Contract analysis

ARTICLE 1 — DEFINITIONS For purposes of this Agreement, the following terms shall have the meanings set forth below. Capitalized terms used but not otherwise defined in this Article 1 shall have the meanings ascribed to them elsewhere in this Agreement. 1.1 "Applicable Data Protection Laws" means the Michigan Identity Theft Protection Act (MCL 445.61 et seq.); the California Consumer Privacy Act as amended by the Cal

ARTICLE 2 — SCOPE AND PURPOSE OF PROCESSING 2.1 Subject Matter of Processing. Processor shall Process Controller Data solely for the purpose of providing connected-vehicle data analytics services as described in the LOI dated August 5, 2022, including the generation of predictive maintenance insights, driver behavior scoring, and fleet optimization analytics (collectively, the "Permitted Purposes"). Processor shall n

ARTICLE 3 — CONTROLLER OBLIGATIONS 3.1 Lawful Basis for Processing. Controller represents and warrants that it has obtained all necessary consents, authorizations, and permissions from Data Subjects through the Connected Insights Program to collect, share, and permit the processing of Controller Data by Processor for the Permitted Purposes described in this Agreement. Controller further represents and warrants that t

ARTICLE 4 — PROCESSOR OBLIGATIONS 4.1 Processing Instructions. Processor shall Process Controller Data solely in accordance with the Controller's documented instructions as provided pursuant to Section 3.6 and as otherwise set forth in this Agreement. Processor shall not Process Controller Data in any manner inconsistent with Controller's instructions unless required to do so by Applicable Data Protection Laws, in wh

ARTICLE 5 — SECURITY MEASURES 5.1 Minimum Security Standards. Processor shall implement and maintain, throughout the Term, the Technical and Organizational Measures described in Annex B, which shall constitute the minimum security standards for the Processing of Controller Data. Without limiting the detailed requirements set forth in Annex B, such measures shall include, at a minimum: (a) Encryption. Encryption of Co

ARTICLE 6 — DATA BREACH NOTIFICATION AND RESPONSE 6.1 Notification Obligation. [OPEN ISSUE — VMS POSITION] Processor shall notify Controller of any Personal Data Breach without undue delay and in any event within [twenty-four (24) hours] of Processor becoming aware of such breach. For purposes of this Section 6.1, Processor shall be deemed to have become "aware" of a Personal Data Breach at the time any employee, off

ARTICLE 7 — SUB-PROCESSORS 7.1 General Restriction. [OPEN ISSUE — VMS POSITION] Processor shall not engage, appoint, or authorize any Sub-Processor to Process Controller Data on behalf of Controller without the prior written consent of Controller. [Note: Meridian has proposed a general authorization model under which Processor would be authorized to engage Sub-Processors, subject to providing Controller with thirty (

ARTICLE 8 — INTERNATIONAL DATA TRANSFERS 8.1 Restriction on International Transfers. Processor shall not transfer, transmit, access, or Process Controller Data outside the continental United States without the prior written consent of Controller. This restriction applies to all forms of transfer, including remote access by personnel located outside the continental United States, storage or backup of Controller Data a

ARTICLE 9 — AUDIT RIGHTS 9.1 Controller Audit Rights. [OPEN ISSUE — VMS POSITION] Controller shall have the right to conduct [on-site audits] of Processor's data processing facilities, systems, and records to verify Processor's compliance with this Agreement, including Processor's compliance with the Technical and Organizational Measures set forth in Annex B, the data retention and deletion requirements set forth in

ARTICLE 10 — DATA RETENTION AND DELETION 10.1 Retention Period. [OPEN ISSUE — VMS POSITION] Processor shall retain raw Controller Data only for so long as reasonably necessary to perform the Processing purposes set forth in this Agreement and shall delete or return all raw Controller Data within [ninety (90) days] of initial Processing. [Note: VMS proposes a ninety (90) day rolling deletion cycle for raw Controller D