Data Processing Addendum

1. Definitions

• “Applicable Data Protection Law” means, to the extent it applies to the processing: the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and its regulations (Cal. Code Regs. tit. 11, §7000 et seq.) (together, the “CCPA”); the comprehensive consumer privacy laws of other U.S. states (for example, Colorado, Connecticut, Virginia, Utah, Texas, and Oregon); and the Gramm-Leach-Bliley Act (“GLBA”) with the FTC’s Privacy Rule (16 CFR Part 313) and Safeguards Rule (16 CFR Part 314).
• “Customer Personal Data” means personal information that you or your Consumers submit to the Services, or that we collect on your behalf through the Services (for example, through your website, forms, chat, messaging, and connected platforms), and that we process as your service provider or processor. It does not include Account Data.
• “Account Data” means information about your account, your users, and billing, which we process as a controller under our Privacy Policy.
• “Consumer” means an individual whose personal information is Customer Personal Data, such as a website visitor, shopper, lead, applicant, or customer of yours.
• “Financing Application Data” means information submitted through credit application and pre-approval forms, including Social Security number, date of birth, and income.
• “Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data in our or our Subprocessors’ systems.
• “Subprocessor” means a third party we engage to process Customer Personal Data on our behalf to provide the Services.

“Business,” “service provider,” “contractor,” “controller,” “processor,” “sell,” “share,” “sensitive personal information,” “customer information,” and “nonpublic personal information” have the meanings given in Applicable Data Protection Law.

2. Roles of the Parties

For Customer Personal Data, you are the “business” and “controller,” and DriveReachAds is your “service provider” or “contractor” under the CCPA and your “processor” under other Applicable Data Protection Law. If you use the Services on behalf of another business (for example, as an agency managing dealership accounts), you confirm that you are authorized to give us instructions for that business, and we act as your subprocessor.

For Account Data, DriveReachAds acts as a controller, as described in our Privacy Policy. Advertising platforms and other services you choose to connect are not our Subprocessors; see Section 8.

3. Details of Processing

• Subject matter and duration: providing the Services to you for the term of the Terms, plus the period after termination described in Section 14.
• Nature of processing: collecting, hosting, storing, organizing, transmitting, analyzing, generating content from, and deleting Customer Personal Data as the Services require.
• Categories of Consumers: visitors to your websites; shoppers, leads, and applicants; people who submit forms, trade-in requests, or appointment requests; people who message you through chat, email, or connected messaging platforms; and, for real estate customers, prospective buyers, sellers, and renters.
• Categories of personal information: identifiers and contact details (such as name, email, phone, and address); vehicle or property interests, trade-in details, and photos; communications, including chat and AI assistant transcripts; appointment details; Financing Application Data; and internet activity (such as IP address, device and browser information, pages viewed, referral and campaign attribution, consent choices, and Global Privacy Control signals).
• Sensitive personal information: Financing Application Data includes sensitive personal information (such as Social Security numbers) and may be customer information under the GLBA. We process it only as described in Sections 6 and 10.

4. Business Purposes

We process Customer Personal Data only for the following specific business purposes (the “Business Purposes”):

• Hosting and operating your websites, inventory pages, forms, and shopper tools.
• Capturing, storing, and delivering leads, form submissions, and Financing Application Data to you and to destinations you designate (such as email addresses or a CRM that accepts ADF/XML leads).
• Providing the lead inbox, CRM, messaging, live chat, and appointment scheduling, including the AI sales assistant that responds to Consumers on your behalf.
• Generating AI-assisted copy, images, and video from your inventory and other materials.
• Publishing posts, listings, catalogs, and ads to platforms you connect and measuring their results, including sending website events to your advertising accounts when you enable it, subject to Consumers’ privacy choices.
• Providing you analytics and reporting about your websites, leads, and campaigns.
• Providing tools that help you honor privacy choices and respond to Consumer privacy requests.
• Providing customer support that you request.
• Detecting and preventing security incidents, spam, fraud, and abuse, and debugging and repairing the Services.
• Complying with law and responding to legal process.
• Internal use to build or improve the quality of the Services, as permitted by 11 CCR §7050(a), without using Customer Personal Data to perform services for another business or to build or augment a profile of a Consumer.

We do not use Customer Personal Data to train or fine-tune AI models.

5. Your Instructions and Responsibilities

The Terms, this DPA, and your configuration and use of the Services (including your settings, forms, and connected platforms) are your documented instructions to us. We process Customer Personal Data only on those instructions, unless the law requires otherwise. Additional instructions must be consistent with the Terms and agreed in writing. We will tell you if we believe an instruction violates Applicable Data Protection Law, but we are not responsible for reviewing your instructions for legal compliance.

You are responsible for the lawfulness of the Customer Personal Data you collect and your instructions, including providing required notices, obtaining required consents, and honoring Consumers’ rights and choices, as further described in the Terms.

