Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the VehiclesDB Terms of Service and API Terms (together, the "Agreement") between Latent Software LLC ("we", "processor") and the customer ("you", "controller"). It applies only where, and only to the extent that, we process personal data on your behalf and data-protection law (including the EU and UK GDPR) requires a contract of this kind. It is accepted when you accept the Agreement. A mutually signed data processing agreement, if one exists, replaces it.

VehiclesDB is a service about vehicles, not people. The processing described here is narrow, and you agree to keep it that way.

1. Scope and roles

1.1 What this DPA covers ("Customer Personal Data"). Vehicle registration marks, and any other personal data the Documentation expressly permits, that you submit to an API endpoint so that we can return a response to you. For that processing you are the controller (or a processor acting for your own customer, in which case you confirm that the controller has authorised these terms) and we are your processor.

1.2 What it does not cover. We act as an independent controller, under our Privacy Policy, for: your account, billing, and contact data; Usage Data and security logs (including the IP address, user-agent, and calling origin of requests made by your systems or by your visitors' browsers through the Widget); and anything we process to secure, meter, bill, and defend the Services or to comply with law. We do not use Customer Personal Data for our own purposes; you instruct us that we may anonymise it, so that it no longer relates to an identifiable person, and use the anonymised result to operate and improve the Services. Personal data you submit against the Documentation or the Acceptable Use Policy is submitted in breach of the Agreement.

1.3 Details of processing. Subject matter and purpose: returning the requested API response (for example, checking a registration mark against published plate formats). Nature: receipt, transient computation, and return. Duration: the time needed to respond; registration marks are not written to our request logs. Data subjects: the people to whom the registration marks you submit relate. Categories of data: registration marks and any other field the Documentation permits; no special categories. Frequency: as you call the API.

2. Our obligations as processor

We will:

1. process Customer Personal Data only on your documented instructions — which are the Agreement, the Documentation, and your API requests — unless law requires otherwise, in which case we will tell you first where the law allows;
2. tell you if we believe an instruction infringes data-protection law;
3. ensure that people authorised to process Customer Personal Data are bound by confidentiality;
4. maintain appropriate technical and organisational measures, including encryption in transit, access controls, exclusion of registration marks from request logs and error reports, and credential security (Section 5);
5. taking into account the nature of the processing, assist you by appropriate measures, at your cost where the assistance is more than minimal, with data-subject requests, security, breach notification, impact assessments, and consultations with regulators, so far as they concern our processing;
6. notify you without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data, with the information we have;
7. delete Customer Personal Data when it is no longer needed to provide the response, and at the end of the Services, unless law requires us to keep it; and
8. make available the information reasonably necessary to demonstrate compliance with this DPA, as set out in Section 6.

3. Your obligations

You are responsible for the lawfulness of the Customer Personal Data and of your instructions: for having a legal basis, for informing the people concerned, for submitting only what the Documentation permits, in the fields it designates, and for not submitting special-category data, data about children, or data whose submission is unlawful.

4. Sub-processors

You give us general authorisation to use sub-processors to provide the Services — our infrastructure and hosting providers, our content-delivery and network-security provider, and our error-monitoring provider. The current list, with each sub-processor's name, role, and location, is available on request from privacy@vehiclesdb.com. We bind each sub-processor to data-protection obligations equivalent in substance to this DPA and remain responsible for its performance. We will notify you by email to your account address at least fourteen (14) days before a new sub-processor starts processing Customer Personal Data (or, where an urgent replacement is needed for security or continuity, as early as we can); you may object on reasonable data-protection grounds within that period, and if we cannot resolve the objection your remedy is to stop using the affected feature or to terminate under the Agreement.

5. Security

Our measures include: transport encryption for all API traffic; network and access controls limited to personnel who need access; hashed credentials and scoped, revocable API keys; exclusion of registration marks and similar inputs from request logs, analytics, and error reports; time-limited retention of request metadata; and monitoring for abuse. We may update these measures, provided the overall level of protection does not materially decrease.

6. Information and audits

On written request, no more than once in any twelve (12) months (or as a regulator requires), we will answer a reasonable written security and data-protection questionnaire about our processing of Customer Personal Data. Where data-protection law gives you a right to an audit that this information cannot satisfy, you may carry one out, at your cost, on at least thirty (30) days' notice, during business hours, under a confidentiality agreement, limited to what is necessary to verify our processing of Customer Personal Data, without access to other customers' data, subject to our reasonable security requirements, and with reimbursement of our reasonable time. The notice period does not apply where a regulator requires an earlier audit or after a personal-data breach affecting your data.

7. International transfers

We are established in the United States and process data there and where our sub-processors operate. Where your transfer of Customer Personal Data to us is restricted by EU, UK, or Swiss law and no adequacy decision or other valid mechanism applies:

1. the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), Module Two (controller to processor) — or Module Three where you act as a processor — are incorporated by reference, with you as data exporter and us as data importer; Clause 7 does not apply; Clause 9 option 2 (general authorisation, with the notice period in Section 4) applies; the optional language in Clause 11 does not apply; under Clauses 17 and 18 the governing law and courts are those of the EU member state in which you are established or, if none, Ireland; Annex I.A is completed with your name, address, and contact as held in your account (data exporter, controller or processor as Section 1.1 describes) and with Latent Software LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, USA, privacy@vehiclesdb.com (data importer, processor), each party's acceptance of the Agreement counting as its signature; Annex I.B by Section 1.3 (transfers are continuous, for the duration of the response, to the sub-processors in Section 4 for the same purpose); Annex I.C by the supervisory authority determined under Clause 13 for your establishment, your EU representative, or the data subjects concerned, as applicable; and Annex II by Section 5;
2. for transfers subject to UK law, the UK International Data Transfer Addendum to those Clauses (version B1.0) applies, completed with the same information, with neither party able to end it under its Section 19; and
3. for transfers subject to Swiss law, the Clauses apply with the adaptations the Swiss Federal Data Protection and Information Commissioner requires.

If there is a conflict between those Clauses and this DPA or the Agreement, the Clauses control.

8. Liability and general

Each party's liability under this DPA is subject to the exclusions and limitations of the Agreement, to the extent the law allows; nothing in this DPA limits a data subject's rights or either party's liability to a data subject or a regulator under the Standard Contractual Clauses or data-protection law. This DPA lasts as long as we process Customer Personal Data. Apart from Section 7, it is governed by the law and forum of the Agreement. Questions: privacy@vehiclesdb.com.