1007-00007 · Vantage Mobility Systems Corp · Transaction Documents

dpa-v3-0-revised-draft.docx DOCUMENT Finance & Banking

12 / 12 ← ✕

DRAFT — PRIVILEGED & CONFIDENTIAL — SUBJECT TO CONTRACT

DATA PROCESSING AGREEMENT

Version 3.0 — Revised Draft

December 2, 2022

Matter Reference: 1007-00007

Circulated by Calderwood & Harkness LLP, counsel to Vantage Mobility Systems Corp. ("VMS"), to Whitfield, Barrow & Crane LLP ("WBC"), counsel to Meridian Telematics Solutions, Inc. ("Meridian").

This version reflects resolutions agreed upon during the November 15, 2022 negotiation call between Calderwood & Harkness (R. Bernstein, A. Burke) and WBC (C. Ng, D. Yamada), with participation of L. Torrance (Meridian) and D. Kowalski (VMS). Bracketed language denotes provisions where Meridian's agreement has not yet been obtained and reflects VMS's positions on remaining open issues. Four (4) material open issues remain outstanding as identified in the drafting notes appended hereto.

DATA PROCESSING AGREEMENT

This Data Processing Agreement (this "Agreement"), dated as of the date of last signature below (the "Effective Date"), is entered into by and between:

Vantage Mobility Systems Corp., a corporation organized and existing under the laws of the State of Delaware, with its principal place of business at 4700 Automation Boulevard, Suite 300, Auburn Hills, MI 48326 (the "Controller" or "VMS");

and

Meridian Telematics Solutions, Inc., a corporation organized and existing under the laws of the State of Delaware, with its principal place of business at 1250 Embarcadero Way, Suite 400, Palo Alto, CA 94303 (the "Processor" or "Meridian").

Controller and Processor are each referred to herein individually as a "Party" and collectively as the "Parties."

RECITALS

WHEREAS, VMS designs, manufactures, and sells connected-vehicle hardware modules and integrated mobility platforms, including its proprietary VantageLink system, which collects real-time vehicle telemetry data from approximately 2.4 million connected vehicles across North America;

WHEREAS, Meridian provides cloud-based analytics and machine-learning services to automotive original equipment manufacturers ("OEMs") and Tier 1 suppliers, processing connected-vehicle data streams to generate predictive maintenance insights, driver behavior scoring, and fleet optimization analytics;

WHEREAS, the Parties executed a non-binding Letter of Intent dated August 5, 2022 (the "LOI"), outlining a connected-vehicle data-sharing partnership under which VMS would provide Meridian with certain categories of vehicle telemetry and in-cabin sensor data from VMS's VantageLink platform for processing and analysis;

WHEREAS, the data-sharing partnership contemplated by the LOI envisions Meridian processing data from approximately 800,000 active VantageLink-equipped vehicles whose owners or lessees have opted into VMS's "Connected Insights" data-sharing program;

WHEREAS, VMS, as Controller, and Meridian, as Processor, desire to enter into this Data Processing Agreement to establish the terms and conditions governing the processing of Controller Data by the Processor in connection with the partnership described in the LOI and any definitive commercial agreement entered into between the Parties;

WHEREAS, this Agreement is intended to ensure compliance with applicable data protection laws, including the Michigan Identity Theft Protection Act (MCL 445.61 et seq.), the California Consumer Privacy Act as amended by the California Privacy Rights Act (Cal. Civ. Code § 1798.100 et seq.) (collectively, "CCPA/CPRA"), and the federal Drivers' Privacy Protection Act (18 U.S.C. § 2721 et seq.) (the "DPPA"); and

WHEREAS, the Parties desire to document their respective rights and obligations with respect to the protection of Controller Data in a manner consistent with industry best practices and the requirements of all Applicable Data Protection Laws;

NOW, THEREFORE, in consideration of the mutual covenants and agreements set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:

Right-click to update Table of Contents

ARTICLE 1 — DEFINITIONS

For purposes of this Agreement, the following terms shall have the meanings set forth below. Capitalized terms used but not otherwise defined in this Article 1 shall have the meanings ascribed to them elsewhere in this Agreement.

1.1 "Applicable Data Protection Laws" means the Michigan Identity Theft Protection Act (MCL 445.61 et seq.); the California Consumer Privacy Act as amended by the California Privacy Rights Act (Cal. Civ. Code § 1798.100 et seq.) (collectively, "CCPA/CPRA"); the Drivers' Privacy Protection Act (18 U.S.C. § 2721 et seq.) ("DPPA"); and any other federal, state, or international data protection, data privacy, or data security law, statute, regulation, or rule that is applicable to the processing of Controller Data under this Agreement, in each case as amended, supplemented, or replaced from time to time.

1.2 "Approved Sub-Processor" means a Sub-Processor that is listed in Annex C as of the Effective Date or that has been subsequently approved by Controller in accordance with the procedures set forth in Section 7.3 of this Agreement.

1.3 "AutoCloud Platform" means Cloudvault Infrastructure, Inc.'s proprietary cloud hosting and data processing platform, including all related infrastructure, software, and services, used by Processor for hosting, storing, and processing Controller Data in connection with the services provided under this Agreement.

1.4 "Business Day" means any day other than a Saturday, Sunday, or a day on which banks in the State of Michigan or the State of California are authorized or required by law to be closed.

1.5 "California Data Subjects" means those Data Subjects whose vehicles are registered in the State of California, which, as of the Effective Date, comprise approximately 112,000 individuals, representing approximately fourteen percent (14%) of the total Data Subject population, and whose Personal Information is subject to the requirements of the CCPA/CPRA.

1.6 "Confidential Information" means all information disclosed by one Party (the "Disclosing Party") to the other Party (the "Receiving Party") in connection with this Agreement that is designated as confidential or that, given the nature of the information or the circumstances of disclosure, reasonably should be understood to be confidential. Confidential Information includes, without limitation, Controller Data, the terms of this Agreement, trade secrets, business plans, financial information, technical specifications, and proprietary methodologies.

1.7 "Connected Insights Program" means VMS's opt-in data-sharing program through which vehicle owners and lessees affirmatively consent to the collection and sharing of vehicle telemetry and in-cabin sensor data from their VantageLink-equipped vehicles for the purposes described in VMS's Connected Insights Program terms and conditions.

1.8 "Controller" means Vantage Mobility Systems Corp.

1.9 "Controller Data" means any and all data provided by or on behalf of the Controller to the Processor for processing under this Agreement, including all fourteen (14) categories of vehicle telemetry and in-cabin sensor data identified in Annex A, together with associated Vehicle Identification Numbers (VINs) and any metadata, derived data, or supplemental information provided by Controller in connection with such data. For the avoidance of doubt, Controller Data includes all Personal Information contained within or derivable from such data.

1.10 "Data Breach" or "Personal Data Breach" means any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to, Controller Data transmitted, stored, or otherwise processed by Processor or any Sub-Processor, whether resulting from a security incident, human error, system failure, or any other cause.

1.11 "Data Subject" means the owner, lessee, or authorized operator of a VantageLink-equipped vehicle who has opted into the Connected Insights Program and whose vehicle telemetry and in-cabin sensor data is collected by VMS and provided to Processor under this Agreement.

1.12 "Derivative Analytics Products" means any analytics products, reports, predictive models, scoring outputs, dashboards, machine-learning models, or other outputs or work products created by Processor using, incorporating, or derived from Controller Data that Processor sells, licenses, distributes, or otherwise makes available to third parties.

1.13 "Effective Date" means the date of last signature set forth on the signature page of this Agreement.

1.14 "Initial Term" has the meaning set forth in Section 12.1.

1.15 "LOI" means the non-binding Letter of Intent dated August 5, 2022, between VMS and Meridian, as described in the Recitals.

1.16 "Personal Information" means, as applicable, (a) "personal information" as defined under the CCPA/CPRA (Cal. Civ. Code § 1798.140(v)); (b) "personal information" as defined under the Michigan Identity Theft Protection Act; (c) "personal information" as defined under the DPPA (18 U.S.C. § 2725(3)); and (d) any other information that constitutes personal information, personal data, or personally identifiable information under any Applicable Data Protection Law, in each case to the extent such information is contained within or derivable from Controller Data.

1.17 "Processor" means Meridian Telematics Solutions, Inc.

1.18 "Processing" means any operation or set of operations performed on Controller Data, whether by automated or manual means, including but not limited to collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, combination, restriction, erasure, or destruction. "Process," "Processes," and "Processed" shall be construed accordingly.

1.19 "Renewal Term" has the meaning set forth in Section 12.1.

1.20 "Sensitive Vehicle Data" means Controller Data falling within the categories of (a) GPS/geolocation data (Category 1 in Annex A) and (b) seat occupancy data (Category 10 in Annex A), which, when combined with Vehicle Identification Numbers (VINs), can be linked to identifiable individuals and are classified as sensitive under VMS's internal data governance policy. Sensitive Vehicle Data is subject to the enhanced protections set forth in Section 5.2 and Annex B, Section B.4.

1.21 "Sub-Processor" means any third party (including any affiliate of Processor, but excluding Processor's own employees) engaged by the Processor to Process Controller Data on behalf of the Controller in connection with the services provided under this Agreement.

1.22 "Technical and Organizational Measures" or "TOMs" means the technical and organizational security measures described in Annex B of this Agreement, as updated from time to time in accordance with this Agreement.

1.23 "Term" means the Initial Term and any Renewal Term(s), as defined in Section 12.1.

1.24 "Territory" means the continental United States of America (the forty-eight (48) contiguous states and the District of Columbia), unless otherwise expressly stated in this Agreement.

1.25 "Vehicle Identification Number" or "VIN" means the unique seventeen-character alphanumeric identifier assigned to each motor vehicle in accordance with applicable federal regulations, used to identify each vehicle in VMS's connected-vehicle fleet and included in data records transmitted to Processor under this Agreement.

Additional terms may be defined parenthetically elsewhere in this Agreement, and such terms shall have the meanings ascribed to them in the context in which they appear.

ARTICLE 2 — SCOPE AND PURPOSE OF PROCESSING

2.1 Subject Matter of Processing. Processor shall Process Controller Data solely for the purpose of providing connected-vehicle data analytics services as described in the LOI dated August 5, 2022, including the generation of predictive maintenance insights, driver behavior scoring, and fleet optimization analytics (collectively, the "Permitted Purposes"). Processor shall not Process Controller Data for any purpose other than the Permitted Purposes, unless otherwise expressly authorized in writing by Controller or required by Applicable Data Protection Laws (in which case Processor shall comply with Section 4.1). The scope of the Permitted Purposes encompasses data ingestion, cleansing, normalization, transformation, aggregation, analysis, modeling, visualization, and the generation of analytics outputs for delivery to Controller and, to the extent authorized under a separate commercial agreement between the Parties, for incorporation into Derivative Analytics Products.

2.2 Categories of Data. The Controller Data subject to this Agreement comprises fourteen (14) categories of vehicle telemetry and in-cabin sensor data, as set forth in detail in Annex A. The fourteen categories are as follows:

(1) GPS/geolocation; (2) vehicle speed; (3) acceleration/deceleration; (4) braking events; (5) tire pressure; (6) engine diagnostic codes; (7) fuel consumption; (8) in-cabin temperature; (9) in-cabin humidity; (10) seat occupancy; (11) seatbelt status; (12) ambient noise levels; (13) windshield wiper activation; and (14) headlight/taillight status.

Each data record transmitted by Controller to Processor will include the associated Vehicle Identification Number (VIN) and relevant metadata, including timestamp, vehicle make, model, and model year (to the extent available). The full descriptions of each data category, including technical specifications and data formats, are set forth in Annex A.

