PRIVILEGED & CONFIDENTIAL — ATTORNEY WORK PRODUCT
DATA PROCESSING AGREEMENT
Version 1.0 — Initial Draft
September 28, 2022
Prepared by: Calderwood & Harkness LLP 1 Liberty Plaza, 38th Floor New York, NY 10006
Matter Number: 1007-00007
BETWEEN
VANTAGE MOBILITY SYSTEMS CORP. a Delaware corporation ("Controller" or "VMS")
AND
MERIDIAN TELEMATICS SOLUTIONS, INC. a Delaware corporation ("Processor" or "Meridian")
Right-click to update Table of Contents
DATA PROCESSING AGREEMENT
This Data Processing Agreement (this "DPA" or "Agreement") is entered into as of ___, 2022 (the "Effective Date"),
BETWEEN:
Vantage Mobility Systems Corp., a corporation organized and existing under the laws of the State of Delaware, with its principal place of business at 4700 Automation Boulevard, Suite 300, Auburn Hills, MI 48326 (hereinafter referred to as "Controller" or "VMS"),
AND:
Meridian Telematics Solutions, Inc., a corporation organized and existing under the laws of the State of Delaware, with its principal place of business at 1250 Embarcadero Way, Suite 400, Palo Alto, CA 94303 (hereinafter referred to as "Processor" or "Meridian").
Controller and Processor are each referred to herein as a "Party" and collectively as the "Parties."
RECITALS
WHEREAS, Controller designs, manufactures, and sells connected-vehicle hardware modules and integrated mobility platforms, including the proprietary "VantageLink" system, which collects real-time vehicle telemetry data from approximately 2,400,000 connected vehicles across North America;
WHEREAS, Processor provides cloud-based analytics and machine-learning services to automotive original equipment manufacturers ("OEMs") and Tier 1 suppliers, processing connected-vehicle data streams to generate predictive maintenance insights, driver behavior scoring, and fleet optimization analytics;
WHEREAS, the Parties executed a non-binding Letter of Intent dated August 5, 2022 (the "LOI"), outlining a connected-vehicle data-sharing partnership under which Processor would receive and process certain categories of vehicle telemetry and in-cabin sensor data from Controller's VantageLink platform;
WHEREAS, under the contemplated partnership, Processor will receive and process data from approximately 800,000 active VantageLink-equipped vehicles whose owners or lessees have opted into Controller's "Connected Insights" data-sharing program;
WHEREAS, the estimated daily volume of raw telemetry data to be processed by Processor under the contemplated partnership is approximately 4.2 terabytes per day;
WHEREAS, the Parties wish to enter into this DPA to establish the terms and conditions governing Processor's processing of Controller Data (as defined herein) in compliance with Applicable Data Protection Laws (as defined herein);
WHEREAS, this DPA is intended to satisfy the requirements for data processing agreements under applicable law, including the Michigan Identity Theft Protection Act (MCL 445.61 et seq.), the California Consumer Privacy Act and California Privacy Rights Act (Cal. Civ. Code § 1798.100 et seq.) (collectively, "CCPA/CPRA"), and the federal Drivers' Privacy Protection Act (18 U.S.C. § 2721 et seq.) ("DPPA"); and
WHEREAS, the Parties intend that this DPA shall be read and construed in conjunction with, and as a supplement to, the underlying commercial agreement to be entered into between the Parties;
NOW, THEREFORE, in consideration of the mutual covenants and agreements set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:
ARTICLE 1 — DEFINITIONS AND INTERPRETATION
Section 1.1 — Definitions
As used in this DPA, the following capitalized terms shall have the meanings set forth below. Capitalized terms used but not defined in this Article 1 shall have the meanings ascribed to them elsewhere in this DPA.
"Applicable Data Protection Laws" means all applicable federal, state, and local laws, statutes, regulations, rules, ordinances, and binding guidance relating to the privacy, protection, or security of personal data or personal information, as may be amended, supplemented, or replaced from time to time, including but not limited to: (a) the Michigan Identity Theft Protection Act (MCL 445.61 et seq.); (b) the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (Cal. Civ. Code § 1798.100 et seq.) (collectively, the "CCPA/CPRA"); (c) the Drivers' Privacy Protection Act (18 U.S.C. § 2721 et seq.) (the "DPPA"); and (d) to the extent applicable to any international transfer of Controller Data or to the processing of personal data of data subjects located in the European Union or European Economic Area, the General Data Protection Regulation (Regulation (EU) 2016/679) (the "GDPR") and its implementing national legislation.
