Data Processing Addendum

This Data Processing Addendum (“Addendum“) is part of the Terms of Service between you (“Customer,” “you“) and Dealer.ms Inc. (“Dealer.ms,” “we,” “us“). It applies whenever we process personal information on your behalf while providing the Services. You accept it when you accept the Terms. You do not need to sign anything. If you need a signed copy for your records, email privacy@dealer.ms.

Words with capital letters that are not defined here, such as Services, Software, Cloud Services and Hosting Services, have the meaning given in the Terms.

1. What This Addendum Covers

Your WordPress database is yours. The Software stores everything you enter into it, such as listings, leads, contacts and settings, in your own WordPress database. If your website is hosted somewhere other than our Hosting Services, we do not have access to that database and do not process the information in it. It is entirely under your control.

This Addendum covers the personal information we do process for you:

• Cloud Services: information sent to our servers to perform a Cloud Service, such as DMS Connect text messages and call records, AI content generation, Dealer.Pics image processing and VIN decoding, and the usage logs we keep for them;
• Hosting Services: websites, databases, files and email stored on our Hosting Services; and
• Support: personal information you share with us, or give us access to, when you ask for help.

Personal information we collect for our own purposes, such as your account, billing and support contact details, is covered by our Privacy Policy, not by this Addendum.

2. Definitions

• Data Protection Laws means the privacy and data protection laws that apply to the processing, including Canada’s PIPEDA and provincial laws, the EU General Data Protection Regulation (“GDPR“), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and US state privacy laws such as the California Consumer Privacy Act (“CCPA“).
• Customer Personal Data means personal information we process on your behalf under this Addendum.
• Controller, Processor, Data Subject, Processing and Supervisory Authority have the meanings given in the GDPR. Under other laws, they mean the equivalent terms, such as “business” and “service provider” under the CCPA.
• Sub-processor means a company we engage that processes Customer Personal Data.
• Security Incident means a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.

3. Roles

You are the Controller of Customer Personal Data, and we are your Processor. If you are a White-Label Partner processing data for your own clients, you may be a Processor for them. In that case we act as your Sub-processor, and you are responsible for passing on to your clients the commitments in this Addendum that apply to them.

The subject matter, duration, nature and purpose of the processing, and the types of personal information and Data Subjects, are described in Annex 1.

4. Your Responsibilities

You are responsible for:

• having a lawful basis, and any consent the law requires, to collect Customer Personal Data and have us process it, including consent to send text messages under laws such as CASL and the TCPA;
• giving your customers a privacy notice that explains how their information is used;
• making sure your instructions to us follow Data Protection Laws; and
• not sending us sensitive information, such as health information, government ID numbers or financial account numbers, through the Services unless the Services are designed for it.

5. How We Process Customer Personal Data

Only on your instructions. We process Customer Personal Data only to provide the Services, following your documented instructions. Your instructions are the Terms, this Addendum, and the way you set up and use the Services. If we believe an instruction breaks Data Protection Laws, we will tell you. We may also process it when the law requires us to. In that case we will tell you first, unless the law forbids it.

Confidentiality. Our staff and contractors who can access Customer Personal Data are bound by a duty of confidentiality, and only those who need access to do their job have it.

Security. We use the technical and organizational measures described in Annex 2 to protect Customer Personal Data. We may update them over time, but we will not reduce the overall level of protection.

Helping you. Taking into account the nature of the processing, we will help you, as reasonably needed, to:

• respond to Data Subject requests to access, correct, delete, restrict, port or object to the processing of their information. Much of this you can do yourself in your WordPress admin area. If a request reaches us directly, we will pass it on to you and will not answer it ourselves unless you ask us to;
• carry out data protection impact assessments and consult Supervisory Authorities when the law requires it; and
• meet your security obligations.

If the help goes beyond what the Services normally provide, we may charge a reasonable fee, which we will agree with you first.

6. Sub-processors

You give us general permission to use Sub-processors. The types we use, and where they process data, are listed in Annex 3. A list of the companies we currently use is available on request at privacy@dealer.ms.

Before a new Sub-processor starts processing Customer Personal Data, we will give you at least 30 days’ notice by email or in the client area. If you have a reasonable data protection concern, you can object in writing within that period. We will try to resolve it. If we cannot, you may cancel the affected Service, and we will refund the prepaid fees for the unused part of its term.

Each Sub-processor is bound by a written agreement that protects Customer Personal Data at least as well as this Addendum. We remain responsible to you for our Sub-processors’ work.

7. Security Incidents

If we become aware of a Security Incident affecting Customer Personal Data, we will notify you without undue delay. We will tell you what we know about the incident, its likely effects and the steps we are taking, and update you as we learn more. We will take reasonable steps to contain it and reduce harm.

You are responsible for any notice to Supervisory Authorities and affected individuals that the law requires, and we will help you as reasonably needed. Notifying you is not an admission of fault.

