Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service (the "Agreement") between CarBG LLC, a Wyoming limited liability company ("CarBG", "we"), and the customer that has accepted the Agreement ("Customer"). It applies automatically to every Customer, without signature, whenever CarBG processes Customer Personal Data on Customer's behalf through the CarBG web app, mobile app or API (the "Service"). If this DPA conflicts with the Agreement, this DPA prevails with respect to the processing of Customer Personal Data.

1. Definitions

• Customer Personal Data: personal data contained in images, files or other content that Customer or its end users submit to the Service, and in the outputs generated from them.
• Data Protection Laws: all data protection laws applicable to the processing, including the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss FADP, Canada's PIPEDA, Québec's Act respecting the protection of personal information in the private sector (Law 25), and US state privacy laws such as the CCPA/CPRA.
• Subprocessor: a third party engaged by CarBG that processes Customer Personal Data.
• Security Incident: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
• Terms such as controller, processor, data subject and processing have the meanings given in the GDPR, or the equivalent terms (e.g. "business" and "service provider") under other Data Protection Laws.

2. Roles and scope

Customer is the controller of Customer Personal Data and CarBG is its processor. Where Customer acts as a processor on behalf of its own clients (for example, a software platform processing photos for independent dealerships), CarBG acts as Customer's subprocessor, and Customer is responsible for having the instructions and authority needed to engage CarBG. CarBG is an independent controller only for account, billing, support and usage data it needs to run its business, which is covered by our Privacy Policy.

3. Customer instructions

CarBG processes Customer Personal Data only on Customer's documented instructions. Those instructions are the Agreement, this DPA and Customer's use and configuration of the Service. CarBG will tell Customer if it believes an instruction violates Data Protection Laws, unless the law prohibits telling Customer. CarBG does not sell or share Customer Personal Data, and does not use it for any purpose other than providing, securing and supporting the Service.

4. No model training

CarBG does not use Customer Personal Data to train or fine-tune AI models, and it engages AI Subprocessors only under terms that prohibit them from using Customer Personal Data to train their models. This applies by default to every Customer, so there is no setting to turn on. AI Subprocessors may keep inputs for a limited period, typically up to 30 days, only for abuse and safety monitoring under their own terms.

5. Confidentiality and security

CarBG ensures that its personnel and contractors who have access to Customer Personal Data are bound by confidentiality obligations, and it limits access to what is needed for operations, support and quality assurance. CarBG maintains appropriate technical and organisational measures, including:

• Encryption of data in transit (TLS) and at rest.
• Private storage, with images isolated per workspace through row-level access controls; images are never publicly listed, and download links are time-limited signed URLs.
• Authentication for every account and API key, with credentials stored hashed or encrypted.
• Least-privilege access to production systems, with multi-factor authentication for administrative accounts.
• Error monitoring and logging to detect and investigate incidents.
• Vetting of Subprocessors' security commitments before engaging them.

6. Subprocessors

Customer gives general authorisation for CarBG to engage the Subprocessors listed below. CarBG imposes data protection obligations on each Subprocessor that are no less protective than this DPA, and remains responsible for their performance. CarBG will update this list and notify Customer by email at least 15 days before adding or replacing a Subprocessor. If Customer objects on reasonable data protection grounds and the parties cannot resolve the objection, Customer may terminate the affected part of the Service and receive a pro-rata refund of prepaid fees for it.

7. Assistance and data subject requests

Taking into account the nature of the processing, CarBG will help Customer meet its obligations under Data Protection Laws, including responding to data subject requests, data protection or privacy impact assessments (including assessments required by Québec Law 25 before transferring data outside Québec), and consultations with supervisory authorities. Customer can delete images itself through the Service at any time. If CarBG receives a request directly from a data subject about Customer Personal Data, it will forward it to Customer and will not respond except as Customer instructs or the law requires.

8. Retention and deletion

Images and outputs are kept in Customer's workspace until Customer deletes them; CarBG does not apply automatic expiry. When Customer deletes an image, it is removed from CarBG's active storage promptly and in any event within 30 days. CarBG does not keep separate backups of image files. When the Agreement ends, or on Customer's written request, CarBG will delete all Customer Personal Data within 30 days, unless the law requires it to keep some of it. Customer can download its outputs at any time before then. Subprocessor copies are deleted on the Subprocessor's own schedule, as described in section 4.

9. Security Incidents

CarBG will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident affecting Customer Personal Data. The notice will describe, as far as known, the nature of the incident, the data and data subjects affected, the likely consequences and the measures taken or proposed. CarBG will take reasonable steps to contain and remedy the incident, and will help Customer meet its own notification obligations.

10. International transfers

Customer Personal Data may be processed outside the country where it was collected, including in Singapore, the United States and the European Union. For transfers of personal data from the EEA, the parties agree to the EU Standard Contractual Clauses (Commission Decision 2021/914), Module Two (controller to processor) or Module Three (processor to processor), which are incorporated into this DPA by reference, with Customer as data exporter and CarBG as data importer. The optional clause 7 does not apply; clause 9 option 2 (general authorisation) applies with the notice period in section 6; clause 11's optional language does not apply; clauses 17 and 18 are governed by the laws and courts of Ireland. Annex I is completed by section 2 of this DPA, Annex II by section 5, and Annex III by section 6. For transfers from the UK, the UK International Data Transfer Addendum applies, and for transfers from Switzerland, the SCCs apply as adapted for the Swiss FADP. For transfers from Canada and Québec, CarBG provides protection equivalent to that required by PIPEDA and Law 25 under this DPA.

11. US state privacy laws

To the extent the CCPA/CPRA or similar US state laws apply, CarBG acts as a service provider. It will not sell or share Customer Personal Data, keep, use or disclose it outside the direct business relationship with Customer, or combine it with personal data received from others, except as those laws permit. CarBG certifies that it understands and will comply with these restrictions.

12. Audits

On request, CarBG will provide the information reasonably needed to demonstrate compliance with this DPA, including written answers to a reasonable security questionnaire up to once per year. If that information is insufficient, or if a supervisory authority requires it, Customer may carry out an audit with at least 30 days' written notice, during business hours, at its own cost, and subject to confidentiality obligations.

13. Liability, term and changes

Each party's liability under this DPA is subject to the limitations of liability in the Agreement, except where Data Protection Laws or the SCCs do not allow such limits. This DPA stays in effect for as long as CarBG processes Customer Personal Data. CarBG may update this DPA to reflect changes in law or in the Service, and will give notice of material changes; no update will reduce the overall level of protection for Customer Personal Data. Customers with an annual account value above USD 1,000 may request a countersigned copy or negotiate changes to this DPA.

14. Contact

CarBG LLC, Sheridan, WY 82801, USA. Privacy and data protection enquiries: hello@carbackground.ai.