Contract analysis

I. Parties and Roles The Draft designates VMS as the Data Controller and Meridian as the Data Processor with respect to all personal data and vehicle telemetry data processed pursuant to the agreement. In its capacity as Data Controller, VMS retains ultimate authority over the purposes and means of data processing, while Meridian, as Data Processor, is authorized to process data solely in accordance with VMS's docume

II. Scope of Data Processing The Draft addresses fourteen (14) categories of vehicle telemetry and in-cabin sensor data to be shared under the partnership, as follows: (1) GPS/geolocation data; (2) vehicle speed; (3) acceleration/deceleration metrics; (4) braking events; (5) tire pressure readings; (6) engine diagnostic codes (OBD-II); (7) fuel consumption data; (8) in-cabin temperature; (9) in-cabin humidity; (10) s

III. Data Volume and Population The partnership contemplates Meridian receiving and processing data from approximately eight hundred thousand (800,000) active VantageLink-equipped vehicles. This figure represents a subset of VMS's total install base of approximately 2.4 million connected vehicles and corresponds to those vehicles whose owners or lessees have affirmatively opted into VMS's "Connected Insights" data-sh

IV. Key Operative Provisions Highlighted for Counterparty Review We wish to highlight the following operative provisions of the Draft, which we anticipate may be areas of particular focus during your client's review and which we are prepared to discuss in detail: Data Retention. Article 7 of the Draft provides for a ninety (90)-day rolling deletion period for raw data following completion of processing. Upon expirati

V. Annexes The Draft includes three annexes, which are incorporated into and form an integral part of the DPA: Annex A — Data Categories. Annex A provides a detailed description of the fourteen (14) categories of vehicle telemetry and in-cabin sensor data within the scope of the DPA, including data field definitions, collection frequency, data format specifications, and the classification of GPS/geolocation data and

VI. Regulatory Framework The Draft has been prepared to address compliance with applicable United States federal and state privacy and data protection statutes, including the following: (a) the Michigan Identity Theft Protection Act, MCL § 445.61 et seq.; (b) the California Consumer Privacy Act, as amended by the California Privacy Rights Act of 2020, Cal. Civ. Code § 1798.100 et seq. ("CCPA/CPRA"); and (c) the feder

VII. Invitation for Comments and Proposed Timeline We invite Whitfield, Barrow & Crane and Meridian to review the enclosed Draft in its entirety and to provide a redlined version reflecting any comments, questions, and proposed revisions at your convenience. VMS is eager to finalize the DPA on a timeline consistent with the anticipated commercial launch of the data-sharing partnership, which, as contemplated by the L