CALDERWOOD & HARKNESS LLP Attorneys at Law 1 Liberty Plaza, 38th Floor New York, NY 10006

October 7, 2022

Via Email and First Class Mail

Catherine Ng, Esq. Partner, Privacy & Cybersecurity Whitfield, Barrow & Crane LLP 555 California Street, Suite 3200 San Francisco, CA 94104

Re: Data Processing Agreement between Vantage Mobility Systems Corp. and Meridian Telematics Solutions, Inc. Our Matter No.: 1007-00007

Dear Ms. Ng:

This firm represents Vantage Mobility Systems Corp. ("VMS"), a Delaware corporation headquartered in Auburn Hills, Michigan, in connection with the above-referenced matter. We write to transmit the enclosed initial draft Data Processing Agreement (Version 1.0), dated September 28, 2022 (the "DPA" or "Draft"), between VMS, acting in its capacity as Data Controller, and Meridian Telematics Solutions, Inc. ("Meridian"), acting in its capacity as Data Processor. The DPA has been prepared in connection with the connected-vehicle data-sharing partnership contemplated by the non-binding Letter of Intent executed by VMS and Meridian on August 5, 2022 (the "LOI"). The enclosed Draft comprises forty-seven (47) pages, including the body of the agreement and three annexes, as described more fully below. We respectfully request that you review the Draft with your client and provide your comments at your earliest convenience.

For your reference, we provide below a summary of the key structural features of the Draft and certain provisions that we anticipate may be of particular interest to Meridian in its review.

I. Parties and Roles

The Draft designates VMS as the Data Controller and Meridian as the Data Processor with respect to all personal data and vehicle telemetry data processed pursuant to the agreement. In its capacity as Data Controller, VMS retains ultimate authority over the purposes and means of data processing, while Meridian, as Data Processor, is authorized to process data solely in accordance with VMS's documented instructions and the terms of the DPA. The DPA governs Meridian's processing and analysis of real-time telematics and in-cabin sensor data collected from VMS's proprietary VantageLink connected-vehicle platform, which is installed across VMS's fleet of consumer and commercial vehicles in the United States.

II. Scope of Data Processing

The Draft addresses fourteen (14) categories of vehicle telemetry and in-cabin sensor data to be shared under the partnership, as follows:

(1) GPS/geolocation data; (2) vehicle speed; (3) acceleration/deceleration metrics; (4) braking events; (5) tire pressure readings; (6) engine diagnostic codes (OBD-II); (7) fuel consumption data; (8) in-cabin temperature; (9) in-cabin humidity; (10) seat occupancy status; (11) seatbelt status; (12) ambient noise levels; (13) windshield wiper activation status; and (14) headlight/taillight status.

These categories are enumerated and described in detail in Annex A to the Draft, which includes data field specifications, collection frequency parameters, and transmission protocols applicable to each category.

We draw your attention to the fact that two of the fourteen categories — specifically, GPS/geolocation data (Category 1) and seat occupancy data (Category 10) — are classified as "Sensitive Vehicle Data" under VMS's internal data governance policy when such data is combined with, or capable of being linked to, vehicle identification numbers ("VINs"). This classification reflects VMS's determination that these data elements, when associated with VINs, may be linked to identifiable natural persons (i.e., vehicle owners or lessees) and therefore warrant enhanced protections. The Draft reflects this heightened classification in several operative provisions, including additional access controls and encryption requirements applicable to Sensitive Vehicle Data as set forth in Annex B.

III. Data Volume and Population

The partnership contemplates Meridian receiving and processing data from approximately eight hundred thousand (800,000) active VantageLink-equipped vehicles. This figure represents a subset of VMS's total install base of approximately 2.4 million connected vehicles and corresponds to those vehicles whose owners or lessees have affirmatively opted into VMS's "Connected Insights" data-sharing program. VMS maintains consent records and opt-in documentation for each participating vehicle and will make such records available to Meridian as required under the terms of the Draft.

Based on current data throughput metrics from the VantageLink platform, VMS estimates that the daily raw telemetry volume transmitted to Meridian under the partnership will be approximately 4.2 terabytes per day. This estimate is subject to seasonal variation and may fluctuate based on driving patterns, geographic distribution of opted-in vehicles, and any future changes to the scope of data categories transmitted.