"Approved Sub-Processor" means a third party that has been authorized by Controller in accordance with Article 7 of this DPA to process Controller Data on behalf of Processor. As of the Effective Date, the Approved Sub-Processors are those listed in Annex C attached hereto.
"Connected Insights Program" means Controller's opt-in data-sharing program through which vehicle owners and lessees consent to the collection, transmission, and sharing of Vehicle Telemetry Data from their VantageLink-equipped vehicles with Controller and Controller's authorized partners and service providers.
"Controller Data" means all data provided by or on behalf of Controller to Processor, or otherwise accessed, collected, generated, received, or processed by Processor in connection with the performance of the Services, including without limitation Vehicle Telemetry Data, Sensitive Vehicle Data, and any Personal Information contained therein or derived therefrom.
"Data Breach" or "Security Incident" means any unauthorized access to, acquisition of, use of, disclosure of, or destruction of Controller Data, or any breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, Controller Data transmitted, stored, or otherwise processed by Processor or any Sub-Processor. A Data Breach includes any event that would constitute a "security breach" under the Michigan Identity Theft Protection Act, a "breach of the security of the system" under the CCPA/CPRA, or any equivalent term under Applicable Data Protection Laws.
"Data Categories" means the fourteen (14) categories of vehicle telemetry and in-cabin sensor data described in Annex A attached hereto.
"Data Subject" means an identified or identifiable natural person to whom Personal Information relates, including without limitation vehicle owners and lessees enrolled in the Connected Insights Program, passengers whose presence is reflected in seat occupancy data, and any other individual whose Personal Information is contained within Controller Data.
"DPPA" means the Drivers' Privacy Protection Act, 18 U.S.C. § 2721 et seq., as amended from time to time.
"LOI" means the non-binding Letter of Intent between Controller and Processor dated August 5, 2022, which outlined the principal terms of the contemplated connected-vehicle data-sharing partnership.
"Personal Information" means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer, household, or vehicle, as that term or any equivalent term is defined under Applicable Data Protection Laws. For the avoidance of doubt, Personal Information includes Vehicle Identification Numbers ("VINs") when combined with GPS/geolocation data, seat occupancy data, or any other data element that, alone or in combination, permits the identification of a natural person.
"Processing" (and its cognates "Process" and "Processed") means any operation or set of operations performed on Controller Data, whether or not by automated means, including without limitation the collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction of Controller Data.
"Processor" means Meridian Telematics Solutions, Inc., a Delaware corporation.
"Retention Period" has the meaning set forth in Section 5.1 of this DPA.
"Sensitive Vehicle Data" means those categories of Controller Data that, under Controller's internal data governance policy, are classified as sensitive due to their capacity to be linked to identifiable individuals when combined with VINs. As of the Effective Date, Sensitive Vehicle Data includes: (i) GPS/geolocation data (Data Category No. 1 as described in Annex A) and (ii) seat occupancy data (Data Category No. 10 as described in Annex A), and such additional categories as Controller may designate in writing from time to time.
"Services" means the data analytics and machine-learning services to be provided by Processor to Controller under the terms of the underlying commercial agreement between the Parties, including without limitation the receipt, hosting, processing, analysis, transformation, and delivery of insights derived from Controller Data, as further described in Section 2.2 of this DPA.
"Sub-Processor" means any third party (excluding Processor's employees acting within the scope of their employment) engaged by Processor to process Controller Data on behalf of Controller in connection with the Services.
"Technical and Organizational Measures" or "TOMs" means the security measures described in Annex B attached hereto, as may be updated from time to time in accordance with Section 6.3 of this DPA.
"VantageLink" means Controller's proprietary connected-vehicle hardware and software platform, consisting of embedded telematics control units, associated sensors, communication modules, firmware, and cloud-based data ingestion infrastructure, that collects, processes, and transmits Vehicle Telemetry Data from equipped vehicles.
"Vehicle Identification Number" or "VIN" means the unique seventeen-character alphanumeric identifier assigned to each motor vehicle pursuant to 49 C.F.R. Part 565 or equivalent regulatory standards.
"Vehicle Telemetry Data" means the categories of data collected from VantageLink-equipped vehicles as described in Annex A attached hereto, including all associated metadata fields identified in Section A.3 of Annex A.
Section 1.2 — Interpretation
The following rules of interpretation shall apply to this DPA:
(a) References to any statute, law, regulation, rule, or ordinance shall be deemed to include references to such statute, law, regulation, rule, or ordinance as amended, supplemented, re-enacted, or replaced from time to time, and to any successor statute, law, regulation, rule, or ordinance.
