Data processing agreement

This Data processing agreement (the DPA) forms part of the Terms of service (the Terms) between Mycarro (Mycarro, the processor) and the Customer that accepted the Terms (the Customer, the controller). It applies whenever Mycarro processes personal data on the Customer's behalf in providing the Service. It meets the requirements of Article 28 of the General Data Protection Regulation (EU) 2016/679 (GDPR) and, where it applies, the Swiss Federal Act on Data Protection (FADP). Words defined in the Terms or the GDPR have the same meaning here.

1. Roles and scope

1.1. For the personal data that the Customer and its users put into the Service about its customers, leads, buyers, sellers, guarantors, employees and website visitors (the Customer Personal Data), the Customer is the controller and Mycarro is the processor. Annex 1 describes the processing.

1.2. Mycarro is an independent controller, outside this DPA, for:

• the account data of the Customer's users;
• billing data;
• usage, security and audit data;
• the de-identified and aggregated data it derives under the Terms;

all as described in its Privacy policy.

1.3. The Customer is responsible for the lawfulness of the processing it instructs. This covers having a valid legal basis and giving the notices required, collecting any consents needed, telling data subjects about its dealer website, and making sure that the Customer Personal Data and its instructions comply with the law. The Customer will not put special categories of data (such as health data) or data on criminal convictions into the Service, except where a feature is designed for it and the law permits it.

2. Instructions

2.1. Mycarro processes Customer Personal Data only on the Customer's documented instructions, including with regard to transfers, unless the law requires otherwise. In that case Mycarro tells the Customer first, unless the law forbids that.

2.2. The Customer's complete instructions are these: the Terms, this DPA, and the Customer's use and configuration of the Service, including the actions of its users and of any AI assistant or integration it connects. Any further instruction must be in writing, agreed by Mycarro, and consistent with the Service's functionality. It may be subject to fees.

2.3. Mycarro informs the Customer if, in its opinion, an instruction infringes data-protection law. It may then suspend that processing, without liability, until the instruction is confirmed or changed. Mycarro has no obligation to assess the lawfulness of the Customer's instructions beyond this.

3. Confidentiality

Mycarro ensures that the people it authorises to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that they access the data only as needed for the Service.

4. Security

4.1. Mycarro implements the technical and organisational measures described in Annex 2, which are appropriate to the risk, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing.

4.2. Mycarro may update those measures, provided that the overall level of protection is not reduced. The Customer has assessed the measures and agrees that they are appropriate for the Customer Personal Data.

4.3. The Customer is responsible for the security of its own systems, devices and credentials, for the roles and permissions it gives its users, for the integrations and AI assistants it connects, and for the configuration of the Service under its control.

5. Sub-processors

5.1. General authorisation. The Customer gives Mycarro a general authorisation to engage sub-processors, including those listed in Annex 3.

5.2. Changes. Mycarro tells the Customer about any intended addition or replacement of a sub-processor by updating Annex 3 on this page, and, where the change is material, by email or in the dashboard, at least 14 days in advance. In an emergency, such as a provider's sudden failure, the period may be shorter.

5.3. Objection. The Customer may object to a change on reasonable data-protection grounds, in writing, within that period. The parties will then discuss it in good faith. If Mycarro cannot reasonably avoid the change, the Customer's sole and exclusive remedy is to terminate the affected plan before the change takes effect, without any refund of prepaid fees beyond what the Terms otherwise allow. Continuing to use the Service after the notice period means the Customer accepts the change.

5.4. Flow-down. Mycarro imposes on each sub-processor, by contract, data-protection obligations that are in substance no less protective than those in this DPA, to the extent they apply to the services provided. Mycarro remains responsible to the Customer for its sub-processors' performance as the GDPR requires, subject to section 11.

5.5. Not sub-processors. Marketplaces, AI assistants, payment services, domain registrars and other third parties that the Customer chooses to connect or use act under their own terms. They are not Mycarro's sub-processors, and Mycarro is not responsible for them.

6. International transfers

Mycarro may transfer Customer Personal Data outside the European Economic Area and Switzerland, or allow its sub-processors to do so, only where:

• an adequacy decision covers the transfer;
• appropriate safeguards are in place, such as the European Commission's Standard Contractual Clauses (with the Swiss amendments where the FADP applies), together with additional measures where needed; or
• another transfer mechanism permitted by the GDPR applies.

The Customer authorises the transfers that the sub-processors in Annex 3 make on these bases.

7. Assistance

7.1. Data subjects' requests. The Service gives the Customer self-service tools to access, correct, export and delete Customer Personal Data. If Mycarro receives a request from a data subject about Customer Personal Data, it passes it on to the Customer without undue delay, if it can identify the Customer, and does not answer it itself except on the Customer's instructions. Where the self-service tools are not enough, Mycarro gives reasonable assistance, taking into account the nature of the processing.

7.2. Other assistance. Taking into account the nature of the processing and the information available to it, Mycarro gives reasonable assistance with the Customer's obligations on security, breach notification, data-protection impact assessments and prior consultation with authorities, mainly by providing this DPA, its annexes and the Service's documentation.

7.3. Costs. Assistance beyond the self-service tools and the documentation, or that is caused by the Customer's own act or breach, is charged at Mycarro's standard rates then in force.

