Data Processing Addendum

This Data Processing Addendum ("DPA") supplements the Terms of Service and governs the processing of personal data by CarSalesSoftware.com.

1. Roles of the Parties

For the purposes of this DPA, you (the Customer) act as the Data Controller, and CarSalesSoftware.com acts as the Data Processor. You are responsible for ensuring that you have the legal right to collect and transfer personal data to us.

2. Processing Instructions

We will only process personal data in accordance with your documented instructions, which include the use of our Services as outlined in the Terms of Service. We will not process personal data for any other purpose unless required to do so by applicable law.

3. Security Measures

We implement and maintain appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These measures include encryption in transit and at rest, regular security assessments, and strict access controls.

4. Subprocessors

You grant us general authorization to engage Subprocessors to assist in providing the Services. We will remain fully liable for the acts and omissions of our Subprocessors. A current list of Subprocessors is available on our Subprocessors List page.

5. Data Subject Requests

We will assist you, to the extent technically possible, in fulfilling your obligations to respond to requests from data subjects exercising their rights under applicable data protection laws. If we receive a request directly from a data subject, we will promptly notify you.

6. Personal Data Breach

In the event of a personal data breach affecting your data, we will notify you without undue delay after becoming aware of the breach. We will provide you with sufficient information to allow you to meet any reporting obligations.

7. Return or Deletion of Data

Upon termination of the Services, we will, at your choice, return or delete all personal data processed on your behalf, unless applicable law requires storage of the personal data.