8. International Transfers

Dealer.ms is based in Canada. The European Commission and the United Kingdom recognize Canada as providing adequate protection for personal information handled by businesses, so transfers to us in Canada need no extra safeguards.

When Customer Personal Data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without such recognition, we or our Sub-processors use a lawful transfer mechanism. That means the European Commission’s Standard Contractual Clauses (Module Two, or Module Three where you are a Processor), the UK International Data Transfer Addendum, or another mechanism approved by Data Protection Laws. If you need the Standard Contractual Clauses between you and us, they are included in this Addendum by reference. The details they require are in the Annexes. Ireland’s law and courts apply to them.

9. US State Privacy Laws

Where US state privacy laws such as the CCPA apply, we act as your service provider or processor. We will not:

• sell or share Customer Personal Data, as those terms are defined in those laws;
• keep, use or disclose it for any purpose other than providing the Services, or as those laws otherwise allow; or
• combine it with personal information we receive from other sources, except as those laws allow.

We will comply with the obligations those laws place on service providers and tell you if we can no longer meet them.

10. Deleting Data When a Service Ends

When a Service ends, we will delete or return Customer Personal Data for that Service, as you choose, within the periods below, unless the law requires us to keep it:

• Cloud Services: data held on our servers for a Cloud Service may be deleted 30 days after that Service ends.
• Usage logs: we keep logs of Cloud Services usage, such as DMS Connect messages and call records, Dealer.Pics processing records, AI generation records and VIN lookups, so we can confirm how credits were used and answer billing questions. We keep them only as long as needed for billing, auditing, carrier and legal requirements, as described in our Privacy Policy, then delete or de-identify them.
• Hosting Services: as described in the hosting section of the Terms. Download anything you want to keep before your Hosting Services end.
• Backups: copies in our backups are overwritten in the normal backup cycle, and are protected under this Addendum until then.

Information stored in your own WordPress database is not affected. It stays under your control, and you can delete it when you deactivate the Software.

11. Audits

We will make available the information reasonably needed to show that we comply with this Addendum. If that information is not enough, or a Supervisory Authority requires it, you may audit our compliance once a year, at your own cost, with at least 30 days’ written notice. Audits must take place during normal business hours, avoid disrupting our business, respect the confidentiality of our other customers, and be carried out by you or an independent auditor bound by confidentiality. We will also allow audits that a Supervisory Authority requires.

12. Liability and Order of Precedence

Each party’s liability under this Addendum is subject to the limitations of liability in the Terms, unless Data Protection Laws do not allow those limits.

If this Addendum conflicts with the Terms, this Addendum wins for the processing of Customer Personal Data. If the Standard Contractual Clauses apply and conflict with this Addendum, the Standard Contractual Clauses win.

13. Term and Changes

This Addendum stays in effect as long as we process Customer Personal Data for you. We may update it to reflect changes in the law or the Services by posting the new version on this page with a new “Last updated” date. We will not make a change that reduces the protection of Customer Personal Data without giving you notice.

14. Contact Us

Questions about this Addendum: privacy@dealer.ms, Dealer.ms Inc., 290 Inkerman St E, Listowel, Ontario, N4W 2M9, Canada.

Annex 1: Details of Processing

Parties. Data exporter: the Customer, as Controller (or as Processor for its own clients). Data importer: Dealer.ms Inc., 290 Inkerman St E, Listowel, Ontario, N4W 2M9, Canada, as Processor. Contact: privacy@dealer.ms.

Data Subjects. Your customers and prospective customers, such as people who send you leads, ask about vehicles, sign up for stock alerts or exchange text messages and calls with you; your staff and other users of your website or account; and people who visit websites on our Hosting Services or send email to them.

Duration. For as long as we provide the Services, plus the retention periods in this Addendum.

Sensitive information. The Services are not designed to process special categories of personal data, and you should not send them to us.

Annex 2: Security Measures

• Encrypted connections (SSL/TLS) for data travelling to and from our websites, client area, Cloud Services and APIs.
• Access to systems that hold Customer Personal Data limited to staff who need it, with individual accounts.
• Isolated customer environments on our Hosting Services.
• Firewalls, malware protection, and monitoring of our servers and network for attacks and unusual activity.
• Regular security updates to our servers and software.
• Backups of our Hosting Services and core systems, to restore data after an incident.
• Short retention for data we do not need, such as deleting Dealer.Pics photos within one hour.
• Confidentiality commitments from staff and contractors, and written data protection agreements with Sub-processors.
• A process for responding to, recording and reporting Security Incidents.

Annex 3: Sub-processors

Wireless carriers that deliver text messages and calls, and vehicle data providers that decode VINs, are not our Sub-processors. They keep their own records under telecommunications law and their own policies, which we do not control. VINs on their own are not personal information.

The current list of companies is available on request at privacy@dealer.ms.