IV. Key Operative Provisions Highlighted for Counterparty Review

We wish to highlight the following operative provisions of the Draft, which we anticipate may be areas of particular focus during your client's review and which we are prepared to discuss in detail:

Data Retention. Article 7 of the Draft provides for a ninety (90)-day rolling deletion period for raw data following completion of processing. Upon expiration of the retention period, Meridian is required to securely delete or, at VMS's election, return all raw data in its possession or control, and to certify such deletion or return in writing. VMS has adopted this retention period to align with the data minimization principles reflected in its internal governance framework.

Breach Notification. Article 9 of the Draft requires Meridian to notify VMS within twenty-four (24) hours of Meridian's discovery of any personal data breach, as defined in the DPA, affecting data processed under the agreement. The notification must include, to the extent then known, the nature of the breach, the categories and approximate number of data subjects and data records affected, the likely consequences of the breach, and the measures taken or proposed to be taken to address and mitigate the breach. We note that the twenty-four (24)-hour notification window is shorter than the default timelines specified under certain applicable regulatory frameworks and reflects VMS's strong preference for accelerated notification in light of the volume and sensitivity of the data at issue.

Sub-Processor Approval. Article 10 of the Draft requires Meridian to obtain VMS's prior written consent before engaging any sub-processor to perform any processing activities under the DPA. Meridian may not engage any sub-processor on the basis of general written authorization alone; specific written approval from VMS is required for each proposed sub-processor engagement. The Draft identifies Cloudvault Infrastructure, Inc. ("Cloudvault") as a proposed and pre-approved sub-processor for cloud hosting and data storage services provided through Cloudvault's "AutoCloud" platform, with data center facilities located in Reno, Nevada and Columbus, Ohio. Cloudvault's inclusion in the approved sub-processor list is reflected in Annex C to the Draft. Any additional sub-processors proposed by Meridian will be subject to VMS's prior review and written approval, including VMS's right to conduct a security assessment of the proposed sub-processor prior to granting consent.

Audit Rights. Article 12 of the Draft provides VMS with on-site audit rights, exercisable upon ten (10) business days' prior written notice to Meridian, to inspect and verify Meridian's compliance with the terms of the DPA, including its technical and organizational security measures. As currently drafted, VMS's audit rights are not subject to any limitation on frequency, and audits may be conducted by VMS personnel or by a qualified third-party auditor engaged by VMS at VMS's expense. VMS considers robust and unrestricted audit rights to be essential given the volume and sensitivity of the data being processed under the partnership.

Liability. Article 14 of the Draft provides for uncapped liability for data breaches and unauthorized processing. Specifically, neither party's aggregate liability to the other with respect to claims arising from a personal data breach, unauthorized processing, or any breach of the confidentiality and security obligations set forth in the DPA is subject to any contractual cap or limitation. We recognize that this provision may warrant discussion, and we are prepared to consider Meridian's perspective on appropriate risk allocation in this area, provided that any proposed limitation is consistent with VMS's regulatory obligations and risk tolerance.

V. Annexes

The Draft includes three annexes, which are incorporated into and form an integral part of the DPA:

Annex A — Data Categories. Annex A provides a detailed description of the fourteen (14) categories of vehicle telemetry and in-cabin sensor data within the scope of the DPA, including data field definitions, collection frequency, data format specifications, and the classification of GPS/geolocation data and seat occupancy data as Sensitive Vehicle Data when combined with VINs.

Annex B — Technical and Organizational Measures. Annex B sets forth the minimum security standards applicable to Meridian's processing environment, including requirements relating to encryption (at rest and in transit), access controls, network segmentation, intrusion detection, vulnerability management, incident response, employee training, and physical security of data center facilities.

Annex C — Approved Sub-Processors. Annex C contains the list of pre-approved sub-processors authorized to perform processing activities on Meridian's behalf under the DPA. As of the date of the Draft, Annex C lists only Cloudvault Infrastructure, Inc., together with a description of the sub-processing services to be performed (cloud hosting and data storage on the AutoCloud platform) and the locations of Cloudvault's data center facilities (Reno, Nevada and Columbus, Ohio).