2.3 Sensitive Vehicle Data. GPS/geolocation data (Category 1) and seat occupancy data (Category 10) are designated as Sensitive Vehicle Data under VMS's internal data governance policy. These categories of data, when combined with VINs, are capable of being linked to identifiable individuals and present heightened privacy risks. Processor acknowledges the sensitive nature of these data categories and shall apply the enhanced protections specified in Section 5.2 and in Annex B, Section B.4 (Enhanced Protections for Sensitive Vehicle Data). Processor shall not downgrade the classification of any data category designated as Sensitive Vehicle Data without the prior written consent of Controller.

2.4 Volume of Data. Processor shall be capable of receiving, processing, and analyzing approximately 4.2 terabytes per day of raw telemetry data streaming from approximately 800,000 active VantageLink-equipped vehicles enrolled in the Connected Insights Program. Processor acknowledges that the volume of data may fluctuate based on the number of active vehicles, driving patterns, and seasonal variations, and shall maintain sufficient processing capacity to accommodate reasonable fluctuations without degradation of service quality or security.

2.5 Data Subjects. The Data Subjects whose data is processed under this Agreement are the approximately 800,000 vehicle owners and lessees who have opted into VMS's Connected Insights Program. As of the date of this Agreement, approximately 112,000 of these Data Subjects (representing approximately fourteen percent (14%) of the total Data Subject population) have vehicles registered in the State of California and are therefore considered California Data Subjects whose Personal Information is subject to the CCPA/CPRA. The number of Data Subjects and the proportion of California Data Subjects may change over time as new vehicle owners opt in or out of the Connected Insights Program.

2.6 Duration of Processing. Processing of Controller Data shall continue for the Term of this Agreement, as defined in Article 12. Upon expiration or termination of this Agreement, Processor's authority to Process Controller Data shall cease immediately, subject to the data return and deletion obligations set forth in Article 10.

2.7 Location of Processing. Unless otherwise approved in writing by the Controller in accordance with Article 8, all Processing of Controller Data shall occur within the continental United States, specifically at the following locations:

(a) Processor's data operations center located at 8900 Research Park Drive, Building C, Austin, TX 78759; and

(b) Approved Sub-Processor facilities located within the continental United States, as identified in Annex C (as of the Effective Date, the sole such facility is Cloudvault Infrastructure, Inc.'s data center located at 7400 Crossroads Boulevard, Columbus, OH 43219).

Processor shall not migrate, replicate, or otherwise transfer Controller Data to any other facility or location without the prior written consent of Controller. Processor shall promptly notify Controller of any planned changes to the physical location of its data processing facilities.

2.8 Prohibited Processing. Processor shall not, under any circumstances:

(a) Process Controller Data for any purpose other than the Permitted Purposes set forth in this Article 2;

(b) sell, rent, lease, or otherwise commercially exploit Controller Data, except to the extent expressly permitted under a separate written commercial agreement between the Parties and in compliance with Applicable Data Protection Laws;

(c) de-identify, re-identify, or attempt to identify any Data Subject using Controller Data, except as strictly necessary to perform the analytics services described in Section 2.1, and in no event shall Processor use Controller Data to build or contribute to any consumer profile or dossier relating to any individual Data Subject;

(d) combine Controller Data with data obtained from any other source, including data obtained from Processor's other customers, publicly available data, or data purchased from third-party data brokers, without the prior written consent of Controller; or

(e) use Controller Data to train, develop, or improve any machine-learning model, algorithm, or artificial intelligence system for Processor's own commercial purposes or for the benefit of any third party, except to the extent expressly authorized in writing by Controller and in compliance with the data retention limitations set forth in Article 10.

ARTICLE 3 — CONTROLLER OBLIGATIONS

3.1 Lawful Basis for Processing. Controller represents and warrants that it has obtained all necessary consents, authorizations, and permissions from Data Subjects through the Connected Insights Program to collect, share, and permit the processing of Controller Data by Processor for the Permitted Purposes described in this Agreement. Controller further represents and warrants that the consents obtained from Data Subjects are sufficient in scope, form, and substance to authorize the processing activities contemplated by this Agreement, including the provision of Controller Data to Processor and the generation of analytics outputs. Controller shall maintain records of such consents and shall make them available to Processor upon reasonable request to the extent necessary for Processor to demonstrate compliance with Applicable Data Protection Laws.

3.2 Compliance with Applicable Data Protection Laws. Controller shall comply with all Applicable Data Protection Laws with respect to the collection, storage, and sharing of Controller Data with Processor. Controller shall be responsible for ensuring that its collection of vehicle telemetry and in-cabin sensor data from VantageLink-equipped vehicles complies with all applicable privacy notices, terms of service, and regulatory requirements. Without limiting the foregoing, Controller shall ensure that its Connected Insights Program terms and conditions accurately describe the types of data collected, the purposes for which data is shared with Processor, and the rights of Data Subjects with respect to their data.

3.3 Accuracy and Quality. Controller shall use commercially reasonable efforts to ensure the accuracy, completeness, and quality of Controller Data transmitted to Processor. Controller acknowledges that the accuracy of analytics outputs generated by Processor is dependent in part on the accuracy and quality of the Controller Data provided. Controller shall promptly notify Processor of any known data quality issues, corrupted data streams, or systematic errors in the Controller Data that may affect Processor's analytics services.

3.4 Data Subject Rights. Controller shall be solely responsible for receiving, evaluating, and responding to Data Subject requests, including requests submitted pursuant to the CCPA/CPRA (such as requests to know, requests to delete, requests to correct, and requests to opt out of the sale or sharing of personal information), the DPPA, and any other Applicable Data Protection Laws. Controller shall notify Processor of any such requests that require action on the part of Processor (including the retrieval, correction, or deletion of Controller Data in Processor's possession) within a reasonable timeframe, and in any event sufficiently in advance of any applicable regulatory deadline to enable Processor to comply in accordance with Section 14.2.

3.5 DPPA Compliance. Controller represents and warrants that its sharing of Controller Data with Processor complies with the permissible uses set forth in the Drivers' Privacy Protection Act (18 U.S.C. § 2721 et seq.) and that Controller Data containing motor vehicle records or personal information derived therefrom is disclosed to Processor only for purposes permitted under DPPA. Controller shall promptly notify Processor if at any time Controller becomes aware that its sharing of Controller Data may not comply with the DPPA or any other Applicable Data Protection Law.

3.6 Instructions. Controller shall provide documented instructions for the Processing of Controller Data, which instructions shall be consistent with the terms of this Agreement and the Permitted Purposes. Controller may supplement, modify, or revoke such instructions in writing during the Term, provided that any such supplementation, modification, or revocation is consistent with the terms of this Agreement. If any supplemental or modified instruction would, in Processor's reasonable opinion, require material changes to Processor's processing infrastructure, systems, or procedures, the Parties shall negotiate in good faith regarding the implementation of such instruction, including any adjustments to fees or timelines.

ARTICLE 4 — PROCESSOR OBLIGATIONS

4.1 Processing Instructions. Processor shall Process Controller Data solely in accordance with the Controller's documented instructions as provided pursuant to Section 3.6 and as otherwise set forth in this Agreement. Processor shall not Process Controller Data in any manner inconsistent with Controller's instructions unless required to do so by Applicable Data Protection Laws, in which case Processor shall: (a) promptly inform Controller of such legal requirement before commencing the required Processing (unless the law prohibits such notification on important grounds of public interest); and (b) limit such Processing to the minimum necessary to comply with the legal requirement. If Processor believes, in its reasonable professional judgment, that any instruction from Controller infringes or would cause Processor to infringe any Applicable Data Protection Law, Processor shall promptly inform Controller in writing, specifying the instruction at issue and the basis for Processor's belief, and shall not be required to carry out such instruction until Controller confirms or modifies the instruction.

4.2 Confidentiality. Processor shall ensure that all personnel authorized to Process Controller Data, including employees, contractors, and temporary staff, are bound by enforceable obligations of confidentiality with respect to Controller Data, whether by written contract, professional ethical obligation, or statutory requirement. Processor shall limit access to Controller Data to those personnel who have a demonstrable need to access such data in order to perform the services contemplated by this Agreement, and shall maintain a current list of all personnel with access to Controller Data, which list shall be made available to Controller upon request.

4.3 Technical and Organizational Measures. Processor shall implement and maintain, at its own cost, the Technical and Organizational Measures set forth in Annex B throughout the Term of this Agreement. Processor shall ensure that such measures provide a level of security appropriate to the risks presented by the Processing of Controller Data, including the risks of accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access, taking into account the nature, scope, context, and purposes of Processing, the state of the art, and the costs of implementation. Processor shall periodically review and, where necessary, update the TOMs to address evolving threats, vulnerabilities, and industry standards, provided that no update shall materially reduce the level of protection afforded to Controller Data without the prior written consent of Controller.

4.4 Cooperation. Processor shall reasonably assist Controller in ensuring compliance with Applicable Data Protection Laws, including but not limited to the following:

(a) Data Subject Requests. Processor shall assist Controller in responding to Data Subject requests (including CCPA/CPRA consumer rights requests) by providing the requested information or performing the requested actions (such as deletion or correction of Controller Data) within five (5) Business Days of receiving notification from Controller of such request, or within such shorter timeframe as may be required by Applicable Data Protection Laws;

(b) Data Protection Impact Assessments. Processor shall, upon Controller's reasonable request, provide such information and assistance as is reasonably necessary to enable Controller to conduct data protection impact assessments or similar assessments required under Applicable Data Protection Laws in connection with the Processing of Controller Data;

(c) Regulatory Cooperation. Processor shall cooperate with Controller in responding to inquiries, investigations, or enforcement actions by any regulatory authority relating to the Processing of Controller Data, including by providing documentation, access to personnel, and other reasonable assistance as Controller may request; and

(d) Documentation. Processor shall maintain, and make available to Controller upon request, all documentation reasonably necessary to demonstrate Processor's compliance with this Agreement and with Applicable Data Protection Laws.

4.5 CCPA/CPRA Compliance. In respect of the approximately 112,000 California Data Subjects whose vehicles are registered in the State of California, Processor acknowledges and agrees that, for purposes of the CCPA/CPRA, it is a "service provider" (as defined in Cal. Civ. Code § 1798.140(ag)) and shall comply with all obligations applicable to service providers under the CCPA/CPRA. Without limiting the generality of the foregoing, Processor shall not:

(a) sell or share (as those terms are defined in the CCPA/CPRA) Personal Information received from or on behalf of Controller;

(b) retain, use, or disclose Personal Information for any purpose other than for the specific purpose of performing the services specified in this Agreement, including retaining, using, or disclosing Personal Information for a commercial purpose other than providing the services specified in this Agreement, as permitted by the CCPA/CPRA;

(c) retain, use, or disclose Personal Information outside of the direct business relationship between Controller and Processor; or

(d) combine Personal Information received from or on behalf of Controller with personal information that Processor receives from or on behalf of another person or persons, or collects from its own interaction with Data Subjects, except as expressly permitted by the CCPA/CPRA.

Processor certifies that it understands and will comply with the restrictions set forth in this Section 4.5 and the applicable requirements of the CCPA/CPRA.

4.6 DPPA Compliance. Processor acknowledges that certain Controller Data may constitute motor vehicle records or personal information derived therefrom, as defined in the DPPA (18 U.S.C. § 2725). Processor shall not disclose, use, or permit access to any Controller Data that constitutes a motor vehicle record or personal information derived therefrom except as permitted under the DPPA and only in accordance with Controller's documented instructions. Processor shall implement appropriate administrative and technical safeguards to prevent the unauthorized disclosure of DPPA-protected information.

4.7 Records of Processing Activities. Processor shall maintain complete and accurate records of all categories of Processing activities carried out on behalf of Controller, including: (a) the name and contact details of Processor and, where applicable, of each Sub-Processor; (b) the categories of Processing carried out on behalf of Controller; (c) where applicable, transfers of Controller Data to a third country or international organization; (d) a general description of the Technical and Organizational Measures implemented pursuant to Section 4.3 and Annex B; and (e) the purposes of Processing. Such records shall be maintained in written or electronic form and shall be made available to Controller upon request and to any competent regulatory authority as required by Applicable Data Protection Laws.