(b) The headings, captions, and section numbers used in this DPA are inserted for convenience of reference only and shall not affect the meaning, interpretation, or construction of any provision of this DPA.
(c) The words "include," "includes," and "including" shall be deemed to be followed by the phrase "without limitation" and shall not be construed as words of limitation.
(d) Words in the singular shall include the plural and vice versa, and words in one gender shall include all genders, unless the context otherwise requires.
(e) References to "days" shall mean calendar days unless expressly specified as "business days." For purposes of this DPA, "business days" means days other than Saturdays, Sundays, and federal holidays observed in the United States.
(f) References to "writing" or "written" include electronic mail and other forms of electronic communication, unless a specific form of delivery is required under this DPA.
(g) The Annexes attached hereto (Annex A, Annex B, and Annex C) are integral parts of this DPA and are hereby incorporated by reference as though fully set forth herein. In the event of any conflict or inconsistency between the body of this DPA and any Annex, the body of this DPA shall control.
(h) References to any article, section, annex, or exhibit are references to articles, sections, annexes, or exhibits of this DPA, unless otherwise specified.
(i) This DPA shall not be construed against the drafting Party. Each Party acknowledges that it has had the opportunity to consult with counsel and has participated in the negotiation and drafting of this DPA.
ARTICLE 2 — SCOPE AND PURPOSE OF PROCESSING
Section 2.1 — Scope of Processing
Processor shall process Controller Data solely as described in this DPA and in accordance with Controller's documented instructions as set forth herein and as may be supplemented from time to time pursuant to Article 3 of this DPA.
The Processing covered by this DPA encompasses fourteen (14) categories of Vehicle Telemetry Data and in-cabin sensor data as set forth in Annex A attached hereto. These Data Categories are collected by Controller's VantageLink platform from approximately 800,000 active VantageLink-equipped vehicles whose owners or lessees have enrolled in the Connected Insights Program. The enrolled vehicle population represents a subset of the approximately 2,400,000 total VantageLink-equipped vehicles deployed across North America.
The estimated daily volume of raw telemetry data to be transmitted from Controller to Processor for Processing is approximately 4.2 terabytes per day, streaming from the enrolled vehicle fleet on a real-time basis with typical transmission intervals of one (1) to five (5) seconds per data point per vehicle. The Parties acknowledge that actual data volumes may vary based on the number of active enrolled vehicles, driving patterns, and data transmission conditions.
Processor's primary data operations center for the performance of the Services is located at 8900 Research Park Drive, Building C, Austin, TX 78759. Controller Data may also be processed and stored at the facilities of Approved Sub-Processors as identified in Annex C, subject to the terms and conditions of Article 7 and Article 9 of this DPA. Processor shall not process or store Controller Data at any location not identified in this DPA or Annex C without the prior written consent of Controller.
Section 2.2 — Purpose of Processing
Processor is authorized to process Controller Data solely for the following specified and limited purposes (collectively, the "Permitted Purposes"):
(a) generating predictive maintenance insights for Controller's vehicle fleet, including but not limited to component failure predictions, maintenance scheduling recommendations, and warranty risk analyses;
(b) producing driver behavior scoring analytics, including but not limited to safety scoring, driving efficiency ratings, and risk profiling for fleet management applications;
(c) delivering fleet optimization analytics, including but not limited to route optimization, fuel consumption analysis, vehicle utilization reporting, and operational efficiency metrics;
(d) developing and training machine-learning models using Controller Data, subject in all cases to the data retention and deletion requirements set forth in Article 5 of this DPA, including the restrictions on retention of Sensitive Vehicle Data; and
(e) any other purpose expressly authorized in writing by Controller, such authorization to specify the scope, duration, and conditions of the additional processing.
Processor shall not process Controller Data for any purpose other than the Permitted Purposes set forth in this Section 2.2 without the prior written consent of Controller. Without limiting the foregoing, Processor shall not process Controller Data for the purpose of: (i) selling or sharing Controller Data (as those terms are defined under the CCPA/CPRA or any other Applicable Data Protection Law); (ii) engaging in targeted advertising directed at Data Subjects; (iii) enriching consumer profiles maintained by Processor on behalf of any third party; or (iv) any purpose that would cause Processor to be deemed a controller, business, or owner of Controller Data under Applicable Data Protection Laws.