VI. Regulatory Framework

The Draft has been prepared to address compliance with applicable United States federal and state privacy and data protection statutes, including the following:

(a) the Michigan Identity Theft Protection Act, MCL § 445.61 et seq.;

(b) the California Consumer Privacy Act, as amended by the California Privacy Rights Act of 2020, Cal. Civ. Code § 1798.100 et seq. ("CCPA/CPRA"); and

With respect to the CCPA/CPRA, we note that its applicability to the data processed under the DPA is triggered, in significant part, by the inclusion of approximately one hundred twelve thousand (112,000) California-registered vehicles within the population of approximately 800,000 opted-in vehicles. This California-registered vehicle population represents approximately fourteen percent (14%) of the total data subject population under the DPA and subjects certain categories of data processing contemplated by the partnership — particularly with respect to GPS/geolocation data and seat occupancy data linked to VINs — to the enhanced consumer rights and business obligations set forth in the CCPA/CPRA, including rights of access, deletion, and opt-out. The Draft incorporates provisions designed to enable both VMS and Meridian to satisfy their respective obligations under the CCPA/CPRA, including service provider restrictions and contractual use limitations applicable to Meridian in its capacity as a "service provider" (as defined in Cal. Civ. Code § 1798.140(ag)).

As set forth in Article 16, the DPA is governed by, and shall be construed in accordance with, the laws of the State of Michigan, without regard to its conflict-of-laws principles.

VII. Invitation for Comments and Proposed Timeline

We invite Whitfield, Barrow & Crane and Meridian to review the enclosed Draft in its entirety and to provide a redlined version reflecting any comments, questions, and proposed revisions at your convenience. VMS is eager to finalize the DPA on a timeline consistent with the anticipated commercial launch of the data-sharing partnership, which, as contemplated by the LOI, is targeted for the first quarter of 2023. To that end, we would appreciate receiving your initial markup within approximately three (3) weeks of the date of this letter, if practicable.

In the interim, we are available at your convenience for a preliminary call to discuss the Draft's structure, the rationale underlying key provisions, and any initial questions you or your client may have prior to undertaking a formal markup. We believe that an early discussion may help to streamline the negotiation process and identify any threshold issues that would benefit from resolution in advance of a detailed exchange of redlines.

Please do not hesitate to contact me directly at (212) 555-0193 or rbernstein@calderwoodharkness.com to schedule a call or to discuss any aspect of the Draft. Additionally, please note that Alan Burke, Senior Associate in our Privacy & Data Security group, will serve as the primary day-to-day contact on the drafting and negotiation of the DPA. Mr. Burke can be reached at (212) 555-0247 or aburke@calderwoodharkness.com. Both Mr. Burke and I are available to coordinate schedules with your team at the earliest opportunity.

We look forward to working with you and your colleagues on this matter and to bringing the DPA to a mutually satisfactory conclusion.

Very truly yours,

CALDERWOOD & HARKNESS LLP

By: ________

Rachel Bernstein Partner, Privacy & Data Security Calderwood & Harkness LLP 1 Liberty Plaza, 38th Floor New York, NY 10006 Tel: (212) 555-0193

Email: rbernstein@calderwoodharkness.com

Enclosure: Data Processing Agreement (v1.0) — Draft dated September 28, 2022 (47 pages, including Annexes A, B, and C)

cc:

Thomas Langford, General Counsel, Vantage Mobility Systems Corp. Diana Kowalski, Chief Privacy Officer, Vantage Mobility Systems Corp. Kevin Ostrowski, Partner, Calderwood & Harkness LLP Alan Burke, Senior Associate, Calderwood & Harkness LLP Sara Hendricks, Associate, Calderwood & Harkness LLP Derek Yamada, Associate, Whitfield, Barrow & Crane LLP