ARTICLE 5 — SECURITY MEASURES

5.1 Minimum Security Standards. Processor shall implement and maintain, throughout the Term, the Technical and Organizational Measures described in Annex B, which shall constitute the minimum security standards for the Processing of Controller Data. Without limiting the detailed requirements set forth in Annex B, such measures shall include, at a minimum:

(a) Encryption. Encryption of Controller Data at rest using the Advanced Encryption Standard with 256-bit keys (AES-256) and encryption of Controller Data in transit using Transport Layer Security version 1.2 or higher (TLS 1.2+);

(b) Access Controls. Implementation and enforcement of role-based access control (RBAC) mechanisms, multi-factor authentication (MFA) for all access to systems containing Controller Data, unique user credentials (with no shared accounts), and quarterly access reviews;

(c) Network Security. Network segmentation isolating Controller Data processing environments from other systems, deployment of intrusion detection and prevention systems (IDS/IPS), and firewall configurations set to deny-by-default;

(d) Vulnerability Management. Regular vulnerability scanning (no less frequently than quarterly) and annual penetration testing conducted by a qualified independent third party;

(e) Logging and Monitoring. Centralized logging of all access, modification, and deletion events relating to Controller Data, with real-time monitoring and alerting for anomalous activity, and log retention for a minimum of twelve (12) months;

(f) Personnel Security. Background checks for all personnel with access to Controller Data, annual security awareness training, and binding confidentiality agreements; and

(g) Physical Security. Physical access controls at all data processing facilities (including biometric and badge-based access), 24/7 video surveillance and environmental monitoring, and visitor access logging and escort requirements.

5.2 Enhanced Protections for Sensitive Vehicle Data. In addition to the minimum security standards set forth in Section 5.1, Processor shall apply the following enhanced protections to Sensitive Vehicle Data (GPS/geolocation data and seat occupancy data), as further described in Annex B, Section B.4:

(a) Pseudonymization. Pseudonymization of VINs prior to any analytical processing to prevent direct linkage of Sensitive Vehicle Data to identifiable individuals. The pseudonymization methodology shall be documented and made available to Controller upon request;

(b) Access Restriction. Access to Sensitive Vehicle Data shall be restricted to a limited number of authorized personnel on a strict need-to-know basis, limited to senior data scientists and designated project leads only, as approved by Processor's Chief Information Security Officer (or equivalent);

(c) Separate Logical Storage. Sensitive Vehicle Data shall be stored in a separate logical storage environment, physically or logically isolated from other categories of Controller Data and from data belonging to Processor's other customers;

(d) Enhanced Audit Logging. All access to Sensitive Vehicle Data shall be subject to enhanced audit logging, with logs retained for a minimum of twelve (12) months and available for inspection by Controller upon request; and

(e) Quarterly Access Reviews. Processor shall conduct quarterly access reviews specific to the Sensitive Vehicle Data environments, documenting the results of each review and remediating any identified issues within fifteen (15) Business Days.

5.3 Security Assessment. Controller may, at its own cost, commission an independent third-party cybersecurity assessment of Processor's data processing environment prior to the commencement of Processing and at any time during the Term upon reasonable written notice to Processor. Such assessments may include vulnerability assessments, penetration testing, configuration reviews, and policy and procedure reviews. Processor shall cooperate fully with such assessments, including by providing reasonable access to facilities, systems, documentation, and personnel, subject to Processor's reasonable security protocols. Processor shall promptly remediate any material vulnerabilities identified during such assessments and shall provide Controller with a written remediation plan and evidence of remediation within thirty (30) days of receiving notice of the findings. This provision reflects the resolution agreed upon by the Parties during the November 15, 2022 negotiation call.

5.4 Ongoing Security Review. Processor shall conduct an annual internal security review of its data processing environment, including a comprehensive assessment of the effectiveness of the Technical and Organizational Measures implemented pursuant to this Agreement and Annex B. Processor shall provide a written summary report of each annual security review to Controller within thirty (30) days of the completion of such review. Such report shall include, at a minimum, a summary of the scope of the review, the findings, any identified deficiencies, and the remediation actions taken or planned.

5.5 Industry Certifications. Processor shall obtain and maintain, at its own cost, a current SOC 2 Type II certification (or equivalent industry-recognized certification acceptable to Controller) covering the data processing environment used for Controller Data throughout the Term. Processor shall provide copies of its most recent SOC 2 Type II report to Controller upon request and, without request, promptly following the issuance of each new report. If at any time Processor's SOC 2 Type II certification lapses, is withdrawn, or is qualified by material exceptions, Processor shall promptly notify Controller and shall use commercially reasonable efforts to restore such certification within ninety (90) days.

ARTICLE 6 — DATA BREACH NOTIFICATION AND RESPONSE

6.1 Notification Obligation. [OPEN ISSUE — VMS POSITION] Processor shall notify Controller of any Personal Data Breach without undue delay and in any event within [twenty-four (24) hours] of Processor becoming aware of such breach. For purposes of this Section 6.1, Processor shall be deemed to have become "aware" of a Personal Data Breach at the time any employee, officer, contractor, or agent of Processor with responsibility for information security, data protection, or incident response has a reasonable basis to believe that a Personal Data Breach has occurred.

[Note: Meridian has proposed a seventy-two (72) hour notification window, citing alignment with GDPR standards and the practical challenges of investigating and confirming breaches within twenty-four hours. VMS maintains its twenty-four (24) hour position, noting the sensitivity of the Controller Data and the large Data Subject population. Bracketed language reflects VMS's position. This issue remains open for further negotiation.]

6.2 Content of Notification. Processor's initial notification to Controller pursuant to Section 6.1 shall include, to the extent such information is reasonably available at the time of notification:

(a) a description of the nature of the Personal Data Breach, including, where possible, the categories and approximate number of Data Subjects affected and the categories and approximate number of data records affected;

(b) the name, title, and contact details of Processor's data protection contact or other point of contact from whom Controller can obtain further information;

(c) a description of the likely consequences of the Personal Data Breach, including an assessment of the potential harm to affected Data Subjects;

(d) a description of the measures taken or proposed to be taken by Processor to address the Personal Data Breach, including, where appropriate, measures to contain the breach and mitigate its possible adverse effects; and

(e) a preliminary timeline for investigation and remediation.

6.3 Supplemental Information. If it is not possible for Processor to provide all of the information specified in Section 6.2 at the time of initial notification, Processor shall provide such information in phases, as it becomes available, without further undue delay. In any event, Processor shall provide all material supplemental information within seventy-two (72) hours of the initial notification. Processor shall continue to update Controller as additional information becomes available until the Personal Data Breach has been fully investigated and remediated.

6.4 Remediation. Processor shall take immediate steps to contain and remediate any Personal Data Breach, including implementing measures to prevent the recurrence of the breach and to mitigate any harm to affected Data Subjects. Processor shall keep Controller informed, on at least a daily basis during the initial response phase, of the status of remediation efforts, including any changes to the scope or severity of the breach. Processor shall, within fourteen (14) days of the resolution of the breach, provide Controller with a written post-incident report, including a root cause analysis, a description of remedial actions taken, and recommendations for preventing similar incidents in the future.

6.5 Cooperation. Processor shall cooperate fully with Controller in investigating, mitigating, and remediating any Personal Data Breach, including by:

(a) preserving and securing all evidence relating to the breach, including logs, records, and forensic data;

(b) providing Controller with reasonable access to Processor's personnel, systems, and facilities as necessary for Controller's investigation;

(c) providing reasonable assistance with any notifications to regulatory authorities or Data Subjects that Controller determines are required under Applicable Data Protection Laws; and

(d) implementing any additional security measures reasonably requested by Controller in response to the breach.

6.6 Notification to Regulatory Authorities and Data Subjects. Controller shall have sole authority and discretion to determine whether notification of any Personal Data Breach to any regulatory authority, Data Subject, or other person is required or advisable under Applicable Data Protection Laws or otherwise. Processor shall not notify any regulatory authority, Data Subject, or other person directly of any Personal Data Breach involving Controller Data without Controller's prior written consent, except where Processor is independently and directly obligated to provide such notification under Applicable Data Protection Laws (in which case Processor shall provide Controller with prior notice of such notification and a copy of the proposed notification, to the extent permitted by law).

6.7 No Admission. Processor's notification of a Personal Data Breach pursuant to this Article 6 shall not be construed as an acknowledgment of fault, liability, or responsibility on the part of Processor for the Personal Data Breach. Nothing in this Section 6.7 shall limit or affect the allocation of liability or indemnification obligations set forth in Article 11.

ARTICLE 7 — SUB-PROCESSORS

7.1 General Restriction. [OPEN ISSUE — VMS POSITION] Processor shall not engage, appoint, or authorize any Sub-Processor to Process Controller Data on behalf of Controller without the prior written consent of Controller.

[Note: Meridian has proposed a general authorization model under which Processor would be authorized to engage Sub-Processors, subject to providing Controller with thirty (30) calendar days' advance notice and an opportunity to object. VMS maintains its prior written consent position, reflecting the sensitivity and volume of Controller Data. Bracketed language reflects VMS's position. This issue remains open for further negotiation.]

7.2 Approved Sub-Processors. The Sub-Processors listed in Annex C are hereby approved by Controller as of the Effective Date of this Agreement. As of the Effective Date, the sole Approved Sub-Processor is Cloudvault Infrastructure, Inc., which provides cloud hosting and data storage services on the AutoCloud Platform from its data center located at 7400 Crossroads Boulevard, Columbus, OH 43219. Processor warrants that it has entered into a written agreement with Cloudvault Infrastructure, Inc. that imposes data protection obligations no less protective than those set forth in this Agreement, as further described in Annex C, Section C.4.

7.3 Sub-Processor Approval Process. [VMS position] In the event Processor wishes to engage a new Sub-Processor, or to materially change the scope of Processing activities performed by an existing Approved Sub-Processor, Processor shall submit a written request to Controller identifying the proposed new Sub-Processor or the proposed change, including the following information:

(a) the full legal name, corporate form, jurisdiction of incorporation, and principal place of business of the proposed Sub-Processor;

(b) the physical location(s) at which the proposed Sub-Processor will Process Controller Data;

(d) the categories of Controller Data to be Processed by the proposed Sub-Processor;

(e) a description of the security measures to be implemented by the proposed Sub-Processor, including whether the proposed Sub-Processor maintains SOC 2 Type II certification (or equivalent);

(f) any relevant certifications, audit reports, or security assessments relating to the proposed Sub-Processor; and

(g) the proposed terms of the data processing agreement to be entered into between Processor and the proposed Sub-Processor.

Controller shall respond to a complete Sub-Processor approval request within [fifteen (15) Business Days] of receipt. Controller may, in its sole discretion, approve or deny any request to engage a new Sub-Processor, and Controller shall not be required to provide reasons for any denial. If Controller does not respond within the specified period, the request shall be deemed denied.

7.4 Flow-Down Obligations. Processor shall impose on each Approved Sub-Processor, by way of a written agreement, data protection and security obligations that are no less protective than those set forth in this Agreement, including, without limitation, the security requirements set forth in Annex B, the confidentiality obligations set forth in Article 13, and the data retention and deletion obligations set forth in Article 10. Processor shall ensure that each Sub-Processor agreement includes provisions granting Controller audit rights equivalent to those set forth in Article 9. Processor shall provide Controller with copies of the relevant data protection provisions of each Sub-Processor agreement upon request.

7.5 Processor Liability for Sub-Processors. Processor shall remain fully liable to Controller for the acts, omissions, errors, and defaults of each of its Sub-Processors (whether approved or not) as if such acts, omissions, errors, and defaults were those of Processor itself. The engagement of any Sub-Processor shall not relieve Processor of any of its obligations under this Agreement.