Section 2.3 — Controller's Responsibilities
Controller represents and warrants to Processor that:
(a) Controller has obtained, and will continue to maintain throughout the term of this DPA, all necessary consents, authorizations, and legal bases from Data Subjects under the Connected Insights Program that are required under Applicable Data Protection Laws for the collection, transmission, and sharing of Controller Data with Processor for Processing in accordance with this DPA;
(b) Controller is solely responsible for the lawfulness of the collection and provision of Controller Data to Processor, including compliance with all applicable notice, disclosure, and consent requirements;
(c) Controller shall classify Controller Data in accordance with its internal data governance policy and shall identify Sensitive Vehicle Data to Processor, including any changes to the classification of Data Categories that may occur during the term of this DPA;
(d) Controller shall promptly notify Processor of any changes to the Connected Insights Program, the scope of Data Subject consents, or any revocations of consent that may affect Processor's Processing of Controller Data; and
(e) Controller's instructions to Processor regarding the Processing of Controller Data comply with Applicable Data Protection Laws.
Section 2.4 — Processor's Role
Processor acts as a data processor and, where applicable, as a "service provider" (as defined under the CCPA/CPRA) on behalf of Controller with respect to Controller Data. Processor processes Controller Data solely on behalf of and under the direction of Controller, and Processor does not determine the purposes or means of Processing Controller Data except to the extent necessary to carry out the Permitted Purposes in accordance with Controller's documented instructions.
Processor shall not be deemed a controller, business (as defined under the CCPA/CPRA), or owner of Controller Data for any purpose under Applicable Data Protection Laws. Processor shall process Controller Data only in accordance with Controller's documented instructions and the terms and conditions of this DPA, and shall not independently determine the purposes for which Controller Data is processed.
Nothing in this DPA shall be construed to limit Controller's rights in, or ownership of, Controller Data. As between the Parties, Controller retains all right, title, and interest in and to Controller Data.
ARTICLE 3 — CONTROLLER'S INSTRUCTIONS
Section 3.1 — Documented Instructions
Processor shall process Controller Data only in accordance with Controller's written instructions, as documented in this DPA, the Annexes attached hereto, and any subsequent written instructions provided by Controller pursuant to this Article 3. The Permitted Purposes set forth in Section 2.2, together with the data handling, security, retention, and deletion requirements set forth in this DPA and its Annexes, constitute Controller's initial documented instructions to Processor.
If Processor believes in good faith that an instruction from Controller infringes or would infringe any Applicable Data Protection Law, Processor shall promptly notify Controller in writing, specifying the nature of the concern and the relevant legal provision, and Processor shall not carry out the instruction until Controller has confirmed the instruction or provided revised instructions. Processor's obligation to notify Controller under this provision does not impose on Processor an obligation to independently assess the legality of Controller's instructions except to the extent that such assessment is required by Applicable Data Protection Laws.
Section 3.2 — Additional Instructions
Controller may issue additional processing instructions in writing to Processor at any time during the term of this DPA. Processor shall implement such additional instructions within a commercially reasonable timeframe, taking into account the nature and complexity of the instruction, the technical changes required, and any impact on the ongoing provision of the Services.
If any additional instruction from Controller would materially alter the scope, volume, nature, or cost of Processing beyond what is contemplated by this DPA, Processor shall promptly notify Controller, and the Parties shall negotiate in good faith regarding any additional fees, resource requirements, or timeline adjustments that may be reasonably necessary to implement such instruction. Until the Parties reach agreement on the terms of implementation, Processor shall continue to process Controller Data in accordance with the most recent documented instructions that were mutually agreed upon.
ARTICLE 4 — CONFIDENTIALITY
Section 4.1 — Confidentiality Obligations
Processor shall maintain the strict confidentiality of all Controller Data and shall not disclose, publish, release, transfer, or otherwise make available Controller Data to any third party except: (a) as permitted or required by this DPA; (b) to Approved Sub-Processors in accordance with Article 7; (c) to Processor's personnel who require access in accordance with Section 4.2; or (d) as required by applicable law, regulation, or valid legal process, subject to Section 4.3 of this DPA.
Processor shall ensure that any person authorized to process Controller Data, including without limitation employees, contractors, agents, and Sub-Processor personnel, has committed to enforceable confidentiality obligations at least as protective as those set forth in this DPA prior to accessing or processing any Controller Data. Processor shall maintain records demonstrating compliance with the foregoing requirement and shall make such records available to Controller upon reasonable request.
Section 4.2 — Personnel Obligations
Processor shall ensure that access to Controller Data is strictly limited to those personnel who require access to Controller Data to perform the Services and who have a documented business need to access such data. Processor shall maintain and enforce access control policies that restrict Controller Data access to the minimum number of personnel necessary for the performance of the Services.