CALDERWOOD & HARKNESS LLP Attorneys at Law 1 Liberty Plaza, 38th Floor New York, NY 10006
October 7, 2022
Via Email and First Class Mail
Catherine Ng, Esq. Partner, Privacy & Cybersecurity Whitfield, Barrow & Crane LLP 555 California Street, Suite 3200 San Francisco, CA 94104
Re: Data Processing Agreement between Vantage Mobility Systems Corp. and Meridian Telematics Solutions, Inc. Our Matter No.: 1007-00007
Dear Ms. Ng:
This firm represents Vantage Mobility Systems Corp. ("VMS"), a Delaware corporation headquartered in Auburn Hills, Michigan, in connection with the above-referenced matter. We write to transmit the enclosed initial draft Data Processing Agreement (Version 1.0), dated September 28, 2022 (the "DPA" or "Draft"), between VMS, acting in its capacity as Data Controller, and Meridian Telematics Solutions, Inc. ("Meridian"), acting in its capacity as Data Processor. The DPA has been prepared in connection with the connected-vehicle data-sharing partnership contemplated by the non-binding Letter of Intent executed by VMS and Meridian on August 5, 2022 (the "LOI"). The enclosed Draft comprises forty-seven (47) pages, including the body of the agreement and three annexes, as described more fully below. We respectfully request that you review the Draft with your client and provide your comments at your earliest convenience.
For your reference, we provide below a summary of the key structural features of the Draft and certain provisions that we anticipate may be of particular interest to Meridian in its review.
I. Parties and Roles
The Draft designates VMS as the Data Controller and Meridian as the Data Processor with respect to all personal data and vehicle telemetry data processed pursuant to the agreement. In its capacity as Data Controller, VMS retains ultimate authority over the purposes and means of data processing, while Meridian, as Data Processor, is authorized to process data solely in accordance with VMS's documented instructions and the terms of the DPA. The DPA governs Meridian's processing and analysis of real-time telematics and in-cabin sensor data collected from VMS's proprietary VantageLink connected-vehicle platform, which is installed across VMS's fleet of consumer and commercial vehicles in the United States.
II. Scope of Data Processing
The Draft addresses fourteen (14) categories of vehicle telemetry and in-cabin sensor data to be shared under the partnership, as follows:
(1) GPS/geolocation data; (2) vehicle speed; (3) acceleration/deceleration metrics; (4) braking events; (5) tire pressure readings; (6) engine diagnostic codes (OBD-II); (7) fuel consumption data; (8) in-cabin temperature; (9) in-cabin humidity; (10) seat occupancy status; (11) seatbelt status; (12) ambient noise levels; (13) windshield wiper activation status; and (14) headlight/taillight status.
These categories are enumerated and described in detail in Annex A to the Draft, which includes data field specifications, collection frequency parameters, and transmission protocols applicable to each category.
We draw your attention to the fact that two of the fourteen categories — specifically, GPS/geolocation data (Category 1) and seat occupancy data (Category 10) — are classified as "Sensitive Vehicle Data" under VMS's internal data governance policy when such data is combined with, or capable of being linked to, vehicle identification numbers ("VINs"). This classification reflects VMS's determination that these data elements, when associated with VINs, may be linked to identifiable natural persons (i.e., vehicle owners or lessees) and therefore warrant enhanced protections. The Draft reflects this heightened classification in several operative provisions, including additional access controls and encryption requirements applicable to Sensitive Vehicle Data as set forth in Annex B.
III. Data Volume and Population
The partnership contemplates Meridian receiving and processing data from approximately eight hundred thousand (800,000) active VantageLink-equipped vehicles. This figure represents a subset of VMS's total install base of approximately 2.4 million connected vehicles and corresponds to those vehicles whose owners or lessees have affirmatively opted into VMS's "Connected Insights" data-sharing program. VMS maintains consent records and opt-in documentation for each participating vehicle and will make such records available to Meridian as required under the terms of the Draft.
Based on current data throughput metrics from the VantageLink platform, VMS estimates that the daily raw telemetry volume transmitted to Meridian under the partnership will be approximately 4.2 terabytes per day. This estimate is subject to seasonal variation and may fluctuate based on driving patterns, geographic distribution of opted-in vehicles, and any future changes to the scope of data categories transmitted.
