GDPR Data Processing Addendum

This GDPR Data Processing Addendum ("Addendum") supplements the Terms of Service and Privacy Policy for providers using the Car Smart People platform. This Addendum applies when processing personal data of individuals located in the European Economic Area (EEA) or when GDPR requirements apply.

1. Definitions

• "GDPR" means the General Data Protection Regulation (EU) 2016/679
• "Personal Data" means any information relating to an identified or identifiable natural person
• "Data Controller" means the entity that determines the purposes and means of processing personal data
• "Data Processor" means the entity that processes personal data on behalf of the Data Controller
• "Data Subject" means the natural person to whom the personal data relates

2. Roles and Responsibilities

3. Provider Obligations

As a Data Controller, providers agree to:

4. Data Subject Rights

Providers must facilitate the exercise of data subject rights, including:

• Right of Access: Provide data subjects with access to their personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Delete data when requested (subject to legal requirements)
• Right to Restrict Processing: Limit processing in certain circumstances
• Right to Data Portability: Provide data in a structured, machine-readable format
• Right to Object: Respect objections to processing for legitimate interests

5. Our Obligations as Data Processor

Car Smart People LLC commits to:

• Process personal data only in accordance with provider instructions
• Implement appropriate technical and organizational measures
• Assist providers in responding to data subject requests
• Notify providers of data breaches without undue delay
• Maintain records of processing activities
• Allow for audits and inspections when required

6. International Data Transfers

If personal data is transferred outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or adequacy decisions, in compliance with GDPR requirements.

7. Sub-Processors

We may engage sub-processors to assist in providing platform services. We ensure that all sub-processors:

• Are bound by data protection obligations
• Implement appropriate security measures
• Comply with GDPR requirements

8. Compliance and Cooperation

Both parties agree to cooperate in good faith to ensure compliance with GDPR and to respond to inquiries from supervisory authorities. We will assist providers in demonstrating compliance with their obligations under GDPR.