service (rentalgrowthadvisors.com/legal).

II. To deliver the Services, the Client will share information about its listings, performance and operations, and RGA will share its proprietary methodology, analyses, reports and recommendations.

III. RGA's policy is that a mutual NDA is in place with every client before any paid work starts. This Agreement implements that policy and governs all Services the Client purchases from RGA, now or in the future, unless the Parties sign a separate agreement that expressly replaces it.

Now, therefore, the Parties agree as follows:

CLAUSES

1. Purpose and scope

1.1. This Agreement sets out the terms governing the exchange and protection of Confidential Information disclosed between the Parties in connection with the Services (the "Purpose").

1.2. This Agreement is a framework agreement: it applies to the Service identified in Annex A and to any further Service the Client purchases from RGA, without the need to accept it again for each purchase.

2. Confidential Information

2.1. "Confidential Information" means any information, in any form or medium (oral, written, electronic, visual or otherwise), disclosed by one Party to the other before or during the term of this Agreement in connection with the Purpose, including without limitation technical, commercial, financial, legal, strategic, organisational or operational information, know-how, trade secrets, business plans, prices, methods, software, databases, designs, client and supplier lists, personal data and any documentation derived from any of the foregoing.

2.2. Client Confidential Information includes, in particular: listing and property data, calendars, occupancy, pricing and revenue figures, guest reviews and communications, screenshots or exports from booking platforms, account settings, and the Client's business plans.

2.3. RGA Confidential Information includes, in particular: RGA's methodology, frameworks, scoring models, audit and diagnostic templates, checklists, tools and prompts; all reports, analyses, rewritten content, recommendations and other work product delivered to the Client (the "Deliverables"); training materials of the RGA Academy; unpublished prices, discounts and commercial terms; the content of proposals and calls; and the identity, background, current or former employers and personal details of RGA's founders, staff, contractors and advisors.

2.4. Information is protected whether or not it is marked as "confidential", provided that, by its nature or by the circumstances of its disclosure, it should reasonably be understood to be confidential.

3. Exclusions

Confidential Information does not include information that the Receiving Party can demonstrate with written records: (a) was lawfully in its possession, free of any duty of confidentiality, before its disclosure; (b) is or becomes publicly available through no breach of this Agreement; (c) is lawfully received from a third party entitled to disclose it without restriction; or (d) was independently developed by the Receiving Party without use of or reference to the Confidential Information. The Deliverables are not "publicly available" merely because they are based on information visible on a booking platform.

4. Obligations of the Receiving Party

4.1. The Receiving Party shall: (a) use the Confidential Information solely for the Purpose; (b) keep it strictly confidential, applying at least the same degree of care it applies to its own confidential information and in any event no less than reasonable care; (c) not disclose it to any third party without the prior written consent of the Disclosing Party; (d) limit access to those directors, employees, advisors or contractors who need to know it for the Purpose and who are bound by confidentiality obligations no less strict than those set out herein, the Receiving Party remaining liable for their compliance; (e) not copy or reproduce it beyond what is strictly necessary for the Purpose; and (f) not reverse-engineer, decompile, disassemble or attempt to reconstruct any method, model or material provided.

4.2. In addition, the Client shall not: (a) share, forward, publish or post the Deliverables or any part of RGA's methodology, in whole or in part, with or to any third party, including other consultants, agencies, co-hosts, property managers, competitors of RGA, online forums, groups or social media; (b) use RGA Confidential Information to provide advisory, optimisation or training services to third parties, or to build, train or improve any product or service that competes with the Services; or (c) use the Deliverables for any listing or property other than those covered by the Service purchased, unless RGA agrees otherwise in writing.

4.3. If the Receiving Party is required by law, regulation or a competent authority to disclose Confidential Information, it shall, where legally permitted, promptly notify the Disclosing Party, disclose only the minimum required and cooperate reasonably in seeking protective treatment.

