Contract analysis

ARTICLE 1 — DEFINITIONS AND INTERPRETATION

Section 1.1 — Definitions As used in this DPA, the following capitalized terms shall have the meanings set forth below. Capitalized terms used but not defined in this Article 1 shall have the meanings ascribed to them elsewhere in this DPA. "Applicable Data Protection Laws" means all applicable federal, state, and local laws, statutes, regulations, rules, ordinances, and binding guidance relating to the privacy, prot

Section 1.2 — Interpretation The following rules of interpretation shall apply to this DPA: (a) References to any statute, law, regulation, rule, or ordinance shall be deemed to include references to such statute, law, regulation, rule, or ordinance as amended, supplemented, re-enacted, or replaced from time to time, and to any successor statute, law, regulation, rule, or ordinance. (b) The headings, captions, and se

ARTICLE 2 — SCOPE AND PURPOSE OF PROCESSING

Section 2.1 — Scope of Processing Processor shall process Controller Data solely as described in this DPA and in accordance with Controller's documented instructions as set forth herein and as may be supplemented from time to time pursuant to Article 3 of this DPA. The Processing covered by this DPA encompasses fourteen (14) categories of Vehicle Telemetry Data and in-cabin sensor data as set forth in Annex A attache

Section 2.2 — Purpose of Processing Processor is authorized to process Controller Data solely for the following specified and limited purposes (collectively, the "Permitted Purposes"): (a) generating predictive maintenance insights for Controller's vehicle fleet, including but not limited to component failure predictions, maintenance scheduling recommendations, and warranty risk analyses; (b) producing driver behavio

Section 2.3 — Controller's Responsibilities Controller represents and warrants to Processor that: (a) Controller has obtained, and will continue to maintain throughout the term of this DPA, all necessary consents, authorizations, and legal bases from Data Subjects under the Connected Insights Program that are required under Applicable Data Protection Laws for the collection, transmission, and sharing of Controller Da

Section 2.4 — Processor's Role Processor acts as a data processor and, where applicable, as a "service provider" (as defined under the CCPA/CPRA) on behalf of Controller with respect to Controller Data. Processor processes Controller Data solely on behalf of and under the direction of Controller, and Processor does not determine the purposes or means of Processing Controller Data except to the extent necessary to car

ARTICLE 3 — CONTROLLER'S INSTRUCTIONS

Section 3.1 — Documented Instructions Processor shall process Controller Data only in accordance with Controller's written instructions, as documented in this DPA, the Annexes attached hereto, and any subsequent written instructions provided by Controller pursuant to this Article 3. The Permitted Purposes set forth in Section 2.2, together with the data handling, security, retention, and deletion requirements set for

Section 3.2 — Additional Instructions Controller may issue additional processing instructions in writing to Processor at any time during the term of this DPA. Processor shall implement such additional instructions within a commercially reasonable timeframe, taking into account the nature and complexity of the instruction, the technical changes required, and any impact on the ongoing provision of the Services. If any

Section 4.1 — Confidentiality Obligations Processor shall maintain the strict confidentiality of all Controller Data and shall not disclose, publish, release, transfer, or otherwise make available Controller Data to any third party except: (a) as permitted or required by this DPA; (b) to Approved Sub-Processors in accordance with Article 7; (c) to Processor's personnel who require access in accordance with Section 4.

Section 4.2 — Personnel Obligations Processor shall ensure that access to Controller Data is strictly limited to those personnel who require access to Controller Data to perform the Services and who have a documented business need to access such data. Processor shall maintain and enforce access control policies that restrict Controller Data access to the minimum number of personnel necessary for the performance of th

Section 4.3 — Compelled Disclosure If Processor receives a subpoena, court order, warrant, regulatory inquiry, or other legal demand or compulsory process requiring or purporting to require the disclosure of Controller Data (a "Legal Demand"), Processor shall, to the extent legally permissible: (a) promptly notify Controller in writing of the Legal Demand, and in no event later than forty-eight (48) hours after recei

ARTICLE 5 — DATA RETENTION AND DELETION

Section 5.1 — Retention Period Processor shall retain raw Controller Data for a period not to exceed ninety (90) days from the date of initial receipt of each data record (the "Retention Period"). The Retention Period is intended to provide Processor with sufficient time to perform the Processing necessary to generate the insights and analytics contemplated by the Permitted Purposes, while ensuring that raw Controlle

Section 5.2 — Rolling Deletion Deletion of raw Controller Data shall occur on a continuous, rolling basis. Raw Controller Data ingested on any given calendar date shall be deleted no later than ninety (90) days after the date of ingestion, regardless of whether Processing of such data has been completed. Processor shall implement, maintain, and test automated deletion protocols sufficient to ensure compliance with th

Section 5.3 — Derived Data and Aggregated Data Processor may retain de-identified, aggregated, or anonymized data derived from Controller Data beyond the ninety (90)-day Retention Period (such data, "Derived Data"), provided that the following conditions are satisfied: (a) the Derived Data cannot reasonably be used, either alone or in combination with other information available to Processor, to identify any individu