All Processor personnel with access to Controller Data shall be subject to binding written confidentiality agreements containing terms no less protective than those set forth in this Article 4. Such confidentiality obligations shall survive the termination of the individual's employment or engagement with Processor.
Processor shall conduct appropriate background checks, consistent with applicable law, on all personnel who will have access to Controller Data prior to granting such access. Background checks shall include, at minimum, verification of identity, criminal history screening, and verification of employment history. Processor shall maintain records of completed background checks and shall make such records available to Controller upon reasonable request in connection with audits conducted pursuant to Article 10.
Section 4.3 — Compelled Disclosure
If Processor receives a subpoena, court order, warrant, regulatory inquiry, or other legal demand or compulsory process requiring or purporting to require the disclosure of Controller Data (a "Legal Demand"), Processor shall, to the extent legally permissible:
(a) promptly notify Controller in writing of the Legal Demand, and in no event later than forty-eight (48) hours after receipt of the Legal Demand, providing Controller with a copy of the Legal Demand and any related correspondence;
(b) cooperate with Controller's efforts to obtain a protective order, quash the Legal Demand, or obtain other appropriate remedy to prevent or limit the disclosure of Controller Data;
(c) disclose only that portion of Controller Data that is strictly required to be disclosed, as determined in consultation with Controller and, where appropriate, legal counsel; and
(d) use commercially reasonable efforts to preserve the confidentiality of Controller Data in connection with any such disclosure.
If Processor is prohibited by applicable law from notifying Controller of a Legal Demand, Processor shall use commercially reasonable efforts to challenge such prohibition or to obtain permission to notify Controller, and shall notify Controller as soon as the prohibition is lifted.
ARTICLE 5 — DATA RETENTION AND DELETION
Section 5.1 — Retention Period
Processor shall retain raw Controller Data for a period not to exceed ninety (90) days from the date of initial receipt of each data record (the "Retention Period"). The Retention Period is intended to provide Processor with sufficient time to perform the Processing necessary to generate the insights and analytics contemplated by the Permitted Purposes, while ensuring that raw Controller Data is not retained longer than necessary.
Upon expiration of the Retention Period applicable to any raw Controller Data, Processor shall securely delete or destroy such raw Controller Data using methods consistent with industry-standard data sanitization practices, including without limitation the guidelines set forth in the National Institute of Standards and Technology Special Publication 800-88, Revision 1 (NIST SP 800-88 Rev. 1), "Guidelines for Media Sanitization," or equivalent or successor standards. Processor shall maintain records demonstrating that deletion or destruction has been completed in accordance with this Section 5.1.
Section 5.2 — Rolling Deletion
Deletion of raw Controller Data shall occur on a continuous, rolling basis. Raw Controller Data ingested on any given calendar date shall be deleted no later than ninety (90) days after the date of ingestion, regardless of whether Processing of such data has been completed.
Processor shall implement, maintain, and test automated deletion protocols sufficient to ensure compliance with this rolling deletion requirement. Such automated protocols shall be configured to identify and delete raw Controller Data based on the ingestion date recorded in the associated metadata (timestamp). Processor shall monitor the automated deletion protocols on a regular basis and shall promptly remediate any failures or delays in the deletion process.
Section 5.3 — Derived Data and Aggregated Data
Processor may retain de-identified, aggregated, or anonymized data derived from Controller Data beyond the ninety (90)-day Retention Period (such data, "Derived Data"), provided that the following conditions are satisfied:
(a) the Derived Data cannot reasonably be used, either alone or in combination with other information available to Processor, to identify any individual Data Subject, vehicle, or Vehicle Identification Number; and
(b) the Derived Data has been irreversibly stripped of all Personal Information, including without limitation all VINs, GPS/geolocation data, seat occupancy data, VantageLink device identifiers, and any other data element that could serve as a direct or indirect identifier of a natural person or specific vehicle.
Processor shall apply de-identification and anonymization techniques that are consistent with industry best practices and that satisfy the de-identification standards under Applicable Data Protection Laws, including the "reasonable linkability" standard under the CCPA/CPRA. Processor shall maintain documentation of its de-identification and anonymization processes and shall make such documentation available to Controller upon request.
Section 5.4 — Deletion Upon Termination
Upon termination or expiration of this DPA (or the underlying commercial agreement between the Parties, whichever occurs first), Processor shall, at Controller's election, communicated in writing within thirty (30) days of the effective date of termination or expiration, either:
(a) return all Controller Data to Controller in a commercially standard, machine-readable format reasonably acceptable to Controller (e.g., JSON, CSV, Parquet, or an equivalent format), delivered via secure transmission methods; or
(b) securely delete or destroy all Controller Data, including all copies, backups, replicas, archives, and cached instances of Controller Data, in accordance with the data sanitization standards set forth in Section 5.1.