IV. Key Operative Provisions Highlighted for Counterparty Review
We wish to highlight the following operative provisions of the Draft, which we anticipate may be areas of particular focus during your client's review and which we are prepared to discuss in detail:
Data Retention. Article 7 of the Draft provides for a ninety (90)-day rolling deletion period for raw data following completion of processing. Upon expiration of the retention period, Meridian is required to securely delete or, at VMS's election, return all raw data in its possession or control, and to certify such deletion or return in writing. VMS has adopted this retention period to align with the data minimization principles reflected in its internal governance framework.
Breach Notification. Article 9 of the Draft requires Meridian to notify VMS within twenty-four (24) hours of Meridian's discovery of any personal data breach, as defined in the DPA, affecting data processed under the agreement. The notification must include, to the extent then known, the nature of the breach, the categories and approximate number of data subjects and data records affected, the likely consequences of the breach, and the measures taken or proposed to be taken to address and mitigate the breach. We note that the twenty-four (24)-hour notification window is shorter than the default timelines specified under certain applicable regulatory frameworks and reflects VMS's strong preference for accelerated notification in light of the volume and sensitivity of the data at issue.
Sub-Processor Approval. Article 10 of the Draft requires Meridian to obtain VMS's prior written consent before engaging any sub-processor to perform any processing activities under the DPA. Meridian may not engage any sub-processor on the basis of general written authorization alone; specific written approval from VMS is required for each proposed sub-processor engagement. The Draft identifies Cloudvault Infrastructure, Inc. ("Cloudvault") as a proposed and pre-approved sub-processor for cloud hosting and data storage services provided through Cloudvault's "AutoCloud" platform, with data center facilities located in Reno, Nevada and Columbus, Ohio. Cloudvault's inclusion in the approved sub-processor list is reflected in Annex C to the Draft. Any additional sub-processors proposed by Meridian will be subject to VMS's prior review and written approval, including VMS's right to conduct a security assessment of the proposed sub-processor prior to granting consent.
Audit Rights. Article 12 of the Draft provides VMS with on-site audit rights, exercisable upon ten (10) business days' prior written notice to Meridian, to inspect and verify Meridian's compliance with the terms of the DPA, including its technical and organizational security measures. As currently drafted, VMS's audit rights are not subject to any limitation on frequency, and audits may be conducted by VMS personnel or by a qualified third-party auditor engaged by VMS at VMS's expense. VMS considers robust and unrestricted audit rights to be essential given the volume and sensitivity of the data being processed under the partnership.
Liability. Article 14 of the Draft provides for uncapped liability for data breaches and unauthorized processing. Specifically, neither party's aggregate liability to the other with respect to claims arising from a personal data breach, unauthorized processing, or any breach of the confidentiality and security obligations set forth in the DPA is subject to any contractual cap or limitation. We recognize that this provision may warrant discussion, and we are prepared to consider Meridian's perspective on appropriate risk allocation in this area, provided that any proposed limitation is consistent with VMS's regulatory obligations and risk tolerance.
V. Annexes
The Draft includes three annexes, which are incorporated into and form an integral part of the DPA:
Annex A — Data Categories. Annex A provides a detailed description of the fourteen (14) categories of vehicle telemetry and in-cabin sensor data within the scope of the DPA, including data field definitions, collection frequency, data format specifications, and the classification of GPS/geolocation data and seat occupancy data as Sensitive Vehicle Data when combined with VINs.
Annex B — Technical and Organizational Measures. Annex B sets forth the minimum security standards applicable to Meridian's processing environment, including requirements relating to encryption (at rest and in transit), access controls, network segmentation, intrusion detection, vulnerability management, incident response, employee training, and physical security of data center facilities.