5. Permitted use by RGA

5.1. The Client authorises RGA to: (a) share Client Confidential Information with RGA's founders, staff, contractors and service providers (including hosting, email, payment, scheduling, analytics and AI-assisted analysis tools) to the extent necessary to deliver the Services, provided they are bound by confidentiality obligations; (b) create and use anonymised and aggregated data derived from the Services that does not identify the Client, its listings or its guests, for benchmarking, research, product improvement and marketing; and (c) retain working copies of the Deliverables and related materials for its records, quality control and the defence of legal claims.

5.2. RGA may describe the Client's engagement as an anonymised case study (with no name, brand, listing link or identifiable image) without further consent. Any reference that identifies the Client by name, brand or listing requires the Client's prior consent, which may be given by email.

6. Deliverables and intellectual property

6.1. All RGA Confidential Information, the Deliverables and any intellectual and industrial property rights therein (including copyright, know-how, methods, templates and trademarks) are and remain the exclusive property of RGA. Nothing in this Agreement or in the Services transfers any such right to the Client.

6.2. RGA grants the Client a non-exclusive, non-transferable, non-sublicensable licence to use the Deliverables internally, for the listings or properties covered by the Service purchased, for the Client's own business. This licence terminates automatically if the Client breaches this Agreement, in which case the Client shall cease all use of the Deliverables and destroy all copies.

6.3. The Client retains ownership of its own data and grants RGA a non-exclusive licence to use it as needed to deliver the Services and as permitted in Clause 5.

6.4. Residual knowledge. Nothing in this Agreement prevents RGA from using the general skills, knowledge, ideas and experience retained in the unaided memory of its team as a result of the Services, provided RGA does not disclose Client Confidential Information.

6.5. Feedback. Any suggestion, comment or improvement idea that the Client provides about the Services may be used by RGA freely and without compensation.

6.6. The disclosure of Confidential Information does not grant the Receiving Party any licence, assignment or right over the intellectual or industrial property of the Disclosing Party other than as expressly set out in this Clause.

7. Trade secrets and disclosure of secrets

7.1. The Parties acknowledge that Confidential Information may constitute a trade secret within the meaning of Spanish Law 1/2019 of 20 February on Trade Secrets and Directive (EU) 2016/943, and undertake to refrain from any unlawful acquisition, use or disclosure of trade secrets under that Law.

7.2. The Parties are aware that the unlawful disclosure of secrets may give rise not only to civil liability but also to criminal liability, including the offences set out in Articles 197 to 201 and 278 to 280 of the Spanish Criminal Code.

8. Data protection

8.1. Each Party shall process personal data received from the other in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 of 5 December (LOPDGDD), and, where applicable, the data protection laws of the Client's country.

8.2. Each Party acts as an independent controller of the contact details of the other Party's representatives, processing them solely to manage the relationship arising from the Services, on the basis of its legitimate interest and for the period necessary. Data subjects may exercise their rights of access, rectification, erasure, objection, restriction and portability by writing to admin@rentalgrowthadvisors.com or to the Client's contact address in Annex A.

8.3. The Client shall share only the personal data of guests or third parties that is necessary for the Services (for example, review text) and shall, where practicable, remove or pseudonymise guest names. The Client warrants that it is entitled to share the data it shares. To the extent RGA processes personal data on behalf of the Client, the data processing terms in Annex B apply, in accordance with Article 28 GDPR.

9. Term

9.1. This Agreement enters into force on the date of the Client's acceptance stated in Annex A and remains in force for as long as the Client purchases or receives Services from RGA.

9.2. The confidentiality obligations survive termination and remain in force for FIVE (5) YEARS from the completion of the last Service, without prejudice to (a) information constituting a trade secret, which remains protected for as long as it retains that status under Law 1/2019, and (b) the obligations in Clause 6 and Clause 4.2, which remain in force for as long as RGA holds rights in the Deliverables and methodology concerned.