If Controller does not make an election within the thirty (30)-day period specified above, Processor shall securely delete or destroy all Controller Data in accordance with subsection (b) above.
Processor shall certify in writing to Controller the completion of deletion or destruction of all Controller Data within thirty (30) days of the effective date of termination or expiration. Such certification shall be signed by an authorized officer of Processor and shall confirm that all Controller Data, including all copies maintained by Sub-Processors, has been deleted or destroyed in accordance with this Section 5.4.
Section 5.5 — Sensitive Vehicle Data Retention
Notwithstanding anything in Section 5.3 to the contrary, Processor shall not retain any Sensitive Vehicle Data — specifically GPS/geolocation data (Data Category No. 1) and seat occupancy data (Data Category No. 10) — beyond the ninety (90)-day Retention Period under any circumstances, including in derived, aggregated, anonymized, de-identified, or any other form, unless Controller provides its prior written consent specifically authorizing such extended retention. Any such consent from Controller shall specify the categories of Sensitive Vehicle Data, the permitted retention period, the purpose of retention, and the additional safeguards to be applied.
For the avoidance of doubt, this prohibition on extended retention of Sensitive Vehicle Data applies to all copies of such data, including backup copies, archived copies, cached copies, and copies held by any Sub-Processor engaged by Processor.
ARTICLE 6 — SECURITY AND TECHNICAL AND ORGANIZATIONAL MEASURES
Section 6.1 — Security Obligations
Processor shall implement and maintain appropriate technical and organizational measures to protect Controller Data against unauthorized or unlawful processing, accidental loss, destruction, damage, alteration, disclosure, or access. The specific measures required under this Article 6 are set forth in detail in Annex B attached hereto.
Such measures shall be appropriate to the nature, scope, context, and purposes of the Processing, as well as the risks of varying likelihood and severity for the rights and freedoms of Data Subjects. In determining the appropriateness of security measures, Processor shall take into account the state of the art of data security technology, the costs of implementation, the nature of the Controller Data being processed (including the presence of Sensitive Vehicle Data), the volume of Controller Data, and the particular risks presented by the connected-vehicle data processing context.
Processor shall ensure that its Technical and Organizational Measures are at least consistent with industry standards for the processing of connected-vehicle and automotive data, including without limitation the standards and best practices promulgated by the National Institute of Standards and Technology (NIST), the International Organization for Standardization (ISO), and recognized industry bodies in the automotive telematics sector.
Section 6.2 — Minimum Security Requirements
Without limiting the generality of Section 6.1, Processor shall implement and maintain, at a minimum, the following security measures with respect to Controller Data:
(a) Encryption. Encryption of all Controller Data at rest using the Advanced Encryption Standard with a minimum key length of 256 bits (AES-256) or equivalent, and encryption of all Controller Data in transit using Transport Layer Security version 1.2 or higher (TLS 1.2+).
(b) Access Controls. Access controls including multi-factor authentication (MFA) for all personnel accessing Controller Data, role-based access control (RBAC) enforcing the principle of least privilege, unique user accounts with no shared or generic credentials, and quarterly access reviews with immediate revocation upon personnel departure or role change.
(c) Vulnerability Assessments and Penetration Testing. Regular vulnerability assessments and penetration testing of all systems and applications used to process Controller Data, conducted at least annually by qualified internal or third-party security professionals, with results and remediation plans made available to Controller upon request.
(d) Intrusion Detection and Prevention. Deployment and maintenance of intrusion detection and prevention systems (IDS/IPS) at all network perimeters and critical processing environments.
(e) Incident Response. A documented incident response plan with clearly defined roles, responsibilities, and escalation procedures, tested through tabletop exercises at least annually.
(f) Physical Security. Physical security measures at all locations where Controller Data is processed or stored, including Processor's data operations center at 8900 Research Park Drive, Building C, Austin, TX 78759 and all Approved Sub-Processor facilities, including 24/7 physical access controls, video surveillance, visitor management, and environmental controls.
(g) Security Awareness Training. Mandatory employee security awareness training for all personnel with access to Controller Data, administered upon hire and at least annually thereafter.
(h) Logging and Monitoring. Comprehensive logging and monitoring of all access to and actions on Controller Data, including read, write, modify, and delete operations, with log retention of at least twelve (12) months and real-time alerting for anomalous or suspicious activity.
The foregoing requirements are further detailed in Annex B, which sets forth the comprehensive Technical and Organizational Measures applicable to Processor's processing of Controller Data.