7.6 Removal of Sub-Processor. Controller may, upon written notice to Processor, require Processor to remove or replace any Sub-Processor if Controller reasonably determines that such Sub-Processor is not meeting the requirements of this Agreement, has experienced a Personal Data Breach, or otherwise poses an unacceptable risk to the security or privacy of Controller Data. Processor shall comply with any such requirement within thirty (30) days of receiving notice (or within such shorter period as may be reasonably necessary to protect Controller Data), and shall make alternative arrangements for the Processing activities previously performed by the removed Sub-Processor at Processor's own cost.

ARTICLE 8 — INTERNATIONAL DATA TRANSFERS

8.1 Restriction on International Transfers. Processor shall not transfer, transmit, access, or Process Controller Data outside the continental United States without the prior written consent of Controller. This restriction applies to all forms of transfer, including remote access by personnel located outside the continental United States, storage or backup of Controller Data at facilities located outside the continental United States, and any transfer to or through systems or networks located outside the continental United States.

[Note: This provision was drafted in response to Meridian's disclosure during the October 2022 negotiation that Cloudvault Infrastructure, Inc. is considering a potential future migration of certain workloads to its facility in Dublin, Ireland. As of this draft, no EU data subjects are in scope and all Processing occurs within the continental United States. VMS requires that this restriction remain in place to prevent any unauthorized international transfer of Controller Data.]

8.2 Conditions for Approved International Transfers. In the event that Controller provides written consent for an international transfer of Controller Data, such transfer shall be subject to the following conditions:

(a) Processor shall ensure that appropriate safeguards are in place to protect Controller Data in the receiving jurisdiction, including, where applicable, the execution of Standard Contractual Clauses (as adopted by the European Commission or other relevant authority) or equivalent transfer mechanisms recognized under Applicable Data Protection Laws;

(b) Processor shall conduct a transfer impact assessment evaluating the legal framework and data protection standards of the receiving jurisdiction and shall provide such assessment to Controller for review and approval prior to the commencement of any transfer;

(c) Processor shall ensure that the receiving country provides an adequate level of data protection or that additional supplementary technical, organizational, and contractual measures are implemented to ensure protection equivalent to that afforded within the continental United States; and

(d) the transfer shall comply with all Applicable Data Protection Laws, including any requirements for regulatory notification or authorization.

8.3 Cloudvault Dublin Facility. For the avoidance of doubt, Processor is not authorized under this Agreement to transfer any Controller Data to Cloudvault Infrastructure, Inc.'s data center located at Unit 12, Parkwest Business Campus, Dublin 12, Ireland, or to any other Cloudvault facility located outside the continental United States. Any such transfer would require Controller's prior written consent and full compliance with the conditions set forth in Section 8.2, as well as any additional requirements imposed by Controller at the time of consent.

8.4 Notification of Compelled Transfer. If Processor receives a legally binding request, order, subpoena, warrant, or other directive from any government authority (whether domestic or foreign) that would require or compel the transfer, disclosure, or access of Controller Data to a location outside the continental United States, Processor shall:

(a) promptly notify Controller of such request or order, to the extent not prohibited by law, providing sufficient detail to enable Controller to assess the request and, if appropriate, seek a protective order or other appropriate remedy;

(b) use commercially reasonable efforts to redirect the request or order to Controller, so that Controller may respond directly;

(c) not disclose or transfer Controller Data in response to such request or order until Controller has had a reasonable opportunity to challenge or respond to the request, unless Processor is compelled to do so by applicable law or court order; and

(d) disclose only the minimum amount of Controller Data necessary to comply with the request or order.

ARTICLE 9 — AUDIT RIGHTS

9.1 Controller Audit Rights. [OPEN ISSUE — VMS POSITION] Controller shall have the right to conduct [on-site audits] of Processor's data processing facilities, systems, and records to verify Processor's compliance with this Agreement, including Processor's compliance with the Technical and Organizational Measures set forth in Annex B, the data retention and deletion requirements set forth in Article 10, and all other obligations of Processor under this Agreement.

(a) Notice. Controller may conduct such audits upon not less than [ten (10) Business Days'] prior written notice to Processor. [VMS position; Meridian proposed thirty (30) calendar days.]

(b) Scope. Audits may include, without limitation, on-site inspection of Processor's data processing facilities and data centers (including the Austin, TX data operations center and any Approved Sub-Processor facilities), review of records, policies, procedures, and documentation, interviews with Processor's personnel (including information security, engineering, and operations staff), and testing of Technical and Organizational Measures.

(c) Frequency. [VMS position: no cap on the number of audits that Controller may conduct during the Term. Meridian proposed a limitation of one (1) audit per calendar year. Compromise language pending further negotiation.]

[Note: VMS proposes unlimited on-site audit rights with ten (10) Business Days' notice. Meridian proposes annual audits only, with thirty (30) calendar days' notice and a $25,000 cost-sharing cap per audit. The bracketed language in this Section reflects VMS's position, with a minor modification to the notice period reflecting a preliminary compromise discussed during the November 15 call. The frequency and cost-sharing provisions remain open.]

9.2 Processor Cooperation. Processor shall cooperate fully with Controller's audits and shall provide Controller and its auditors with reasonable access to Processor's facilities, systems, documentation, and personnel during normal business hours. Processor shall designate a single point of contact to coordinate audit logistics and shall respond to reasonable audit-related information requests within five (5) Business Days. Processor shall not obstruct, delay, or otherwise impede any audit conducted by Controller or its authorized representatives.

9.3 Cost of Audits. [VMS position] Each Party shall bear its own internal costs and expenses in connection with any audit. Controller shall reimburse Processor for reasonable, documented out-of-pocket costs directly incurred by Processor in facilitating audits (such as costs of third-party contractors required to support the audit process), [subject to no per-audit cap].

[Note: Meridian proposed a $25,000 cost-sharing cap per audit. VMS has not accepted this cap. Bracketed language reflects VMS's position. This issue remains open.]

9.4 Third-Party Auditors. Controller may engage independent third-party auditors to conduct audits on its behalf, provided that: (a) such auditors are bound by written confidentiality obligations no less protective than those set forth in Article 13; (b) such auditors are not direct competitors of Processor; and (c) Controller provides Processor with reasonable advance notice of the identity of any third-party auditor engaged to conduct an audit. Processor may raise a reasonable objection to a proposed third-party auditor, and the Parties shall negotiate in good faith to resolve any such objection.

9.5 Sub-Processor Audits. Controller's audit rights under this Article 9 shall extend to all Approved Sub-Processors engaged by Processor to Process Controller Data. Processor shall use commercially reasonable efforts to ensure that Controller has equivalent audit rights with respect to each Approved Sub-Processor, including Cloudvault Infrastructure, Inc. Where Processor is unable to secure direct audit rights for Controller with respect to a Sub-Processor, Processor shall, at Controller's request, exercise its own audit rights under its agreement with the Sub-Processor and provide Controller with a copy of the audit report.

9.6 Remediation. If any audit conducted pursuant to this Article 9 reveals material non-compliance with this Agreement or any Applicable Data Protection Law, Processor shall:

(a) develop and submit to Controller a detailed written remediation plan within thirty (30) days of receiving notice of the audit findings, specifying the non-compliance identified, the root cause(s), the corrective actions to be taken, and the timeline for implementation;

(b) implement the remediation plan in accordance with the agreed timeline; and

(c) provide Controller with written evidence of the completion of each corrective action and, if requested by Controller, submit to a follow-up audit to verify the effectiveness of remediation, at Processor's cost.

9.7 SOC 2 Reports. Without limiting Controller's audit rights under this Article 9, Processor shall provide Controller with copies of its most recent SOC 2 Type II audit report (and, to the extent available, the most recent SOC 2 Type II audit reports of Approved Sub-Processors, including Cloudvault Infrastructure, Inc.) upon request, and no less frequently than annually. If any SOC 2 Type II report identifies material control deficiencies or exceptions, Processor shall promptly notify Controller and shall implement corrective measures in accordance with Section 9.6.

ARTICLE 10 — DATA RETENTION AND DELETION

10.1 Retention Period. [OPEN ISSUE — VMS POSITION] Processor shall retain raw Controller Data only for so long as reasonably necessary to perform the Processing purposes set forth in this Agreement and shall delete or return all raw Controller Data within [ninety (90) days] of initial Processing.

[Note: VMS proposes a ninety (90) day rolling deletion cycle for raw Controller Data after initial Processing. Meridian has proposed an eighteen (18) month retention period to enable machine-learning model training and iterative analytics refinement. VMS does not accept the eighteen-month period due to concerns regarding data minimization, the sensitive nature of Controller Data, and the large Data Subject population. Bracketed language reflects VMS's position. This issue remains open for further negotiation.]

10.2 Rolling Deletion. Processor shall implement automated rolling deletion mechanisms to ensure that raw Controller Data is securely and irreversibly deleted within [ninety (90) days] of initial Processing, unless otherwise instructed in writing by Controller. Processor shall maintain documentation of its rolling deletion procedures, including the technical mechanisms used, the deletion schedule, and verification processes, and shall make such documentation available to Controller upon request. Processor shall not manually override or disable automated rolling deletion mechanisms without the prior written consent of Controller.

10.3 Aggregated/Anonymized Data. Nothing in this Article 10 shall prevent Processor from retaining truly anonymized, aggregated data from which no individual Data Subject can be identified or re-identified, directly or indirectly, provided that all of the following conditions are satisfied:

(a) such anonymization is irreversible and meets the standard of anonymization under Applicable Data Protection Laws, such that the data no longer constitutes Personal Information;

(b) all VINs, GPS/geolocation data, and seat occupancy data have been permanently and irrevocably removed from the anonymized data set;

(c) the anonymized data cannot, by any means reasonably likely to be used, be linked back to any individual vehicle, VIN, or Data Subject; and

(d) Processor maintains documentation of the anonymization methodology applied, which documentation shall be available to Controller upon request.

For the avoidance of doubt, data that has been merely pseudonymized (i.e., data from which direct identifiers have been replaced with pseudonyms but which can be re-identified through the use of additional information) shall not be considered anonymized data for purposes of this Section 10.3 and shall remain subject to the retention and deletion requirements of this Article 10.

10.4 Deletion Upon Termination. Upon termination or expiration of this Agreement for any reason, Processor shall, at Controller's election (which election shall be communicated in writing within thirty (30) days of the effective date of termination or expiration):

(a) return all Controller Data to Controller in a commonly used, machine-readable format (such as CSV, JSON, or Parquet), via a secure transfer mechanism agreed upon by the Parties; or

(b) securely delete all Controller Data (including all copies, backups, and reproductions thereof, whether in electronic or physical form) using industry-standard data sanitization methods (such as NIST SP 800-88 guidelines) and provide written certification of such deletion to Controller within thirty (30) days of the effective date of termination or expiration.

If Controller does not communicate its election within the thirty (30) day period, Processor shall securely delete all Controller Data in accordance with clause (b) above. The obligations set forth in this Section 10.4 shall extend to all Controller Data held by Approved Sub-Processors, and Processor shall ensure that each Sub-Processor complies with the applicable return or deletion requirements.

10.5 Deletion Certification. Following any deletion of Controller Data, whether pursuant to the rolling deletion procedures set forth in Section 10.2 or the deletion upon termination procedures set forth in Section 10.4, Processor shall provide Controller with a written certification of deletion, signed by an authorized officer or representative of Processor, specifying: (a) the categories and approximate volume of data deleted; (b) the method(s) of deletion used; (c) the date(s) on which deletion was completed; and (d) confirmation that no copies, backups, or reproductions of the deleted data have been retained, except as permitted by Section 10.3 or Section 10.6.