10. Return and destruction

Upon the first written request of the Disclosing Party, and in any event when the licence in Clause 6.2 terminates, the Receiving Party shall return or, at the Disclosing Party's option, destroy all Confidential Information of the Disclosing Party and any copies thereof, certifying such destruction in writing where requested. The Receiving Party may retain copies that must be kept by law or under bona fide back-up or compliance policies, and RGA may retain the materials referred to in Clause 5.1(c); all retained copies remain subject to this Agreement.

11. No warranty; relationship with the Terms of Service

11.1. Confidential Information is provided "as is". This Agreement does not oblige either Party to disclose any specific information or to enter into any further agreement.

11.2. The Services themselves (scope, price, delivery, guarantee, liability) are governed by RGA's Terms of Service at rentalgrowthadvisors.com/legal. In the event of conflict, this Agreement prevails on confidentiality and intellectual property matters and the Terms of Service prevail on all other matters.

12. Remedies and liability

12.1. Breach of this Agreement entitles the aggrieved Party to compensation for the damages caused, in accordance with Articles 1101 et seq. of the Spanish Civil Code, and to any other remedy available at law, including the measures provided for in Law 1/2019 on Trade Secrets. The Parties acknowledge that a breach may cause harm that is difficult to repair and that the aggrieved Party may seek interim and injunctive relief.

12.2. Penalty clause. For each unauthorised disclosure or use of the other Party's Confidential Information, the breaching Party shall pay the aggrieved Party a penalty of EUR 5,000 (five thousand euros), which the Parties agree is proportionate to the harm foreseeable at the date of this Agreement. Pursuant to Article 1153 of the Spanish Civil Code, this penalty is cumulative with, and does not replace, compensation for damages exceeding that amount and the other remedies in this Clause.

12.3. Except in cases of wilful misconduct (dolo) or gross negligence, RGA's aggregate liability to the Client under this Agreement, including any penalty under Clause 12.2, shall not exceed the total fees paid by the Client to RGA in the twelve (12) months preceding the event giving rise to the claim.

12.4. The Client shall indemnify RGA against any claim by a third party (including guests and booking platforms) arising from the Client sharing data it was not entitled to share.

13. Notices

Any notice under this Agreement shall be made in writing by email to admin@rentalgrowthadvisors.com (RGA) or to the Client's email address stated in Annex A, or to any replacement address notified in writing. A notice is deemed served when its receipt can be evidenced (for example, by a reply or a delivery record).

14. Miscellaneous

14.1. Entire agreement. This Agreement, together with the Terms of Service referred to in Clause 11.2, constitutes the entire understanding between the Parties regarding confidentiality and intellectual property in connection with the Services and supersedes any prior agreement on that subject matter.

14.2. Severability. If any provision is declared null or unenforceable, the remaining provisions remain in full force, and the Parties shall replace the affected provision with a valid one of equivalent effect.

14.3. No waiver. Failure or delay in exercising any right does not constitute a waiver of that right.

14.4. Assignment. The Client may not assign its position under this Agreement without RGA's prior written consent. RGA may assign this Agreement to any successor of its business or to a company of its group, giving notice to the Client.

14.5. Amendments. Any amendment must be made in writing and accepted by both Parties. RGA may publish updated versions of this NDA for future purchases; the version accepted by the Client is the version identified in Annex A.

14.6. Independent parties. Nothing in this Agreement creates a partnership, joint venture, agency or employment relationship between the Parties.

15. Electronic execution and evidence

15.1. Client acceptance. The Client accepts this Agreement by ticking the acceptance box and completing the checkout on rentalgrowthadvisors.com. That act constitutes the Client's electronic consent and signature. In accordance with Articles 23 and 24 of Spanish Law 34/2002 on Information Society Services and Electronic Commerce (LSSI), Article 25 of Regulation (EU) 910/2014 (eIDAS) and Law 6/2020, contracts concluded electronically produce all the effects provided for by law, and the electronic record of acceptance is admissible as documentary evidence.