Section 6.3 — Updates to Security Measures
Processor shall review and, as necessary, update the Technical and Organizational Measures set forth in Annex B on at least an annual basis to account for evolving threats, vulnerabilities, technological developments, and industry standards. Processor shall promptly notify Controller of any material changes to its Technical and Organizational Measures.
Processor shall not diminish the overall level of protection afforded to Controller Data without Controller's prior written consent. Any proposed reduction in security measures shall be communicated to Controller in writing at least thirty (30) days in advance, and Controller shall have the right to object to and refuse any such reduction.
ARTICLE 7 — SUB-PROCESSORS
Section 7.1 — Prior Written Consent Required
Processor shall not engage any Sub-Processor to process Controller Data without the prior written consent of Controller. Processor's request for consent shall be submitted in writing and shall identify: (a) the name and legal entity of the proposed Sub-Processor; (b) the Sub-Processor's location(s) of processing, including the physical addresses of all facilities where Controller Data will be processed or stored; (c) the nature and scope of the processing to be performed by the Sub-Processor; and (d) the specific categories of Controller Data to be processed by the Sub-Processor.
Controller's consent to the engagement of a Sub-Processor shall be specific to each Sub-Processor and to the scope of processing described in the request. Consent to a Sub-Processor for a particular scope of processing shall not constitute consent to any expansion of such scope without further written authorization from Controller.
Section 7.2 — Approved Sub-Processors
As of the Effective Date, the Sub-Processors listed in Annex C attached hereto are approved by Controller for the processing activities described therein. The initial Approved Sub-Processor is:
Cloudvault Infrastructure, Inc., a corporation organized under the laws of the State of Nevada, with headquarters at 200 Mill Street, Suite 100, Reno, NV 89501, which will host and process Controller Data on its proprietary "AutoCloud" platform at its data center facility located at 7400 Crossroads Boulevard, Columbus, OH 43219.
Meridian's existing master services agreement with Cloudvault Infrastructure, Inc. was executed on March 1, 2021. The scope of Cloudvault's processing of Controller Data includes cloud infrastructure hosting, data storage, and provision of compute resources for analytics processing. Controller's approval of Cloudvault is limited to the processing activities and facilities described in Annex C, and does not extend to any other Cloudvault facility or processing activity, including without limitation Cloudvault's facility located at Unit 12, Parkwest Business Campus, Dublin 12, Ireland.
Section 7.3 — Sub-Processor Agreements
Prior to any Sub-Processor commencing the Processing of Controller Data, Processor shall enter into a written agreement with the Sub-Processor that imposes data protection and data security obligations no less protective than those imposed on Processor under this DPA. Such agreement shall include, at a minimum, the following provisions:
(a) confidentiality obligations at least as protective as those set forth in Article 4 of this DPA;
(b) security requirements consistent with the Technical and Organizational Measures described in Annex B;
(c) data retention and deletion obligations consistent with Article 5, including the rolling deletion requirement and the prohibition on extended retention of Sensitive Vehicle Data;
(d) breach notification obligations requiring the Sub-Processor to notify Processor within twenty-four (24) hours of becoming aware of a Data Breach, consistent with Article 8;
(e) audit and inspection rights in favor of Controller, exercisable directly by Controller or through Processor, consistent with Article 10;
(f) data localization and transfer restrictions consistent with Article 9, including the requirement that Controller Data be processed and stored exclusively within the United States unless otherwise authorized in writing by Controller; and
(g) obligations regarding the return or deletion of Controller Data upon termination of the Sub-Processor agreement.
Processor shall provide Controller with copies of Sub-Processor agreements (or, with Controller's consent, relevant excerpts thereof) upon request.
Section 7.4 — Processor Liability for Sub-Processors
Processor shall remain fully liable to Controller for the acts, omissions, failures, breaches, and negligence of any Sub-Processor engaged pursuant to this Article 7 to the same extent as if such acts, omissions, failures, breaches, or negligence were those of Processor itself. The engagement of any Sub-Processor shall not relieve Processor of any of its obligations under this DPA.
Section 7.5 — New Sub-Processor Requests
If Processor wishes to engage a new Sub-Processor that is not listed in Annex C at the time of the request, Processor shall provide Controller with written notice at least forty-five (45) days prior to the proposed engagement, which notice shall include:
(a) the information specified in Section 7.1(a) through (d);
(b) a completed Sub-Processor due diligence questionnaire in the form attached as an exhibit to Annex C;
(c) a description of the proposed Sub-Processor's security certifications, compliance posture, and data protection capabilities; and
(d) the proposed Sub-Processor's agreement (or draft agreement) with Processor, or relevant excerpts thereof, demonstrating compliance with Section 7.3.