10.6 Retention Exceptions. Processor may retain Controller Data beyond the periods set forth in this Article 10 only to the extent retention is required by Applicable Data Protection Laws, applicable regulatory requirements, or a valid and enforceable order of a court or governmental authority, provided that Processor:

(a) promptly notifies Controller of such retention requirement, specifying the legal basis, the categories and volume of data to be retained, and the expected duration of retention;

(b) limits retention to the minimum data and the minimum period necessary to comply with the applicable requirement;

DRAFT — PRIVILEGED & CONFIDENTIAL — SUBJECT TO CONTRACT
DATA PROCESSING AGREEMENT
Version 3.0 — Revised Draft
December 2, 2022
Matter Reference: 1007-00007
Circulated by Calderwood & Harkness LLP, counsel to Vantage Mobility Systems Corp. ("VMS"), to Whitfield, Barrow & Crane LLP ("WBC"), counsel to Meridian Telematics Solutions, Inc. ("Meridian").
This version reflects resolutions agreed upon during the November 15, 2022 negotiation call between Calderwood & Harkness (R. Bernstein, A. Burke) and WBC (C. Ng, D. Yamada), with participation of L. Torrance (Meridian) and D. Kowalski (VMS). Bracketed language denotes provisions where Meridian's agreement has not yet been obtained and reflects VMS's positions on remaining open issues. Four (4) material open issues remain outstanding as identified in the drafting notes appended hereto.
DATA PROCESSING AGREEMENT
This Data Processing Agreement (this "Agreement"), dated as of the date of last signature below (the "Effective Date"), is entered into by and between:
Vantage Mobility Systems Corp., a corporation organized and existing under the laws of the State of Delaware, with its principal place of business at 4700 Automation Boulevard, Suite 300, Auburn Hills, MI 48326 (the "Controller" or "VMS");
and
Meridian Telematics Solutions, Inc., a corporation organized and existing under the laws of the State of Delaware, with its principal place of business at 1250 Embarcadero Way, Suite 400, Palo Alto, CA 94303 (the "Processor" or "Meridian").
Controller and Processor are each referred to herein individually as a "Party" and collectively as the "Parties."
RECITALS
WHEREAS, VMS designs, manufactures, and sells connected-vehicle hardware modules and integrated mobility platforms, including its proprietary VantageLink system, which collects real-time vehicle telemetry data from approximately 2.4 million connected vehicles across North America;
WHEREAS, Meridian provides cloud-based analytics and machine-learning services to automotive original equipment manufacturers ("OEMs") and Tier 1 suppliers, processing connected-vehicle data streams to generate predictive maintenance insights, driver behavior scoring, and fleet optimization analytics;
WHEREAS, the Parties executed a non-binding Letter of Intent dated August 5, 2022 (the "LOI"), outlining a connected-vehicle data-sharing partnership under which VMS would provide Meridian with certain categories of vehicle telemetry and in-cabin sensor data from VMS's VantageLink platform for processing and analysis;
WHEREAS, the data-sharing partnership contemplated by the LOI envisions Meridian processing data from approximately 800,000 active VantageLink-equipped vehicles whose owners or lessees have opted into VMS's "Connected Insights" data-sharing program;
WHEREAS, VMS, as Controller, and Meridian, as Processor, desire to enter into this Data Processing Agreement to establish the terms and conditions governing the processing of Controller Data by the Processor in connection with the partnership described in the LOI and any definitive commercial agreement entered into between the Parties;
WHEREAS, this Agreement is intended to ensure compliance with applicable data protection laws, including the Michigan Identity Theft Protection Act (MCL 445.61 et seq.), the California Consumer Privacy Act as amended by the California Privacy Rights Act (Cal. Civ. Code § 1798.100 et seq.) (collectively, "CCPA/CPRA"), and the federal Drivers' Privacy Protection Act (18 U.S.C. § 2721 et seq.) (the "DPPA"); and
WHEREAS, the Parties desire to document their respective rights and obligations with respect to the protection of Controller Data in a manner consistent with industry best practices and the requirements of all Applicable Data Protection Laws;
NOW, THEREFORE, in consideration of the mutual covenants and agreements set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:
Right-click to update Table of Contents
ARTICLE 1 — DEFINITIONS
For purposes of this Agreement, the following terms shall have the meanings set forth below. Capitalized terms used but not otherwise defined in this Article 1 shall have the meanings ascribed to them elsewhere in this Agreement.
1.1 "Applicable Data Protection Laws" means the Michigan Identity Theft Protection Act (MCL 445.61 et seq.); the California Consumer Privacy Act as amended by the California Privacy Rights Act (Cal. Civ. Code § 1798.100 et seq.) (collectively, "CCPA/CPRA"); the Drivers' Privacy Protection Act (18 U.S.C. § 2721 et seq.) ("DPPA"); and any other federal, state, or international data protection, data privacy, or data security law, statute, regulation, or rule that is applicable to the processing of Controller Data under this Agreement, in each case as amended, supplemented, or replaced from time to time.
1.2 "Approved Sub-Processor" means a Sub-Processor that is listed in Annex C as of the Effective Date or that has been subsequently approved by Controller in accordance with the procedures set forth in Section 7.3 of this Agreement.
1.3 "AutoCloud Platform" means Cloudvault Infrastructure, Inc.'s proprietary cloud hosting and data processing platform, including all related infrastructure, software, and services, used by Processor for hosting, storing, and processing Controller Data in connection with the services provided under this Agreement.
1.4 "Business Day" means any day other than a Saturday, Sunday, or a day on which banks in the State of Michigan or the State of California are authorized or required by law to be closed.
1.5 "California Data Subjects" means those Data Subjects whose vehicles are registered in the State of California, which, as of the Effective Date, comprise approximately 112,000 individuals, representing approximately fourteen percent (14%) of the total Data Subject population, and whose Personal Information is subject to the requirements of the CCPA/CPRA.
1.6 "Confidential Information" means all information disclosed by one Party (the "Disclosing Party") to the other Party (the "Receiving Party") in connection with this Agreement that is designated as confidential or that, given the nature of the information or the circumstances of disclosure, reasonably should be understood to be confidential. Confidential Information includes, without limitation, Controller Data, the terms of this Agreement, trade secrets, business plans, financial information, technical specifications, and proprietary methodologies.
1.7 "Connected Insights Program" means VMS's opt-in data-sharing program through which vehicle owners and lessees affirmatively consent to the collection and sharing of vehicle telemetry and in-cabin sensor data from their VantageLink-equipped vehicles for the purposes described in VMS's Connected Insights Program terms and conditions.
1.8 "Controller" means Vantage Mobility Systems Corp.
1.9 "Controller Data" means any and all data provided by or on behalf of the Controller to the Processor for processing under this Agreement, including all fourteen (14) categories of vehicle telemetry and in-cabin sensor data identified in Annex A, together with associated Vehicle Identification Numbers (VINs) and any metadata, derived data, or supplemental information provided by Controller in connection with such data. For the avoidance of doubt, Controller Data includes all Personal Information contained within or derivable from such data.
1.10 "Data Breach" or "Personal Data Breach" means any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to, Controller Data transmitted, stored, or otherwise processed by Processor or any Sub-Processor, whether resulting from a security incident, human error, system failure, or any other cause.
1.11 "Data Subject" means the owner, lessee, or authorized operator of a VantageLink-equipped vehicle who has opted into the Connected Insights Program and whose vehicle telemetry and in-cabin sensor data is collected by VMS and provided to Processor under this Agreement.
1.12 "Derivative Analytics Products" means any analytics products, reports, predictive models, scoring outputs, dashboards, machine-learning models, or other outputs or work products created by Processor using, incorporating, or derived from Controller Data that Processor sells, licenses, distributes, or otherwise makes available to third parties.
1.13 "Effective Date" means the date of last signature set forth on the signature page of this Agreement.
1.14 "Initial Term" has the meaning set forth in Section 12.1.
1.15 "LOI" means the non-binding Letter of Intent dated August 5, 2022, between VMS and Meridian, as described in the Recitals.
1.16 "Personal Information" means, as applicable, (a) "personal information" as defined under the CCPA/CPRA (Cal. Civ. Code § 1798.140(v)); (b) "personal information" as defined under the Michigan Identity Theft Protection Act; (c) "personal information" as defined under the DPPA (18 U.S.C. § 2725(3)); and (d) any other information that constitutes personal information, personal data, or personally identifiable information under any Applicable Data Protection Law, in each case to the extent such information is contained within or derivable from Controller Data.
1.17 "Processor" means Meridian Telematics Solutions, Inc.
1.18 "Processing" means any operation or set of operations performed on Controller Data, whether by automated or manual means, including but not limited to collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, combination, restriction, erasure, or destruction. "Process," "Processes," and "Processed" shall be construed accordingly.
1.19 "Renewal Term" has the meaning set forth in Section 12.1.
1.20 "Sensitive Vehicle Data" means Controller Data falling within the categories of (a) GPS/geolocation data (Category 1 in Annex A) and (b) seat occupancy data (Category 10 in Annex A), which, when combined with Vehicle Identification Numbers (VINs), can be linked to identifiable individuals and are classified as sensitive under VMS's internal data governance policy. Sensitive Vehicle Data is subject to the enhanced protections set forth in Section 5.2 and Annex B, Section B.4.
1.21 "Sub-Processor" means any third party (including any affiliate of Processor, but excluding Processor's own employees) engaged by the Processor to Process Controller Data on behalf of the Controller in connection with the services provided under this Agreement.
1.22 "Technical and Organizational Measures" or "TOMs" means the technical and organizational security measures described in Annex B of this Agreement, as updated from time to time in accordance with this Agreement.
1.23 "Term" means the Initial Term and any Renewal Term(s), as defined in Section 12.1.
1.24 "Territory" means the continental United States of America (the forty-eight (48) contiguous states and the District of Columbia), unless otherwise expressly stated in this Agreement.
1.25 "Vehicle Identification Number" or "VIN" means the unique seventeen-character alphanumeric identifier assigned to each motor vehicle in accordance with applicable federal regulations, used to identify each vehicle in VMS's connected-vehicle fleet and included in data records transmitted to Processor under this Agreement.
Additional terms may be defined parenthetically elsewhere in this Agreement, and such terms shall have the meanings ascribed to them in the context in which they appear.
ARTICLE 2 — SCOPE AND PURPOSE OF PROCESSING
2.1 Subject Matter of Processing. Processor shall Process Controller Data solely for the purpose of providing connected-vehicle data analytics services as described in the LOI dated August 5, 2022, including the generation of predictive maintenance insights, driver behavior scoring, and fleet optimization analytics (collectively, the "Permitted Purposes"). Processor shall not Process Controller Data for any purpose other than the Permitted Purposes, unless otherwise expressly authorized in writing by Controller or required by Applicable Data Protection Laws (in which case Processor shall comply with Section 4.1). The scope of the Permitted Purposes encompasses data ingestion, cleansing, normalization, transformation, aggregation, analysis, modeling, visualization, and the generation of analytics outputs for delivery to Controller and, to the extent authorized under a separate commercial agreement between the Parties, for incorporation into Derivative Analytics Products.
2.2 Categories of Data. The Controller Data subject to this Agreement comprises fourteen (14) categories of vehicle telemetry and in-cabin sensor data, as set forth in detail in Annex A. The fourteen categories are as follows:
(1) GPS/geolocation; (2) vehicle speed; (3) acceleration/deceleration; (4) braking events; (5) tire pressure; (6) engine diagnostic codes; (7) fuel consumption; (8) in-cabin temperature; (9) in-cabin humidity; (10) seat occupancy; (11) seatbelt status; (12) ambient noise levels; (13) windshield wiper activation; and (14) headlight/taillight status.
Each data record transmitted by Controller to Processor will include the associated Vehicle Identification Number (VIN) and relevant metadata, including timestamp, vehicle make, model, and model year (to the extent available). The full descriptions of each data category, including technical specifications and data formats, are set forth in Annex A.
2.3 Sensitive Vehicle Data. GPS/geolocation data (Category 1) and seat occupancy data (Category 10) are designated as Sensitive Vehicle Data under VMS's internal data governance policy. These categories of data, when combined with VINs, are capable of being linked to identifiable individuals and present heightened privacy risks. Processor acknowledges the sensitive nature of these data categories and shall apply the enhanced protections specified in Section 5.2 and in Annex B, Section B.4 (Enhanced Protections for Sensitive Vehicle Data). Processor shall not downgrade the classification of any data category designated as Sensitive Vehicle Data without the prior written consent of Controller.
2.4 Volume of Data. Processor shall be capable of receiving, processing, and analyzing approximately 4.2 terabytes per day of raw telemetry data streaming from approximately 800,000 active VantageLink-equipped vehicles enrolled in the Connected Insights Program. Processor acknowledges that the volume of data may fluctuate based on the number of active vehicles, driving patterns, and seasonal variations, and shall maintain sufficient processing capacity to accommodate reasonable fluctuations without degradation of service quality or security.
