Data Processing Addendum

1. Roles

For seller contact data the dealership is the Controller and VinScouter is the Processor. For dealer account data VinScouter is the Controller.

2. Subject matter

VinScouter processes personal data only to provide the service: aggregation of public listings, delivery of dealer-initiated messages, appointment scheduling, and CRM push.

3. Security measures

• TLS 1.2+ in transit; AES-256 at rest.
• Row-level security tenancy isolation per rooftop and per group.
• SOC 2 Type II audit underway (target Q4 2026).
• Quarterly access reviews; principle of least privilege.
• 72-hour breach notification commitment.

4. Subprocessors

A current subprocessor list and 14-day advance change notice are available at security@vinscouter.com.

5. Data subject rights

VinScouter assists Customer with seller access, deletion, and suppression requests within 10 business days at no additional cost.

6. Term & deletion

On termination Customer may export data for 30 days. After that all Customer data is deleted within 60 days, except suppression records which are retained indefinitely.