Controller shall have the right to approve or reject the proposed Sub-Processor in its sole and absolute discretion within thirty (30) days of receipt of the complete notice and accompanying documentation. If Controller does not respond within such thirty (30)-day period, the proposed Sub-Processor shall be deemed rejected.
If Controller objects to a proposed Sub-Processor, the Parties shall negotiate in good faith to resolve the objection within fifteen (15) days of Controller's written objection. If no resolution is reached within such fifteen (15)-day period, Controller may terminate this DPA without penalty, liability, or obligation to pay termination fees, upon written notice to Processor.
ARTICLE 8 — DATA BREACH NOTIFICATION
Section 8.1 — Notification Obligation
Processor shall notify Controller of any Data Breach without undue delay and in no event later than twenty-four (24) hours after Processor becomes aware, or reasonably should have become aware, of the Data Breach. For purposes of this Section, Processor shall be deemed to be "aware" of a Data Breach at the time any employee, officer, contractor, or agent of Processor (including any Sub-Processor) has a reasonable basis for believing that a Data Breach has occurred.
Notification shall be directed to Controller's Chief Privacy Officer, Diana Kowalski, and General Counsel, Thomas Langford, by both email and telephone. Processor shall maintain current contact information for the foregoing individuals and shall request updated contact information at least annually. Controller shall promptly notify Processor of any changes to the designated contacts or their contact information.
Section 8.2 — Content of Notification
Processor's initial notification to Controller shall include, to the extent then known and available:
(a) the nature and circumstances of the Data Breach, including the date and time of discovery, the likely date and time of the breach, and a description of how the breach was discovered;
(b) the categories and approximate number of Data Subjects affected by the Data Breach;
(c) the categories and approximate number of data records affected by the Data Breach;
(d) the name and contact details of Processor's designated data protection point of contact;
(e) a description of the likely consequences of the Data Breach for affected Data Subjects, including an assessment of the risk of harm;
(f) a description of the measures taken or proposed to be taken by Processor to address the Data Breach, including measures to contain the breach and to mitigate possible adverse effects;
(g) whether any Sensitive Vehicle Data — specifically GPS/geolocation data or seat occupancy data — was involved in or potentially affected by the Data Breach; and
(h) whether any Sub-Processor was involved in or contributed to the Data Breach, and if so, the identity of the Sub-Processor and the nature of its involvement.
If Processor is unable to provide all of the information specified in this Section 8.2 at the time of initial notification, Processor shall provide such information as is then available and shall supplement the notification with additional information as it becomes available, in accordance with Section 8.3.
Section 8.3 — Supplemental Information
Processor shall provide supplemental information regarding the Data Breach to Controller as it becomes available, without undue delay. Processor shall provide updates to Controller at least every twenty-four (24) hours during the initial response phase and at regular intervals thereafter as mutually agreed by the Parties.
Processor shall cooperate fully with Controller's investigation and remediation efforts in connection with any Data Breach. Such cooperation shall include, without limitation, providing Controller with access to relevant systems, logs, records, and personnel, preserving evidence, and implementing any additional security measures or remediation steps reasonably requested by Controller.
Section 8.4 — No Independent Notification
Processor shall not notify any Data Subject, regulatory authority, law enforcement agency, media outlet, or other third party of a Data Breach involving Controller Data without Controller's prior written consent, unless Processor is required to provide such notification by Applicable Data Protection Laws. In the event that Applicable Data Protection Laws require Processor to provide notification directly, Processor shall, to the extent legally permissible, coordinate with Controller regarding the timing, content, and manner of such notification prior to issuing it.
Section 8.5 — Remediation
Processor shall take all commercially reasonable steps to contain, investigate, and remediate any Data Breach and to prevent recurrence of the same or similar breaches. Remediation efforts shall include, without limitation, patching vulnerabilities, strengthening access controls, enhancing monitoring, and implementing any additional measures necessary to address the root cause of the breach.
Processor shall provide Controller with a comprehensive root cause analysis and remediation report within thirty (30) days of discovering the Data Breach. Such report shall include: (a) a detailed timeline of the breach; (b) identification of the root cause(s); (c) a description of all remediation measures implemented; (d) an assessment of the effectiveness of such measures; and (e) recommendations for additional measures to prevent recurrence. Controller shall have the right to review and comment on the root cause analysis and remediation report and to require Processor to implement additional remediation measures that Controller reasonably deems necessary.