6. CCPA Service Provider and Contractor Terms

With respect to Customer Personal Data, and as required by the CCPA (including 11 CCR §7051(a)), DriveReachAds:

• will not sell or share it;
• will not retain, use, or disclose it for any purpose other than the Business Purposes, or as otherwise permitted by the CCPA and its regulations;
• will not retain, use, or disclose it outside the direct business relationship between you and DriveReachAds;
• will not combine it with personal information we receive from or on behalf of another person, or collect from our own interactions with a Consumer, except as the CCPA and its regulations permit;
• will comply with the obligations that apply to us under the CCPA and provide the same level of privacy protection the CCPA requires of businesses, including cooperating with you on Consumer requests and maintaining reasonable security procedures and practices;
• will use sensitive personal information, including Financing Application Data, only to provide the Services and as permitted by 11 CCR §7027(m), and not to infer characteristics about Consumers;
• will notify you within five business days if we determine that we can no longer meet our obligations under the CCPA or its regulations;
• grants you the right to take reasonable and appropriate steps to help ensure that we use Customer Personal Data consistently with your CCPA obligations, including the assessments described in Section 13;
• grants you the right, upon notice, to take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data, including by directing us to stop the processing or delete the affected data;
• will enable you to respond to Consumer requests as described in Section 12, and will tell you about requests we receive directly; and
• will engage Subprocessors only as described in Section 9.

DriveReachAds certifies that it understands the restrictions in this Section and will comply with them.

7. Obligations Under Other State Privacy Laws

Where other state consumer privacy laws apply to Customer Personal Data, DriveReachAds also will:

• ensure that each person who processes Customer Personal Data for us is subject to a duty of confidentiality;
• delete or return Customer Personal Data at the end of the Services, as described in Section 14;
• make available the information in our possession that is necessary to demonstrate our compliance with those laws, and allow and cooperate with reasonable assessments, as described in Section 13;
• engage Subprocessors only under written contracts that require them to meet our obligations for the Customer Personal Data, after giving you notice and an opportunity to object, as described in Section 9; and
• taking into account the nature of the processing and the information available to us, provide reasonable assistance with your obligations to respond to Consumer requests, secure personal data, give breach notifications, and conduct data protection assessments, risk assessments, and cybersecurity audits.

8. Advertising Platforms and Other Services You Connect

When you connect or enable third-party services, such as Meta, Google, or TikTok advertising accounts, pixels and conversion APIs, lead forms, messaging channels, or your CRM, we transmit Customer Personal Data to those services only as you instruct. Those services are chosen by you, act under your own agreements with them, and are not our Subprocessors. Any disclosure of personal information to them, including for advertising, is made by you, and you are responsible for the notices, consents, and opt-out rights it requires.

Dealer websites hosted on the Services treat a Global Privacy Control signal as a request to opt out of sale and sharing, and do not load advertising pixels or send server-side conversion events for a visitor who has opted out or who, where your consent settings require it, has not consented. See our Subprocessors page for examples of platforms you can connect.

9. Subprocessors

You authorize us to engage the Subprocessors listed on our Subprocessors page. We impose data protection obligations on each Subprocessor by written contract that are no less protective of Customer Personal Data than those required of us by Applicable Data Protection Law, and we remain responsible for their performance of those obligations.

We will update the Subprocessors page and email your account owner at least 30 days before a new Subprocessor begins processing Customer Personal Data. If a replacement is urgently needed to keep the Services secure or available, we will give notice as soon as reasonably practicable.

You may object to a new Subprocessor on reasonable data protection grounds by emailing hello@drivereachads.com within 30 days after our notice. We will work with you in good faith to address the objection. If we cannot reasonably do so, you may terminate the affected Services by written notice, and we will refund any prepaid fees for the terminated portion of the term.

10. Information Security (GLBA Safeguards Rule)

You may be a financial institution subject to the GLBA and the FTC Safeguards Rule, which requires you to oversee your service providers by contract (16 CFR 314.4(f)). With respect to Customer Personal Data, including customer information and nonpublic personal information, DriveReachAds will:

• implement and maintain administrative, technical, and physical safeguards appropriate to our size and complexity, the nature and scope of the Services, and the sensitivity of the information, designed to protect its security, confidentiality, and integrity;
• use and disclose nonpublic personal information only to provide the Services to you, consistent with the limits on reuse and redisclosure in 16 CFR 313.11; and
• take reasonable steps to select and retain Subprocessors that are capable of maintaining appropriate safeguards, require them by contract to maintain those safeguards, and periodically assess them based on the risk they present.

Our safeguards currently include:

• Encryption in transit: TLS (HTTPS) for the dashboard, dealer websites and forms, and connections to our providers.
• Encryption at rest: Customer Personal Data is stored with hosting, database, and storage providers that encrypt data at rest. Financing Application Data is also encrypted by our application before it is stored, using AES-256-GCM with a separate data key for each customer account that is itself encrypted with a master key kept outside the database. If that encryption is unavailable, those fields are discarded rather than stored unencrypted.
• Access controls: separation between customer accounts; role-based permissions for your users; two-step verification (an emailed code) available for every user account, which account owners can require for their whole team; and, before decrypted financing details are shown, the user's password plus an emailed one-time code, limited to owner, admin and manager roles, with every view logged. Access by DriveReachAds personnel is limited to what is needed to provide, support, and secure the Services.
• Logging and monitoring: security-relevant account events (such as sign-ins, password and two-step verification changes, and team membership changes) and administrative actions by DriveReachAds personnel are logged, and application errors are monitored.
• Retention and disposal: Financing Application Data is automatically deleted 25 months after submission, consistent with the record-retention period in Regulation B (12 CFR 202.12) and the disposal requirement in 16 CFR 314.4(c)(6). First-party website analytics events are deleted after 26 months. Other Customer Personal Data is kept for the term of the Services and then handled as described in Section 14.
• Privacy controls: Global Privacy Control and consent handling on dealer websites, as described in Section 8.
• Vendor oversight: selection, contractual requirements, and periodic review of Subprocessors, as described above and in Section 9.