15.2. RGA execution. This version of the Agreement has been approved and executed on behalf of RGA by its joint directors before publication. RGA's issuance of the completed copy of this Agreement from its systems to the Client's email address, bearing the unique reference in Annex A, constitutes RGA's execution and delivery of the Agreement. On the Client's written request, RGA will provide a copy signed by its representatives with a qualified electronic signature or by hand.

15.3. Record. RGA keeps an acceptance record containing the date and time of acceptance, the checkout reference, the version of the NDA accepted and, where available, the IP address used. The Parties agree that this record, together with the completed copy of this Agreement, is sufficient evidence of the conclusion and content of the Agreement, and waive any objection to its validity on the sole ground that it was concluded electronically or without handwritten signatures.

15.4. The Client may request a copy of this Agreement at any time by writing to admin@rentalgrowthadvisors.com.

16. Language, governing law and jurisdiction

16.1. This Agreement is made in English, with courtesy translations into Spanish and Portuguese. In the event of any discrepancy, the English version prevails.

16.2. This Agreement is governed by and construed in accordance with Spanish law.

16.3. For the resolution of any dispute arising from the interpretation or performance of this Agreement, the Parties, expressly waiving any other jurisdiction to which they may be entitled, submit to the Courts and Tribunals of the city of Barcelona, Spain. If, notwithstanding Clause 1 and the Client's confirmation above, mandatory consumer-protection rules apply to the Client, those rules prevail over this Clause to the extent required.

EXECUTION

Executed electronically as set out in Clause 15. The Parties' identification and acceptance details are recorded in Annex A.

ANNEX A. CLIENT SCHEDULE

Details provided by the Client at checkout and recorded by RGA at the time of acceptance.

ANNEX B. DATA PROCESSING TERMS (ARTICLE 28 GDPR)

1. Scope. These terms apply only where RGA processes personal data on behalf of the Client in the course of the Services (for example, guest names contained in reviews or messages shared by the Client). The Client is the controller and RGA is the processor.

2. Subject matter and duration. Processing of listing, guest and booking data shared by the Client for the purpose of analysing and improving the Client's listings, for the duration of the Services and the retention period in Clause 10.

3. Instructions. RGA processes the data only on the Client's documented instructions, which are set out in the Service purchased and in this Agreement, unless required otherwise by EU or Member State law, in which case RGA will inform the Client where legally permitted.

4. Confidentiality and security. RGA ensures that persons authorised to process the data are bound by confidentiality, and implements appropriate technical and organisational measures, including access controls, encrypted storage and transmission through its service providers, and least-privilege access.

5. Sub-processors. The Client gives general authorisation for RGA to use sub-processors for hosting, email, payment, scheduling, analytics and AI-assisted analysis (currently including Google Workspace, Cloudflare, Framer, Stripe, Resend, Calendly and the analysis tools RGA uses). RGA will inform the Client of intended changes on request and the Client may object on reasonable data-protection grounds. Transfers outside the EEA are made under the EU-US Data Privacy Framework, Standard Contractual Clauses or another valid transfer mechanism.

6. Assistance. Taking into account the nature of the processing, RGA assists the Client, as far as reasonably possible, in responding to data-subject requests and in complying with its obligations on security, breach notification and impact assessments. RGA notifies the Client without undue delay after becoming aware of a personal data breach affecting the Client's data.

7. Deletion. At the end of the Services, RGA deletes or returns the personal data processed on behalf of the Client, except for the copies it may retain under Clause 10 and Clause 5.1(c), which remain subject to this Agreement.

8. Information and audit. RGA makes available the information necessary to demonstrate compliance with Article 28 GDPR and allows for audits conducted by the Client or an auditor mandated by the Client, on reasonable written notice, no more than once a year, at the Client's cost and without access to the confidential information of other clients.