Section 5.4 — Deletion Upon Termination Upon termination or expiration of this DPA (or the underlying commercial agreement between the Parties, whichever occurs first), Processor shall, at Controller's election, communicated in writing within thirty (30) days of the effective date of termination or expiration, either: (a) return all Controller Data to Controller in a commercially standard, machine-readable format rea

Section 5.5 — Sensitive Vehicle Data Retention Notwithstanding anything in Section 5.3 to the contrary, Processor shall not retain any Sensitive Vehicle Data — specifically GPS/geolocation data (Data Category No. 1) and seat occupancy data (Data Category No. 10) — beyond the ninety (90)-day Retention Period under any circumstances, including in derived, aggregated, anonymized, de-identified, or any other form, unless

ARTICLE 6 — SECURITY AND TECHNICAL AND ORGANIZATIONAL MEASURES

Section 6.1 — Security Obligations Processor shall implement and maintain appropriate technical and organizational measures to protect Controller Data against unauthorized or unlawful processing, accidental loss, destruction, damage, alteration, disclosure, or access. The specific measures required under this Article 6 are set forth in detail in Annex B attached hereto. Such measures shall be appropriate to the natur

Section 6.2 — Minimum Security Requirements Without limiting the generality of Section 6.1, Processor shall implement and maintain, at a minimum, the following security measures with respect to Controller Data: (a) Encryption. Encryption of all Controller Data at rest using the Advanced Encryption Standard with a minimum key length of 256 bits (AES-256) or equivalent, and encryption of all Controller Data in transit

Section 6.3 — Updates to Security Measures Processor shall review and, as necessary, update the Technical and Organizational Measures set forth in Annex B on at least an annual basis to account for evolving threats, vulnerabilities, technological developments, and industry standards. Processor shall promptly notify Controller of any material changes to its Technical and Organizational Measures. Processor shall not di

Section 7.1 — Prior Written Consent Required Processor shall not engage any Sub-Processor to process Controller Data without the prior written consent of Controller. Processor's request for consent shall be submitted in writing and shall identify: (a) the name and legal entity of the proposed Sub-Processor; (b) the Sub-Processor's location(s) of processing, including the physical addresses of all facilities where Con

Section 7.2 — Approved Sub-Processors As of the Effective Date, the Sub-Processors listed in Annex C attached hereto are approved by Controller for the processing activities described therein. The initial Approved Sub-Processor is: Cloudvault Infrastructure, Inc., a corporation organized under the laws of the State of Nevada, with headquarters at 200 Mill Street, Suite 100, Reno, NV 89501, which will host and process

Section 7.3 — Sub-Processor Agreements Prior to any Sub-Processor commencing the Processing of Controller Data, Processor shall enter into a written agreement with the Sub-Processor that imposes data protection and data security obligations no less protective than those imposed on Processor under this DPA. Such agreement shall include, at a minimum, the following provisions: (a) confidentiality obligations at least a

Section 7.4 — Processor Liability for Sub-Processors Processor shall remain fully liable to Controller for the acts, omissions, failures, breaches, and negligence of any Sub-Processor engaged pursuant to this Article 7 to the same extent as if such acts, omissions, failures, breaches, or negligence were those of Processor itself. The engagement of any Sub-Processor shall not relieve Processor of any of its obligation

Section 7.5 — New Sub-Processor Requests If Processor wishes to engage a new Sub-Processor that is not listed in Annex C at the time of the request, Processor shall provide Controller with written notice at least forty-five (45) days prior to the proposed engagement, which notice shall include: (a) the information specified in Section 7.1(a) through (d); (b) a completed Sub-Processor due diligence questionnaire in th

ARTICLE 8 — DATA BREACH NOTIFICATION

Section 8.1 — Notification Obligation Processor shall notify Controller of any Data Breach without undue delay and in no event later than twenty-four (24) hours after Processor becomes aware, or reasonably should have become aware, of the Data Breach. For purposes of this Section, Processor shall be deemed to be "aware" of a Data Breach at the time any employee, officer, contractor, or agent of Processor (including a

Section 8.2 — Content of Notification Processor's initial notification to Controller shall include, to the extent then known and available: (a) the nature and circumstances of the Data Breach, including the date and time of discovery, the likely date and time of the breach, and a description of how the breach was discovered; (b) the categories and approximate number of Data Subjects affected by the Data Breach; (c) t

Section 8.3 — Supplemental Information Processor shall provide supplemental information regarding the Data Breach to Controller as it becomes available, without undue delay. Processor shall provide updates to Controller at least every twenty-four (24) hours during the initial response phase and at regular intervals thereafter as mutually agreed by the Parties. Processor shall cooperate fully with Controller's investi

Section 8.4 — No Independent Notification Processor shall not notify any Data Subject, regulatory authority, law enforcement agency, media outlet, or other third party of a Data Breach involving Controller Data without Controller's prior written consent, unless Processor is required to provide such notification by Applicable Data Protection Laws. In the event that Applicable Data Protection Laws require Processor to

Section 8.5 — Remediation Processor shall take all commercially reasonable steps to contain, investigate, and remediate any Data Breach and to prevent recurrence of the same or similar breaches. Remediation efforts shall include, without limitation, patching vulnerabilities, strengthening access controls, enhancing monitoring, and implementing any additional measures necessary to address the root cause of the breach.