Annex C — Approved Sub-Processors. Annex C contains the list of pre-approved sub-processors authorized to perform processing activities on Meridian's behalf under the DPA. As of the date of the Draft, Annex C lists only Cloudvault Infrastructure, Inc., together with a description of the sub-processing services to be performed (cloud hosting and data storage on the AutoCloud platform) and the locations of Cloudvault's data center facilities (Reno, Nevada and Columbus, Ohio).
VI. Regulatory Framework
The Draft has been prepared to address compliance with applicable United States federal and state privacy and data protection statutes, including the following:
(a) the Michigan Identity Theft Protection Act, MCL § 445.61 et seq.;
(b) the California Consumer Privacy Act, as amended by the California Privacy Rights Act of 2020, Cal. Civ. Code § 1798.100 et seq. ("CCPA/CPRA"); and
(c) the federal Drivers' Privacy Protection Act, 18 U.S.C. § 2721 et seq. ("DPPA").
With respect to the CCPA/CPRA, we note that its applicability to the data processed under the DPA is triggered, in significant part, by the inclusion of approximately one hundred twelve thousand (112,000) California-registered vehicles within the population of approximately 800,000 opted-in vehicles. This California-registered vehicle population represents approximately fourteen percent (14%) of the total data subject population under the DPA and subjects certain categories of data processing contemplated by the partnership — particularly with respect to GPS/geolocation data and seat occupancy data linked to VINs — to the enhanced consumer rights and business obligations set forth in the CCPA/CPRA, including rights of access, deletion, and opt-out. The Draft incorporates provisions designed to enable both VMS and Meridian to satisfy their respective obligations under the CCPA/CPRA, including service provider restrictions and contractual use limitations applicable to Meridian in its capacity as a "service provider" (as defined in Cal. Civ. Code § 1798.140(ag)).
As set forth in Article 16, the DPA is governed by, and shall be construed in accordance with, the laws of the State of Michigan, without regard to its conflict-of-laws principles.
VII. Invitation for Comments and Proposed Timeline
We invite Whitfield, Barrow & Crane and Meridian to review the enclosed Draft in its entirety and to provide a redlined version reflecting any comments, questions, and proposed revisions at your convenience. VMS is eager to finalize the DPA on a timeline consistent with the anticipated commercial launch of the data-sharing partnership, which, as contemplated by the LOI, is targeted for the first quarter of 2023. To that end, we would appreciate receiving your initial markup within approximately three (3) weeks of the date of this letter, if practicable.
In the interim, we are available at your convenience for a preliminary call to discuss the Draft's structure, the rationale underlying key provisions, and any initial questions you or your client may have prior to undertaking a formal markup. We believe that an early discussion may help to streamline the negotiation process and identify any threshold issues that would benefit from resolution in advance of a detailed exchange of redlines.
Please do not hesitate to contact me directly at (212) 555-0193 or rbernstein@calderwoodharkness.com to schedule a call or to discuss any aspect of the Draft. Additionally, please note that Alan Burke, Senior Associate in our Privacy & Data Security group, will serve as the primary day-to-day contact on the drafting and negotiation of the DPA. Mr. Burke can be reached at (212) 555-0247 or aburke@calderwoodharkness.com. Both Mr. Burke and I are available to coordinate schedules with your team at the earliest opportunity.
We look forward to working with you and your colleagues on this matter and to bringing the DPA to a mutually satisfactory conclusion.
Very truly yours,
CALDERWOOD & HARKNESS LLP
By: ________
Rachel Bernstein Partner, Privacy & Data Security Calderwood & Harkness LLP 1 Liberty Plaza, 38th Floor New York, NY 10006 Tel: (212) 555-0193
Email: rbernstein@calderwoodharkness.com
Enclosure: Data Processing Agreement (v1.0) — Draft dated September 28, 2022 (47 pages, including Annexes A, B, and C)
cc:
Thomas Langford, General Counsel, Vantage Mobility Systems Corp. Diana Kowalski, Chief Privacy Officer, Vantage Mobility Systems Corp. Kevin Ostrowski, Partner, Calderwood & Harkness LLP Alan Burke, Senior Associate, Calderwood & Harkness LLP Sara Hendricks, Associate, Calderwood & Harkness LLP Derek Yamada, Associate, Whitfield, Barrow & Crane LLP

CALDERWOOD & HARKNESS LLP Attorneys at Law 1 Liberty Plaza, 38th Floor New York, NY 10006

CALDERWOOD & HARKNESS LLP

Record

Parties

Dates

Amounts