AutoCents™ Data Processing Agreement

Parties

This Data Processing Agreement ("DPA") is entered into between:

1. FOUNDATIONAL PROVISIONS

1.1 Relationship to Master Agreement

This DPA supplements and is incorporated into the AutoCents™ Terms of Service or other master service agreement between the parties (the "Agreement"). In case of conflict between this DPA and the Agreement regarding data protection matters, this DPA shall control.

1.2 Scope of Application

This DPA applies to Personal Data processed by AutoCents on behalf of Customer in connection with the provision of AutoCents services, where such processing is subject to US federal privacy laws, the New Hampshire Privacy Act, or other applicable state privacy laws.

1.3 Effective Date and Term

This DPA becomes effective when Customer accepts the AutoCents Terms of Service and remains in effect until termination of the Agreement or earlier termination of data processing activities.

2. DEFINITIONS

For purposes of this DPA:

3. DATA PROCESSING PRINCIPLES

3.1 Processing Limitations

AutoCents shall:

• Process Personal Data solely on behalf of and in accordance with Customer's documented instructions as set forth in this DPA and the Agreement
• Not process Personal Data for any purpose other than providing the Services to Customer
• Not sell, rent, release, disclose, disseminate, make available, transfer, or otherwise communicate Personal Data to third parties for monetary or other valuable consideration
• Not use Personal Data for AutoCents' own commercial purposes, including targeted advertising, building user profiles, or enhancing AutoCents' own products or services outside the scope of Services provided to Customer
• Not retain Personal Data longer than reasonably necessary to fulfill the purposes for which it was collected

3.2 Processing Instructions

Customer instructs AutoCents to process Personal Data for the following purposes:

• Providing the AutoCents Smart Vehicle Analytics Services as described in the Agreement
• Technical support and maintenance of the Services
• Compliance with applicable legal obligations
• Other processing activities as explicitly authorized by Customer in writing

3.3 FTC Act Compliance

AutoCents acknowledges that:

• Any material misrepresentation about its data security practices or unfair data handling practices may violate Section 5 of the FTC Act
• It will implement and maintain reasonable security measures as described in Section 4
• It will not engage in deceptive practices regarding its handling of Personal Data

3.4 Unlawful Instructions

If AutoCents believes any instruction from Customer violates applicable Data Protection Laws, AutoCents will:

• Immediately notify Customer in writing
• Suspend processing of the affected Personal Data until the instruction is clarified or modified
• Document the incident and resolution

4. SECURITY MEASURES

4.1 Security Requirements

AutoCents shall implement and maintain reasonable administrative, technical, and physical safeguards designed to protect Personal Data, appropriate to:

• The volume and nature of Personal Data processed
• The risks presented by the processing
• The current state of technology
• Industry best practices

4.2 Specific Security Measures

AutoCents' security measures include, at minimum:

4.3 Security Updates

AutoCents shall:

• Regularly review and update security measures to address new threats
• Apply security patches and updates in a timely manner
• Conduct annual security assessments
• Maintain documentation of security measures and updates

5. SECURITY INCIDENT RESPONSE

5.1 Incident Notification

AutoCents shall notify Customer without unreasonable delay, and in no event later than 72 hours after becoming aware of a Security Incident affecting Customer's Personal Data. Notification shall include:

• Description of the nature of the Security Incident
• Categories and approximate number of Data Subjects affected
• Categories and approximate number of Personal Data records affected
• Contact information for AutoCents' incident response team
• Likely consequences of the Security Incident
• Measures taken or proposed to address the incident

5.2 Incident Response Cooperation

AutoCents shall:

• Cooperate with Customer's reasonable requests for information about the Security Incident
• Assist Customer in investigating the incident
• Take reasonable measures to mitigate harm from the incident
• Provide updates as the investigation progresses
• Assist Customer in meeting any notification obligations to Data Subjects or regulatory authorities

6. SUB-PROCESSORS

6.1 Authorized Sub-processors

Customer authorizes AutoCents to engage the sub-processors listed in Appendix A. AutoCents shall:

• Impose data protection obligations on sub-processors that are no less protective than those in this DPA
• Ensure sub-processors comply with applicable Data Protection Laws
• Remain fully liable for sub-processors' compliance with data protection obligations

6.2 New Sub-processors

AutoCents may engage new sub-processors provided:

• AutoCents provides at least 30 days' prior written notice to Customer
• Customer may object to the new sub-processor within 30 days if it has reasonable grounds related to data protection
• If Customer objects and no resolution is reached, Customer may terminate the affected Services

7. DATA SUBJECT RIGHTS

7.1 Rights Support

AutoCents shall assist Customer in fulfilling Data Subject requests to exercise rights under applicable Data Protection Laws, including:

• Access to Personal Data
• Correction of inaccurate Personal Data
• Deletion of Personal Data
• Restriction of processing
• Data portability
• Opt-out of sale or targeted advertising

7.2 Direct Requests

If AutoCents receives a direct request from a Data Subject:

• AutoCents shall promptly notify Customer
• AutoCents shall not respond directly without Customer's written authorization
• AutoCents shall provide reasonable assistance to Customer in responding

8. LIABILITY AND RISK ALLOCATION

8.1 Limitation of Liability

AutoCents' liability to Customer under this DPA is limited to direct damages actually caused by:

• AutoCents' material breach of its specific obligations under this DPA
• AutoCents' failure to implement required security measures as specified in Section 4
• AutoCents' processing of Personal Data outside the scope of Customer's documented instructions

9. NEW HAMPSHIRE PRIVACY ACT COMPLIANCE

9.1 Consumer Rights Support

AutoCents shall provide technical assistance to enable Customer to fulfill New Hampshire consumers' rights to:

• Access their Personal Data
• Correct inaccurate Personal Data
• Delete Personal Data
• Opt-out of processing for targeted advertising
• Opt-out of sales of Personal Data

10. COPPA COMPLIANCE

10.1 Enhanced Protection for Children's Data

If any Personal Data relates to children under 13, additional requirements apply:

• Separate parental consent required for any third-party disclosures
• Enhanced security measures and monitoring
• Strict data minimization principles
• Compliance with updated COPPA Rule requirements

11. DATA TRANSFERS AND RETENTION

11.1 Data Location

Personal Data will be processed and stored primarily in the United States. AutoCents may access Personal Data from other locations for support, maintenance, or disaster recovery purposes, subject to appropriate safeguards.

11.2 Data Retention

AutoCents shall:

• Retain Personal Data only as long as reasonably necessary to fulfill the purposes in Section 3.2
• Not retain Personal Data indefinitely
• Implement automated deletion procedures where technically feasible
• Provide Customer with information about retention periods upon request

12. COMPLIANCE MONITORING AND AUDITS

12.1 Audit Rights

Customer may audit AutoCents' compliance with this DPA through:

• Review of AutoCents' compliance documentation
• Third-party security certifications and reports
• On-site inspections with 30 days' prior notice (limited to once annually unless there is reasonable suspicion of non-compliance)

13. INSURANCE AND FINANCIAL SAFEGUARDS

13.1 Cyber Liability Insurance

AutoCents shall maintain cyber liability insurance coverage with minimum limits commensurate with the volume and sensitivity of Personal Data processed, including coverage for:

• Data breach response costs
• Regulatory fines and penalties
• Third-party liability claims
• Business interruption
• Crisis management and public relations

14. GENERAL PROVISIONS

14.1 Governing Law

This DPA shall be governed by the laws of New Hampshire, except where federal law provides exclusive jurisdiction. Any disputes shall be resolved in the state or federal courts of New Hampshire.

14.2 Amendment

This DPA may only be modified by written agreement signed by both parties. AutoCents may update Appendix A (Sub-processors) in accordance with Section 6.

APPENDIX A: AUTHORIZED SUB-PROCESSORS

AutoCents may engage the following sub-processors to assist in providing the Services:

Note: AutoCents will update this list in accordance with Section 6.2 when engaging new sub-processors.