ARTICLE 9 — DATA TRANSFERS AND DATA LOCALIZATION

Section 9.1 — Data Localization Processor shall process and store all Controller Data exclusively within the United States of America unless otherwise authorized in writing by Controller. This data localization requirement applies to all forms of Controller Data, including raw data, processed data, derived data, backup copies, archived copies, and cached copies. As of the Effective Date, Controller Data shall be proc

Section 9.2 — Restriction on International Transfers Processor shall not transfer, transmit, access, or permit access to Controller Data from or in any location outside of the United States of America without the prior written consent of Controller. This restriction applies to all forms of transfer, including electronic transmission, remote access by personnel located outside the United States, mirroring, replication

Section 9.3 — GDPR Considerations The Parties acknowledge that, as of the Effective Date, no EU/EEA data subjects are within the known scope of this DPA, and Controller Data is not expected to include personal data of individuals located in the European Union or European Economic Area. However, in the event that Controller Data is or becomes subject to the GDPR, whether by reason of a transfer to or processing in a j

ARTICLE 10 — AUDIT AND INSPECTION RIGHTS

Section 10.1 — Controller's Audit Rights Controller shall have the right to conduct on-site audits and inspections of Processor's facilities, systems, records, policies, procedures, and practices related to the Processing of Controller Data to verify Processor's compliance with this DPA and Applicable Data Protection Laws. Controller may exercise such audit rights at any time during regular business hours upon ten (1

Section 10.2 — Scope of Audits Audits conducted pursuant to this Article 10 may include, without limitation: (a) review and assessment of Processor's Technical and Organizational Measures and verification of compliance with the requirements set forth in Annex B; (b) inspection of physical and logical security controls at all locations where Controller Data is processed or stored, including Processor's data operations

Section 10.3 — Cooperation Processor shall cooperate fully with Controller's audits and inspections and shall provide all reasonably requested information, documentation, access to systems, and access to facilities in a timely manner. Processor shall not impose unreasonable conditions, fees, or restrictions on Controller's exercise of its audit rights. Processor shall make available its Head of Data Governance, or an

Section 10.4 — Audit Costs Each Party shall bear its own costs in connection with audits conducted under this Article 10. Processor shall bear its own internal costs, including the costs of personnel time, facility access, and document production. Controller shall bear the costs of its own auditors, inspectors, and representatives. Notwithstanding the foregoing, if an audit reveals a material non-compliance by Proces

Section 10.5 — Third-Party Auditors Controller may engage qualified third-party auditors, consultants, or inspectors to conduct audits on its behalf under this Article 10, provided that such third-party auditors are bound by written confidentiality obligations no less protective than those set forth in Article 4 of this DPA. Controller shall be responsible for ensuring that its third-party auditors comply with such c

Section 10.6 — Sub-Processor Audits Controller's audit and inspection rights under this Article 10 shall extend to all Approved Sub-Processors engaged by Processor to process Controller Data. Controller may conduct audits of Sub-Processors directly or may instruct Processor to conduct audits of Sub-Processors on Controller's behalf. Processor shall ensure that its written agreements with all Sub-Processors include eq

ARTICLE 11 — DATA SUBJECT RIGHTS

Section 11.1 — Assistance with Data Subject Requests Processor shall promptly assist Controller in responding to requests from Data Subjects to exercise their rights under Applicable Data Protection Laws. Such rights include, without limitation, the rights of access, deletion, correction, portability, restriction of processing, and opt-out (including the right to opt out of the sale or sharing of Personal Information

Section 11.2 — Notification of Requests If Processor receives a request directly from a Data Subject seeking to exercise any right under Applicable Data Protection Laws with respect to Controller Data, Processor shall not respond to the Data Subject directly (except to acknowledge receipt and redirect the Data Subject to Controller) and shall: (a) promptly redirect the Data Subject to Controller, providing the Data S

Section 11.3 — CCPA/CPRA Specific Obligations Given that approximately 112,000 of the 800,000 opted-in vehicles participating in the Connected Insights Program are registered in the State of California, representing approximately fourteen percent (14%) of the Data Subject population, Processor acknowledges and agrees that the CCPA/CPRA applies to a material portion of the Controller Data processed under this DPA. In

Section 11.4 — DPPA Specific Obligations To the extent Controller Data includes "personal information" as defined under the Drivers' Privacy Protection Act, 18 U.S.C. § 2721(a)(2), including without limitation information linked to motor vehicle records through Vehicle Identification Numbers, Processor acknowledges and agrees that such information is subject to the protections and restrictions of the DPPA. In further