8. Personal data breaches

8.1. Mycarro notifies the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. The notice is sent to the email address of the Customer's owner or administrator. As far as it is then known, it describes the nature of the breach, the categories and approximate numbers concerned, the likely consequences, and the measures taken or proposed. Information may be provided in phases.

8.2. Mycarro takes reasonable steps to contain the breach and mitigate its effects. The Customer is responsible for deciding whether to notify supervisory authorities and data subjects, and for doing so.

8.3. A notice or the assistance given is not an admission of fault or liability. Unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, such as pings, port scans, failed sign-in attempts or denial-of-service attacks, are not breaches and need no notice.

9. Return and deletion

9.1. During the term, the Customer can export and delete Customer Personal Data with the Service's tools.

9.2. After the Terms end, the Customer may ask for a final export within the period the Terms set. After that period, Mycarro deletes the Customer Personal Data, unless the law requires it to be kept. Copies in backups are deleted on the normal backup cycle, generally within 90 days, and until then remain protected under this DPA and are not used actively. Mycarro may keep de-identified and aggregated data, which is not personal data.

10. Audits and information

10.1. Mycarro makes available the information necessary to demonstrate compliance with Article 28 of the GDPR. It does so by providing this DPA, its annexes, answers to a reasonable written security questionnaire and, where available, third-party certifications or audit reports (including those of its sub-processors).

10.2. If the Customer reasonably shows that this information is not enough, or a supervisory authority requires it, the Customer may carry out an audit, alone or through an independent auditor bound by confidentiality who is not a competitor of Mycarro. The audit is subject to these conditions:

• at most once in any 12 months, unless there is a breach or an authority's order;
• on at least 30 days' written notice, with a scope agreed in advance;
• during business hours, remotely where possible, without disruption to the Service and without access to other customers' data or to sub-processors' facilities;
• at the Customer's sole cost, including Mycarro's reasonable costs at its standard rates;
• the Customer shares the audit report with Mycarro, and keeps it confidential.

11. Liability

Each party's liability arising out of or in connection with this DPA, whether in contract, tort or otherwise, is subject to the exclusions and limitations of liability in the Terms, and counts towards the same aggregate cap, to the extent the law allows. The Customer indemnifies Mycarro, as provided in the Terms, against claims and fines arising out of the Customer's instructions, the Customer Personal Data, or its breach of data-protection law.

12. Term, precedence and changes

12.1. This DPA applies for as long as Mycarro processes Customer Personal Data, and ends automatically when it no longer does.

12.2. If this DPA conflicts with the Terms on the processing of Customer Personal Data, this DPA prevails. In every other respect the Terms prevail. The Terms' provisions on governing law, jurisdiction, language, notices and changes apply to this DPA.

12.3. Mycarro may update this DPA, including to reflect changes in the law or in the Service, as the Terms describe. An update does not reduce the overall level of protection of Customer Personal Data.

Annex 1. Description of the processing

• Subject matter and duration: providing the Service to the Customer, for the term of the Terms and the wind-down period after it.
• Nature of the processing: collecting, recording, organising, storing, adapting, retrieving, consulting, using, disclosing by transmission (including to marketplaces and integrations the Customer activates), aligning, restricting, erasing and destroying, by automated means, including AI models.
• Purpose: the dealership management functions the Customer uses. These include stock and vehicle management, the dealer website, publishing to marketplaces, leads and customer management, sales, contracts, warranties, invoices and treasury, campaigns, documents, and the AI features and connectors.
• Categories of data subjects:
  • the Customer's customers and prospects (buyers, sellers, trade-in owners, guarantors);
  • leads and people who make enquiries;
  • visitors to the Customer's dealer website;
  • the Customer's employees and contractors;
  • other people the Customer records.
• Categories of personal data:
  • identification and contact data: name, email, phone, postal address;
  • identity and tax numbers, identity-document numbers and dates of birth, where the Customer records them for contracts, invoices or registrations;
  • vehicle and transaction data linked to a person (vehicle identification number, registration, purchase, sale, trade-in, prices, payments, financing, warranty);
  • communications and notes;
  • documents the Customer uploads;
  • technical data about visitors to the dealer website.
• Special categories: none intended. See section 1.3.

Annex 2. Technical and organisational measures

• Encryption: traffic encrypted in transit with TLS; secrets and credentials encrypted at rest.
• Access control: each user signs in individually through a dedicated authentication provider, with multi-factor authentication available; access is based on roles and limited to the Customer's own dealership; staff access to production follows the least-privilege principle and is limited to what is needed.
• Audit: changes made in the dashboard and through connectors are recorded with the user or assistant that made them.
• Separation: every record is scoped to its dealership, and access checks are enforced on the server.
• Availability and resilience: hosting in the European Union, regular backups, monitoring and alerting, and restore procedures.
• Development and change management: automated tests, code review, dependency and secret scanning, and separate development, staging and production environments.
• Data minimisation: error reports carry no session replay and no identifying user data; website analytics are cookieless.
• Providers: sub-processors are chosen for their security and bound by contract.
• Incident response: documented procedures to detect, contain, investigate and notify personal data breaches.

Annex 3. Sub-processors