We may change our safeguards over time, but we will not materially reduce the overall protection of Customer Personal Data. No method of transmission or storage is completely secure.

You remain responsible for your own information security program, including managing which of your users can access the Services, requiring two-step verification for them, protecting their credentials, and promptly removing access for people who no longer need it.

11. Security Incidents

We will notify you without undue delay, and in any event within 72 hours after we confirm a Security Incident affecting your Customer Personal Data. We will send notice to your account owner’s email address and include, to the extent known: a description of the incident; the categories and approximate number of Consumers and records affected; whether the affected data was encrypted and whether encryption keys were involved; the likely consequences; the steps we have taken or plan to take; and a contact for more information. We will update you as more information becomes available.

We will take reasonable steps to contain, investigate, and remediate the Security Incident. Unsuccessful attempts that do not compromise the security of Customer Personal Data, such as pings, port scans, or blocked sign-in attempts, are not Security Incidents. Our notice is not an acknowledgment of fault.

You decide whether and how to notify affected Consumers, regulators, and others. If a Security Incident is a “notification event” under the FTC Safeguards Rule (generally, unauthorized acquisition of unencrypted customer information of at least 500 consumers), you must notify the FTC as soon as possible and no later than 30 days after discovery (16 CFR 314.4(j)). We will provide the information in our possession that you reasonably need to meet that deadline and any state breach-notification requirements, and we will not notify Consumers or regulators about your Customer Personal Data on your behalf without your approval unless the law requires us to.

Please report suspected Security Incidents, including compromised user credentials, to hello@drivereachads.com.

12. Consumer Requests and Privacy Choices

The Services include tools to help you respond to Consumer privacy requests, such as locating, exporting, correcting, and deleting a Consumer’s records, and website controls that record opt-out and consent choices. If you cannot complete a request with those tools, we will provide reasonable assistance on your written request, in time for you to meet your legal deadlines when you give us reasonable notice.

If we receive a request directly from a Consumer about your Customer Personal Data, we will not act on it ourselves. We will tell the Consumer to contact you or forward the request to you, unless the law requires otherwise.

13. Assessments, Audits, and Information

On your written request, no more than once in any 12-month period (and additionally after a Security Incident or when a regulator requires it), we will respond to reasonable security and privacy questionnaires and provide documentation reasonably necessary to demonstrate our compliance with this DPA, including a description of our safeguards and our current Subprocessors.

If that information is not sufficient to meet a legal requirement that applies to you, you or an independent assessor you designate may conduct a reasonable assessment of our relevant practices, with at least 30 days’ notice, during normal business hours, subject to confidentiality obligations, and in a way that does not unreasonably disrupt the Services or expose other customers’ data. As an alternative, we may arrange for a qualified and independent assessor to assess our practices using an appropriate and accepted control standard and provide you the report. Each party bears its own costs.

Information we provide under this Section is our confidential information.

14. Return and Deletion

During the term, you can delete many kinds of Customer Personal Data, such as leads and inventory, directly in the Services. The automatic retention periods described in Section 10 continue to apply.

After the Services end, you may ask us in writing, within 30 days, to return Customer Personal Data by providing an export in a commonly used, machine-readable format, to delete it, or both. On your deletion request, we will delete Customer Personal Data from our active systems within a reasonable time. Copies in backups are deleted as those backups expire in the ordinary course. If you make no request within 30 days, we may delete Customer Personal Data.

We may keep Customer Personal Data where the law requires us to. This DPA continues to protect any Customer Personal Data we keep, for as long as we keep it.

15. Data Location and International Transfers

We host Customer Personal Data primarily in the United States. Some Subprocessors may process data in other countries, as noted on our Subprocessors page.

The Services are designed for businesses in the United States. Do not use the Services to process personal data that is subject to the EU or UK GDPR or to other laws that restrict international transfers unless we have first agreed in writing to any additional terms those laws require.

16. Order of Precedence, Liability, and Changes

If this DPA conflicts with the Terms or any other agreement between us about the processing of Customer Personal Data, this DPA controls, unless a written agreement signed by both parties expressly states that it amends this DPA. Each party’s liability under this DPA is subject to the limitations of liability in the Terms, to the extent the law permits.

We may update this DPA as the law or the Services change. If we make a material change, we will notify your account owner by email before it takes effect. Updates will not reduce the protection this DPA provides for Customer Personal Data unless the law requires it.