2.5 Data Subjects. The Data Subjects whose data is processed under this Agreement are the approximately 800,000 vehicle owners and lessees who have opted into VMS's Connected Insights Program. As of the date of this Agreement, approximately 112,000 of these Data Subjects (representing approximately fourteen percent (14%) of the total Data Subject population) have vehicles registered in the State of California and are therefore considered California Data Subjects whose Personal Information is subject to the CCPA/CPRA. The number of Data Subjects and the proportion of California Data Subjects may change over time as new vehicle owners opt in or out of the Connected Insights Program.
2.6 Duration of Processing. Processing of Controller Data shall continue for the Term of this Agreement, as defined in Article 12. Upon expiration or termination of this Agreement, Processor's authority to Process Controller Data shall cease immediately, subject to the data return and deletion obligations set forth in Article 10.
2.7 Location of Processing. Unless otherwise approved in writing by the Controller in accordance with Article 8, all Processing of Controller Data shall occur within the continental United States, specifically at the following locations:
(a) Processor's data operations center located at 8900 Research Park Drive, Building C, Austin, TX 78759; and
(b) Approved Sub-Processor facilities located within the continental United States, as identified in Annex C (as of the Effective Date, the sole such facility is Cloudvault Infrastructure, Inc.'s data center located at 7400 Crossroads Boulevard, Columbus, OH 43219).
Processor shall not migrate, replicate, or otherwise transfer Controller Data to any other facility or location without the prior written consent of Controller. Processor shall promptly notify Controller of any planned changes to the physical location of its data processing facilities.
2.8 Prohibited Processing. Processor shall not, under any circumstances:
(a) Process Controller Data for any purpose other than the Permitted Purposes set forth in this Article 2;
(b) sell, rent, lease, or otherwise commercially exploit Controller Data, except to the extent expressly permitted under a separate written commercial agreement between the Parties and in compliance with Applicable Data Protection Laws;
(c) de-identify, re-identify, or attempt to identify any Data Subject using Controller Data, except as strictly necessary to perform the analytics services described in Section 2.1, and in no event shall Processor use Controller Data to build or contribute to any consumer profile or dossier relating to any individual Data Subject;
(d) combine Controller Data with data obtained from any other source, including data obtained from Processor's other customers, publicly available data, or data purchased from third-party data brokers, without the prior written consent of Controller; or
(e) use Controller Data to train, develop, or improve any machine-learning model, algorithm, or artificial intelligence system for Processor's own commercial purposes or for the benefit of any third party, except to the extent expressly authorized in writing by Controller and in compliance with the data retention limitations set forth in Article 10.
ARTICLE 3 — CONTROLLER OBLIGATIONS
3.1 Lawful Basis for Processing. Controller represents and warrants that it has obtained all necessary consents, authorizations, and permissions from Data Subjects through the Connected Insights Program to collect, share, and permit the processing of Controller Data by Processor for the Permitted Purposes described in this Agreement. Controller further represents and warrants that the consents obtained from Data Subjects are sufficient in scope, form, and substance to authorize the processing activities contemplated by this Agreement, including the provision of Controller Data to Processor and the generation of analytics outputs. Controller shall maintain records of such consents and shall make them available to Processor upon reasonable request to the extent necessary for Processor to demonstrate compliance with Applicable Data Protection Laws.
3.2 Compliance with Applicable Data Protection Laws. Controller shall comply with all Applicable Data Protection Laws with respect to the collection, storage, and sharing of Controller Data with Processor. Controller shall be responsible for ensuring that its collection of vehicle telemetry and in-cabin sensor data from VantageLink-equipped vehicles complies with all applicable privacy notices, terms of service, and regulatory requirements. Without limiting the foregoing, Controller shall ensure that its Connected Insights Program terms and conditions accurately describe the types of data collected, the purposes for which data is shared with Processor, and the rights of Data Subjects with respect to their data.
3.3 Accuracy and Quality. Controller shall use commercially reasonable efforts to ensure the accuracy, completeness, and quality of Controller Data transmitted to Processor. Controller acknowledges that the accuracy of analytics outputs generated by Processor is dependent in part on the accuracy and quality of the Controller Data provided. Controller shall promptly notify Processor of any known data quality issues, corrupted data streams, or systematic errors in the Controller Data that may affect Processor's analytics services.
3.4 Data Subject Rights. Controller shall be solely responsible for receiving, evaluating, and responding to Data Subject requests, including requests submitted pursuant to the CCPA/CPRA (such as requests to know, requests to delete, requests to correct, and requests to opt out of the sale or sharing of personal information), the DPPA, and any other Applicable Data Protection Laws. Controller shall notify Processor of any such requests that require action on the part of Processor (including the retrieval, correction, or deletion of Controller Data in Processor's possession) within a reasonable timeframe, and in any event sufficiently in advance of any applicable regulatory deadline to enable Processor to comply in accordance with Section 14.2.
3.5 DPPA Compliance. Controller represents and warrants that its sharing of Controller Data with Processor complies with the permissible uses set forth in the Drivers' Privacy Protection Act (18 U.S.C. § 2721 et seq.) and that Controller Data containing motor vehicle records or personal information derived therefrom is disclosed to Processor only for purposes permitted under DPPA. Controller shall promptly notify Processor if at any time Controller becomes aware that its sharing of Controller Data may not comply with the DPPA or any other Applicable Data Protection Law.
3.6 Instructions. Controller shall provide documented instructions for the Processing of Controller Data, which instructions shall be consistent with the terms of this Agreement and the Permitted Purposes. Controller may supplement, modify, or revoke such instructions in writing during the Term, provided that any such supplementation, modification, or revocation is consistent with the terms of this Agreement. If any supplemental or modified instruction would, in Processor's reasonable opinion, require material changes to Processor's processing infrastructure, systems, or procedures, the Parties shall negotiate in good faith regarding the implementation of such instruction, including any adjustments to fees or timelines.
ARTICLE 4 — PROCESSOR OBLIGATIONS
4.1 Processing Instructions. Processor shall Process Controller Data solely in accordance with the Controller's documented instructions as provided pursuant to Section 3.6 and as otherwise set forth in this Agreement. Processor shall not Process Controller Data in any manner inconsistent with Controller's instructions unless required to do so by Applicable Data Protection Laws, in which case Processor shall: (a) promptly inform Controller of such legal requirement before commencing the required Processing (unless the law prohibits such notification on important grounds of public interest); and (b) limit such Processing to the minimum necessary to comply with the legal requirement. If Processor believes, in its reasonable professional judgment, that any instruction from Controller infringes or would cause Processor to infringe any Applicable Data Protection Law, Processor shall promptly inform Controller in writing, specifying the instruction at issue and the basis for Processor's belief, and shall not be required to carry out such instruction until Controller confirms or modifies the instruction.
4.2 Confidentiality. Processor shall ensure that all personnel authorized to Process Controller Data, including employees, contractors, and temporary staff, are bound by enforceable obligations of confidentiality with respect to Controller Data, whether by written contract, professional ethical obligation, or statutory requirement. Processor shall limit access to Controller Data to those personnel who have a demonstrable need to access such data in order to perform the services contemplated by this Agreement, and shall maintain a current list of all personnel with access to Controller Data, which list shall be made available to Controller upon request.
4.3 Technical and Organizational Measures. Processor shall implement and maintain, at its own cost, the Technical and Organizational Measures set forth in Annex B throughout the Term of this Agreement. Processor shall ensure that such measures provide a level of security appropriate to the risks presented by the Processing of Controller Data, including the risks of accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access, taking into account the nature, scope, context, and purposes of Processing, the state of the art, and the costs of implementation. Processor shall periodically review and, where necessary, update the TOMs to address evolving threats, vulnerabilities, and industry standards, provided that no update shall materially reduce the level of protection afforded to Controller Data without the prior written consent of Controller.
4.4 Cooperation. Processor shall reasonably assist Controller in ensuring compliance with Applicable Data Protection Laws, including but not limited to the following:
(a) Data Subject Requests. Processor shall assist Controller in responding to Data Subject requests (including CCPA/CPRA consumer rights requests) by providing the requested information or performing the requested actions (such as deletion or correction of Controller Data) within five (5) Business Days of receiving notification from Controller of such request, or within such shorter timeframe as may be required by Applicable Data Protection Laws;
(b) Data Protection Impact Assessments. Processor shall, upon Controller's reasonable request, provide such information and assistance as is reasonably necessary to enable Controller to conduct data protection impact assessments or similar assessments required under Applicable Data Protection Laws in connection with the Processing of Controller Data;
(c) Regulatory Cooperation. Processor shall cooperate with Controller in responding to inquiries, investigations, or enforcement actions by any regulatory authority relating to the Processing of Controller Data, including by providing documentation, access to personnel, and other reasonable assistance as Controller may request; and
(d) Documentation. Processor shall maintain, and make available to Controller upon request, all documentation reasonably necessary to demonstrate Processor's compliance with this Agreement and with Applicable Data Protection Laws.
4.5 CCPA/CPRA Compliance. In respect of the approximately 112,000 California Data Subjects whose vehicles are registered in the State of California, Processor acknowledges and agrees that, for purposes of the CCPA/CPRA, it is a "service provider" (as defined in Cal. Civ. Code § 1798.140(ag)) and shall comply with all obligations applicable to service providers under the CCPA/CPRA. Without limiting the generality of the foregoing, Processor shall not:
(a) sell or share (as those terms are defined in the CCPA/CPRA) Personal Information received from or on behalf of Controller;
(b) retain, use, or disclose Personal Information for any purpose other than for the specific purpose of performing the services specified in this Agreement, including retaining, using, or disclosing Personal Information for a commercial purpose other than providing the services specified in this Agreement, as permitted by the CCPA/CPRA;
(c) retain, use, or disclose Personal Information outside of the direct business relationship between Controller and Processor; or
(d) combine Personal Information received from or on behalf of Controller with personal information that Processor receives from or on behalf of another person or persons, or collects from its own interaction with Data Subjects, except as expressly permitted by the CCPA/CPRA.
Processor certifies that it understands and will comply with the restrictions set forth in this Section 4.5 and the applicable requirements of the CCPA/CPRA.
4.6 DPPA Compliance. Processor acknowledges that certain Controller Data may constitute motor vehicle records or personal information derived therefrom, as defined in the DPPA (18 U.S.C. § 2725). Processor shall not disclose, use, or permit access to any Controller Data that constitutes a motor vehicle record or personal information derived therefrom except as permitted under the DPPA and only in accordance with Controller's documented instructions. Processor shall implement appropriate administrative and technical safeguards to prevent the unauthorized disclosure of DPPA-protected information.
4.7 Records of Processing Activities. Processor shall maintain complete and accurate records of all categories of Processing activities carried out on behalf of Controller, including: (a) the name and contact details of Processor and, where applicable, of each Sub-Processor; (b) the categories of Processing carried out on behalf of Controller; (c) where applicable, transfers of Controller Data to a third country or international organization; (d) a general description of the Technical and Organizational Measures implemented pursuant to Section 4.3 and Annex B; and (e) the purposes of Processing. Such records shall be maintained in written or electronic form and shall be made available to Controller upon request and to any competent regulatory authority as required by Applicable Data Protection Laws.
ARTICLE 5 — SECURITY MEASURES
5.1 Minimum Security Standards. Processor shall implement and maintain, throughout the Term, the Technical and Organizational Measures described in Annex B, which shall constitute the minimum security standards for the Processing of Controller Data. Without limiting the detailed requirements set forth in Annex B, such measures shall include, at a minimum:
(a) Encryption. Encryption of Controller Data at rest using the Advanced Encryption Standard with 256-bit keys (AES-256) and encryption of Controller Data in transit using Transport Layer Security version 1.2 or higher (TLS 1.2+);
(b) Access Controls. Implementation and enforcement of role-based access control (RBAC) mechanisms, multi-factor authentication (MFA) for all access to systems containing Controller Data, unique user credentials (with no shared accounts), and quarterly access reviews;
(c) Network Security. Network segmentation isolating Controller Data processing environments from other systems, deployment of intrusion detection and prevention systems (IDS/IPS), and firewall configurations set to deny-by-default;
(d) Vulnerability Management. Regular vulnerability scanning (no less frequently than quarterly) and annual penetration testing conducted by a qualified independent third party;
(e) Logging and Monitoring. Centralized logging of all access, modification, and deletion events relating to Controller Data, with real-time monitoring and alerting for anomalous activity, and log retention for a minimum of twelve (12) months;
(f) Personnel Security. Background checks for all personnel with access to Controller Data, annual security awareness training, and binding confidentiality agreements; and
(g) Physical Security. Physical access controls at all data processing facilities (including biometric and badge-based access), 24/7 video surveillance and environmental monitoring, and visitor access logging and escort requirements.
5.2 Enhanced Protections for Sensitive Vehicle Data. In addition to the minimum security standards set forth in Section 5.1, Processor shall apply the following enhanced protections to Sensitive Vehicle Data (GPS/geolocation data and seat occupancy data), as further described in Annex B, Section B.4:
(a) Pseudonymization. Pseudonymization of VINs prior to any analytical processing to prevent direct linkage of Sensitive Vehicle Data to identifiable individuals. The pseudonymization methodology shall be documented and made available to Controller upon request;
(b) Access Restriction. Access to Sensitive Vehicle Data shall be restricted to a limited number of authorized personnel on a strict need-to-know basis, limited to senior data scientists and designated project leads only, as approved by Processor's Chief Information Security Officer (or equivalent);
(c) Separate Logical Storage. Sensitive Vehicle Data shall be stored in a separate logical storage environment, physically or logically isolated from other categories of Controller Data and from data belonging to Processor's other customers;
(d) Enhanced Audit Logging. All access to Sensitive Vehicle Data shall be subject to enhanced audit logging, with logs retained for a minimum of twelve (12) months and available for inspection by Controller upon request; and
(e) Quarterly Access Reviews. Processor shall conduct quarterly access reviews specific to the Sensitive Vehicle Data environments, documenting the results of each review and remediating any identified issues within fifteen (15) Business Days.
5.3 Security Assessment. Controller may, at its own cost, commission an independent third-party cybersecurity assessment of Processor's data processing environment prior to the commencement of Processing and at any time during the Term upon reasonable written notice to Processor. Such assessments may include vulnerability assessments, penetration testing, configuration reviews, and policy and procedure reviews. Processor shall cooperate fully with such assessments, including by providing reasonable access to facilities, systems, documentation, and personnel, subject to Processor's reasonable security protocols. Processor shall promptly remediate any material vulnerabilities identified during such assessments and shall provide Controller with a written remediation plan and evidence of remediation within thirty (30) days of receiving notice of the findings. This provision reflects the resolution agreed upon by the Parties during the November 15, 2022 negotiation call.
5.4 Ongoing Security Review. Processor shall conduct an annual internal security review of its data processing environment, including a comprehensive assessment of the effectiveness of the Technical and Organizational Measures implemented pursuant to this Agreement and Annex B. Processor shall provide a written summary report of each annual security review to Controller within thirty (30) days of the completion of such review. Such report shall include, at a minimum, a summary of the scope of the review, the findings, any identified deficiencies, and the remediation actions taken or planned.
5.5 Industry Certifications. Processor shall obtain and maintain, at its own cost, a current SOC 2 Type II certification (or equivalent industry-recognized certification acceptable to Controller) covering the data processing environment used for Controller Data throughout the Term. Processor shall provide copies of its most recent SOC 2 Type II report to Controller upon request and, without request, promptly following the issuance of each new report. If at any time Processor's SOC 2 Type II certification lapses, is withdrawn, or is qualified by material exceptions, Processor shall promptly notify Controller and shall use commercially reasonable efforts to restore such certification within ninety (90) days.
ARTICLE 6 — DATA BREACH NOTIFICATION AND RESPONSE
6.1 Notification Obligation. [OPEN ISSUE — VMS POSITION] Processor shall notify Controller of any Personal Data Breach without undue delay and in any event within [twenty-four (24) hours] of Processor becoming aware of such breach. For purposes of this Section 6.1, Processor shall be deemed to have become "aware" of a Personal Data Breach at the time any employee, officer, contractor, or agent of Processor with responsibility for information security, data protection, or incident response has a reasonable basis to believe that a Personal Data Breach has occurred.
[Note: Meridian has proposed a seventy-two (72) hour notification window, citing alignment with GDPR standards and the practical challenges of investigating and confirming breaches within twenty-four hours. VMS maintains its twenty-four (24) hour position, noting the sensitivity of the Controller Data and the large Data Subject population. Bracketed language reflects VMS's position. This issue remains open for further negotiation.]
6.2 Content of Notification. Processor's initial notification to Controller pursuant to Section 6.1 shall include, to the extent such information is reasonably available at the time of notification:
(a) a description of the nature of the Personal Data Breach, including, where possible, the categories and approximate number of Data Subjects affected and the categories and approximate number of data records affected;
(b) the name, title, and contact details of Processor's data protection contact or other point of contact from whom Controller can obtain further information;
(c) a description of the likely consequences of the Personal Data Breach, including an assessment of the potential harm to affected Data Subjects;
(d) a description of the measures taken or proposed to be taken by Processor to address the Personal Data Breach, including, where appropriate, measures to contain the breach and mitigate its possible adverse effects; and
(e) a preliminary timeline for investigation and remediation.
6.3 Supplemental Information. If it is not possible for Processor to provide all of the information specified in Section 6.2 at the time of initial notification, Processor shall provide such information in phases, as it becomes available, without further undue delay. In any event, Processor shall provide all material supplemental information within seventy-two (72) hours of the initial notification. Processor shall continue to update Controller as additional information becomes available until the Personal Data Breach has been fully investigated and remediated.
6.4 Remediation. Processor shall take immediate steps to contain and remediate any Personal Data Breach, including implementing measures to prevent the recurrence of the breach and to mitigate any harm to affected Data Subjects. Processor shall keep Controller informed, on at least a daily basis during the initial response phase, of the status of remediation efforts, including any changes to the scope or severity of the breach. Processor shall, within fourteen (14) days of the resolution of the breach, provide Controller with a written post-incident report, including a root cause analysis, a description of remedial actions taken, and recommendations for preventing similar incidents in the future.
6.5 Cooperation. Processor shall cooperate fully with Controller in investigating, mitigating, and remediating any Personal Data Breach, including by:
(a) preserving and securing all evidence relating to the breach, including logs, records, and forensic data;
(b) providing Controller with reasonable access to Processor's personnel, systems, and facilities as necessary for Controller's investigation;
(c) providing reasonable assistance with any notifications to regulatory authorities or Data Subjects that Controller determines are required under Applicable Data Protection Laws; and
(d) implementing any additional security measures reasonably requested by Controller in response to the breach.
6.6 Notification to Regulatory Authorities and Data Subjects. Controller shall have sole authority and discretion to determine whether notification of any Personal Data Breach to any regulatory authority, Data Subject, or other person is required or advisable under Applicable Data Protection Laws or otherwise. Processor shall not notify any regulatory authority, Data Subject, or other person directly of any Personal Data Breach involving Controller Data without Controller's prior written consent, except where Processor is independently and directly obligated to provide such notification under Applicable Data Protection Laws (in which case Processor shall provide Controller with prior notice of such notification and a copy of the proposed notification, to the extent permitted by law).
6.7 No Admission. Processor's notification of a Personal Data Breach pursuant to this Article 6 shall not be construed as an acknowledgment of fault, liability, or responsibility on the part of Processor for the Personal Data Breach. Nothing in this Section 6.7 shall limit or affect the allocation of liability or indemnification obligations set forth in Article 11.
ARTICLE 7 — SUB-PROCESSORS
7.1 General Restriction. [OPEN ISSUE — VMS POSITION] Processor shall not engage, appoint, or authorize any Sub-Processor to Process Controller Data on behalf of Controller without the prior written consent of Controller.
[Note: Meridian has proposed a general authorization model under which Processor would be authorized to engage Sub-Processors, subject to providing Controller with thirty (30) calendar days' advance notice and an opportunity to object. VMS maintains its prior written consent position, reflecting the sensitivity and volume of Controller Data. Bracketed language reflects VMS's position. This issue remains open for further negotiation.]
7.2 Approved Sub-Processors. The Sub-Processors listed in Annex C are hereby approved by Controller as of the Effective Date of this Agreement. As of the Effective Date, the sole Approved Sub-Processor is Cloudvault Infrastructure, Inc., which provides cloud hosting and data storage services on the AutoCloud Platform from its data center located at 7400 Crossroads Boulevard, Columbus, OH 43219. Processor warrants that it has entered into a written agreement with Cloudvault Infrastructure, Inc. that imposes data protection obligations no less protective than those set forth in this Agreement, as further described in Annex C, Section C.4.
7.3 Sub-Processor Approval Process. [VMS position] In the event Processor wishes to engage a new Sub-Processor, or to materially change the scope of Processing activities performed by an existing Approved Sub-Processor, Processor shall submit a written request to Controller identifying the proposed new Sub-Processor or the proposed change, including the following information:
(a) the full legal name, corporate form, jurisdiction of incorporation, and principal place of business of the proposed Sub-Processor;
(b) the physical location(s) at which the proposed Sub-Processor will Process Controller Data;
(c) a detailed description of the Processing activities to be performed by the proposed Sub-Processor;
(d) the categories of Controller Data to be Processed by the proposed Sub-Processor;
(e) a description of the security measures to be implemented by the proposed Sub-Processor, including whether the proposed Sub-Processor maintains SOC 2 Type II certification (or equivalent);
(f) any relevant certifications, audit reports, or security assessments relating to the proposed Sub-Processor; and
(g) the proposed terms of the data processing agreement to be entered into between Processor and the proposed Sub-Processor.
Controller shall respond to a complete Sub-Processor approval request within [fifteen (15) Business Days] of receipt. Controller may, in its sole discretion, approve or deny any request to engage a new Sub-Processor, and Controller shall not be required to provide reasons for any denial. If Controller does not respond within the specified period, the request shall be deemed denied.
7.4 Flow-Down Obligations. Processor shall impose on each Approved Sub-Processor, by way of a written agreement, data protection and security obligations that are no less protective than those set forth in this Agreement, including, without limitation, the security requirements set forth in Annex B, the confidentiality obligations set forth in Article 13, and the data retention and deletion obligations set forth in Article 10. Processor shall ensure that each Sub-Processor agreement includes provisions granting Controller audit rights equivalent to those set forth in Article 9. Processor shall provide Controller with copies of the relevant data protection provisions of each Sub-Processor agreement upon request.
7.5 Processor Liability for Sub-Processors. Processor shall remain fully liable to Controller for the acts, omissions, errors, and defaults of each of its Sub-Processors (whether approved or not) as if such acts, omissions, errors, and defaults were those of Processor itself. The engagement of any Sub-Processor shall not relieve Processor of any of its obligations under this Agreement.
7.6 Removal of Sub-Processor. Controller may, upon written notice to Processor, require Processor to remove or replace any Sub-Processor if Controller reasonably determines that such Sub-Processor is not meeting the requirements of this Agreement, has experienced a Personal Data Breach, or otherwise poses an unacceptable risk to the security or privacy of Controller Data. Processor shall comply with any such requirement within thirty (30) days of receiving notice (or within such shorter period as may be reasonably necessary to protect Controller Data), and shall make alternative arrangements for the Processing activities previously performed by the removed Sub-Processor at Processor's own cost.
ARTICLE 8 — INTERNATIONAL DATA TRANSFERS
8.1 Restriction on International Transfers. Processor shall not transfer, transmit, access, or Process Controller Data outside the continental United States without the prior written consent of Controller. This restriction applies to all forms of transfer, including remote access by personnel located outside the continental United States, storage or backup of Controller Data at facilities located outside the continental United States, and any transfer to or through systems or networks located outside the continental United States.
[Note: This provision was drafted in response to Meridian's disclosure during the October 2022 negotiation that Cloudvault Infrastructure, Inc. is considering a potential future migration of certain workloads to its facility in Dublin, Ireland. As of this draft, no EU data subjects are in scope and all Processing occurs within the continental United States. VMS requires that this restriction remain in place to prevent any unauthorized international transfer of Controller Data.]
8.2 Conditions for Approved International Transfers. In the event that Controller provides written consent for an international transfer of Controller Data, such transfer shall be subject to the following conditions:
(a) Processor shall ensure that appropriate safeguards are in place to protect Controller Data in the receiving jurisdiction, including, where applicable, the execution of Standard Contractual Clauses (as adopted by the European Commission or other relevant authority) or equivalent transfer mechanisms recognized under Applicable Data Protection Laws;
(b) Processor shall conduct a transfer impact assessment evaluating the legal framework and data protection standards of the receiving jurisdiction and shall provide such assessment to Controller for review and approval prior to the commencement of any transfer;
(c) Processor shall ensure that the receiving country provides an adequate level of data protection or that additional supplementary technical, organizational, and contractual measures are implemented to ensure protection equivalent to that afforded within the continental United States; and
(d) the transfer shall comply with all Applicable Data Protection Laws, including any requirements for regulatory notification or authorization.
8.3 Cloudvault Dublin Facility. For the avoidance of doubt, Processor is not authorized under this Agreement to transfer any Controller Data to Cloudvault Infrastructure, Inc.'s data center located at Unit 12, Parkwest Business Campus, Dublin 12, Ireland, or to any other Cloudvault facility located outside the continental United States. Any such transfer would require Controller's prior written consent and full compliance with the conditions set forth in Section 8.2, as well as any additional requirements imposed by Controller at the time of consent.
8.4 Notification of Compelled Transfer. If Processor receives a legally binding request, order, subpoena, warrant, or other directive from any government authority (whether domestic or foreign) that would require or compel the transfer, disclosure, or access of Controller Data to a location outside the continental United States, Processor shall:
(a) promptly notify Controller of such request or order, to the extent not prohibited by law, providing sufficient detail to enable Controller to assess the request and, if appropriate, seek a protective order or other appropriate remedy;
(b) use commercially reasonable efforts to redirect the request or order to Controller, so that Controller may respond directly;
(c) not disclose or transfer Controller Data in response to such request or order until Controller has had a reasonable opportunity to challenge or respond to the request, unless Processor is compelled to do so by applicable law or court order; and
(d) disclose only the minimum amount of Controller Data necessary to comply with the request or order.
ARTICLE 9 — AUDIT RIGHTS
9.1 Controller Audit Rights. [OPEN ISSUE — VMS POSITION] Controller shall have the right to conduct [on-site audits] of Processor's data processing facilities, systems, and records to verify Processor's compliance with this Agreement, including Processor's compliance with the Technical and Organizational Measures set forth in Annex B, the data retention and deletion requirements set forth in Article 10, and all other obligations of Processor under this Agreement.
(a) Notice. Controller may conduct such audits upon not less than [ten (10) Business Days'] prior written notice to Processor. [VMS position; Meridian proposed thirty (30) calendar days.]
(b) Scope. Audits may include, without limitation, on-site inspection of Processor's data processing facilities and data centers (including the Austin, TX data operations center and any Approved Sub-Processor facilities), review of records, policies, procedures, and documentation, interviews with Processor's personnel (including information security, engineering, and operations staff), and testing of Technical and Organizational Measures.
(c) Frequency. [VMS position: no cap on the number of audits that Controller may conduct during the Term. Meridian proposed a limitation of one (1) audit per calendar year. Compromise language pending further negotiation.]
[Note: VMS proposes unlimited on-site audit rights with ten (10) Business Days' notice. Meridian proposes annual audits only, with thirty (30) calendar days' notice and a $25,000 cost-sharing cap per audit. The bracketed language in this Section reflects VMS's position, with a minor modification to the notice period reflecting a preliminary compromise discussed during the November 15 call. The frequency and cost-sharing provisions remain open.]
9.2 Processor Cooperation. Processor shall cooperate fully with Controller's audits and shall provide Controller and its auditors with reasonable access to Processor's facilities, systems, documentation, and personnel during normal business hours. Processor shall designate a single point of contact to coordinate audit logistics and shall respond to reasonable audit-related information requests within five (5) Business Days. Processor shall not obstruct, delay, or otherwise impede any audit conducted by Controller or its authorized representatives.
9.3 Cost of Audits. [VMS position] Each Party shall bear its own internal costs and expenses in connection with any audit. Controller shall reimburse Processor for reasonable, documented out-of-pocket costs directly incurred by Processor in facilitating audits (such as costs of third-party contractors required to support the audit process), [subject to no per-audit cap].
[Note: Meridian proposed a $25,000 cost-sharing cap per audit. VMS has not accepted this cap. Bracketed language reflects VMS's position. This issue remains open.]
9.4 Third-Party Auditors. Controller may engage independent third-party auditors to conduct audits on its behalf, provided that: (a) such auditors are bound by written confidentiality obligations no less protective than those set forth in Article 13; (b) such auditors are not direct competitors of Processor; and (c) Controller provides Processor with reasonable advance notice of the identity of any third-party auditor engaged to conduct an audit. Processor may raise a reasonable objection to a proposed third-party auditor, and the Parties shall negotiate in good faith to resolve any such objection.
9.5 Sub-Processor Audits. Controller's audit rights under this Article 9 shall extend to all Approved Sub-Processors engaged by Processor to Process Controller Data. Processor shall use commercially reasonable efforts to ensure that Controller has equivalent audit rights with respect to each Approved Sub-Processor, including Cloudvault Infrastructure, Inc. Where Processor is unable to secure direct audit rights for Controller with respect to a Sub-Processor, Processor shall, at Controller's request, exercise its own audit rights under its agreement with the Sub-Processor and provide Controller with a copy of the audit report.
9.6 Remediation. If any audit conducted pursuant to this Article 9 reveals material non-compliance with this Agreement or any Applicable Data Protection Law, Processor shall:
(a) develop and submit to Controller a detailed written remediation plan within thirty (30) days of receiving notice of the audit findings, specifying the non-compliance identified, the root cause(s), the corrective actions to be taken, and the timeline for implementation;
(b) implement the remediation plan in accordance with the agreed timeline; and
(c) provide Controller with written evidence of the completion of each corrective action and, if requested by Controller, submit to a follow-up audit to verify the effectiveness of remediation, at Processor's cost.
9.7 SOC 2 Reports. Without limiting Controller's audit rights under this Article 9, Processor shall provide Controller with copies of its most recent SOC 2 Type II audit report (and, to the extent available, the most recent SOC 2 Type II audit reports of Approved Sub-Processors, including Cloudvault Infrastructure, Inc.) upon request, and no less frequently than annually. If any SOC 2 Type II report identifies material control deficiencies or exceptions, Processor shall promptly notify Controller and shall implement corrective measures in accordance with Section 9.6.
ARTICLE 10 — DATA RETENTION AND DELETION
10.1 Retention Period. [OPEN ISSUE — VMS POSITION] Processor shall retain raw Controller Data only for so long as reasonably necessary to perform the Processing purposes set forth in this Agreement and shall delete or return all raw Controller Data within [ninety (90) days] of initial Processing.
[Note: VMS proposes a ninety (90) day rolling deletion cycle for raw Controller Data after initial Processing. Meridian has proposed an eighteen (18) month retention period to enable machine-learning model training and iterative analytics refinement. VMS does not accept the eighteen-month period due to concerns regarding data minimization, the sensitive nature of Controller Data, and the large Data Subject population. Bracketed language reflects VMS's position. This issue remains open for further negotiation.]
10.2 Rolling Deletion. Processor shall implement automated rolling deletion mechanisms to ensure that raw Controller Data is securely and irreversibly deleted within [ninety (90) days] of initial Processing, unless otherwise instructed in writing by Controller. Processor shall maintain documentation of its rolling deletion procedures, including the technical mechanisms used, the deletion schedule, and verification processes, and shall make such documentation available to Controller upon request. Processor shall not manually override or disable automated rolling deletion mechanisms without the prior written consent of Controller.
10.3 Aggregated/Anonymized Data. Nothing in this Article 10 shall prevent Processor from retaining truly anonymized, aggregated data from which no individual Data Subject can be identified or re-identified, directly or indirectly, provided that all of the following conditions are satisfied:
(a) such anonymization is irreversible and meets the standard of anonymization under Applicable Data Protection Laws, such that the data no longer constitutes Personal Information;
(b) all VINs, GPS/geolocation data, and seat occupancy data have been permanently and irrevocably removed from the anonymized data set;
(c) the anonymized data cannot, by any means reasonably likely to be used, be linked back to any individual vehicle, VIN, or Data Subject; and
(d) Processor maintains documentation of the anonymization methodology applied, which documentation shall be available to Controller upon request.
For the avoidance of doubt, data that has been merely pseudonymized (i.e., data from which direct identifiers have been replaced with pseudonyms but which can be re-identified through the use of additional information) shall not be considered anonymized data for purposes of this Section 10.3 and shall remain subject to the retention and deletion requirements of this Article 10.
10.4 Deletion Upon Termination. Upon termination or expiration of this Agreement for any reason, Processor shall, at Controller's election (which election shall be communicated in writing within thirty (30) days of the effective date of termination or expiration):
(a) return all Controller Data to Controller in a commonly used, machine-readable format (such as CSV, JSON, or Parquet), via a secure transfer mechanism agreed upon by the Parties; or
(b) securely delete all Controller Data (including all copies, backups, and reproductions thereof, whether in electronic or physical form) using industry-standard data sanitization methods (such as NIST SP 800-88 guidelines) and provide written certification of such deletion to Controller within thirty (30) days of the effective date of termination or expiration.
If Controller does not communicate its election within the thirty (30) day period, Processor shall securely delete all Controller Data in accordance with clause (b) above. The obligations set forth in this Section 10.4 shall extend to all Controller Data held by Approved Sub-Processors, and Processor shall ensure that each Sub-Processor complies with the applicable return or deletion requirements.
10.5 Deletion Certification. Following any deletion of Controller Data, whether pursuant to the rolling deletion procedures set forth in Section 10.2 or the deletion upon termination procedures set forth in Section 10.4, Processor shall provide Controller with a written certification of deletion, signed by an authorized officer or representative of Processor, specifying: (a) the categories and approximate volume of data deleted; (b) the method(s) of deletion used; (c) the date(s) on which deletion was completed; and (d) confirmation that no copies, backups, or reproductions of the deleted data have been retained, except as permitted by Section 10.3 or Section 10.6.
10.6 Retention Exceptions. Processor may retain Controller Data beyond the periods set forth in this Article 10 only to the extent retention is required by Applicable Data Protection Laws, applicable regulatory requirements, or a valid and enforceable order of a court or governmental authority, provided that Processor:
(a) promptly notifies Controller of such retention requirement, specifying the legal basis, the categories and volume of data to be retained, and the expected duration of retention;
(b) limits retention to the minimum data and the minimum period necessary to comply with the applicable requirement;
(c) continues to protect the retained Co

DRAFT — PRIVILEGED & CONFIDENTIAL — SUBJECT TO CONTRACT

DATA PROCESSING AGREEMENT

DATA PROCESSING AGREEMENT

RECITALS

Record

Parties

Dates

Amounts