Data Processing Agreement

1. Definitions and scope

1.1 This Data Processing Agreement (the "DPA") applies where Market Check Cars, Inc., a Nevada corporation ("MarketCheck", "we", "us"), processes Personal Data on your behalf in connection with MarketCheck AI Desk (the "Service"). It forms part of, and is incorporated into, our Terms of Service (the "Terms").

1.2 In this DPA:

• "Customer" (also "you") means the person or entity that has agreed to the Terms.
• "Controller" means the party that determines the purposes and means of processing Personal Data. For this DPA, that is the Customer.
• "Processor" means the party that processes Personal Data on the Controller's behalf. For this DPA, that is MarketCheck.
• "Data Protection Laws" means all laws applicable to the processing under this DPA, which may include the California Consumer Privacy Act as amended by the CPRA and other US state privacy laws, and, where the Customer is established in the United Kingdom or the European Economic Area, the UK GDPR, the Data Protection Act 2018, Part 5 of the Data (Use and Access) Act 2025, and the EU GDPR.
• "Data Subject" means the identified or identifiable person the Personal Data relates to.
• "Personal Data" means information relating to a Data Subject that we process solely as Processor on your behalf in connection with the Service. It excludes data we process as a controller for our own purposes.
• "Personal Data Breach" means a breach of security leading to accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of or access to Personal Data.
• "Sub-Processor" means a third party we engage to process Personal Data on your behalf.

1.3 Where no Personal Data is processed on your behalf, this DPA imposes no obligations on either party. Terms not defined here have the meaning given in the Terms.

2. Roles of the parties

2.1 You are the Controller and we are the Processor for Personal Data processed under this DPA. Each party complies with its own obligations under Data Protection Laws in that capacity.

2.2 As Controller you decide what Personal Data to put into the Service and why. You are responsible for having a lawful basis for the processing, for giving Data Subjects the privacy information they are owed, and for obtaining any consents or authorisations needed for us to process the Personal Data as described here.

2.3 The subject matter, duration, nature and purpose of the processing, the types of Personal Data, and the categories of Data Subjects are set out in Annex 1.

2.4 Nothing in this DPA prevents us from processing data for which we are ourselves a controller, including account registration details, billing records, usage, telemetry, and logs, for our own legitimate business purposes such as operating and securing the Service, billing, fraud prevention, support, and improving the product. We may also create and use aggregated or de-identified data that does not identify you or any Data Subject. That processing is governed by our Privacy Policy, not by this DPA.

3. Processing instructions

3.1 We process Personal Data only on your documented instructions, unless applicable law requires otherwise. The Terms, this DPA, and Annex 1 are your initial documented instructions, and running a report is an instruction to process the inputs you supply for that report. You may give further written instructions consistent with this DPA.

3.2 We do not process Personal Data for any purpose other than providing the Service in accordance with your instructions.

3.3 If law requires us to process Personal Data other than on your instructions, we will tell you before doing so unless the law prohibits it on important grounds of public interest.

3.4 We will tell you if, in our reasonable opinion, an instruction infringes Data Protection Laws or conflicts with how the Service works. We need not act on such an instruction until you confirm or change it in writing, and a delay caused by this section is not a breach by us.

4. Confidentiality

4.1 Anyone we authorise to process Personal Data is bound by an appropriate duty of confidence, by contract or by law. That applies to our employees, agents, and contractors alike.

4.2 Access to Personal Data is limited to those who need it to deliver the Service and who have been told it is confidential.

4.3 These obligations survive termination of this DPA and the Terms for as long as we or our personnel hold any Personal Data.

5. Security

5.1 We implement and maintain technical and organisational measures appropriate to the risk, described in Annex 2. These are a reasonable, risk-based standard and are not a guarantee that Personal Data will be secure against every Personal Data Breach.

5.2 In judging what is appropriate we take account of the state of the art, the cost of implementation, the nature, scope, context and purposes of the processing, and the likelihood and severity of risk to Data Subjects.

5.3 We test and review the effectiveness of those measures. We may update Annex 2 without your prior consent provided the overall level of protection is not materially reduced, and we will tell you promptly about any material change.

5.4 You are responsible for security within your own systems and for your account. That includes safeguarding your sign-in credentials, and controlling who you send report links to. A report link is a bearer link: anyone holding it can open the report and see whatever you entered on it. We are not responsible for a Personal Data Breach to the extent it arises from your systems, your handling of report links, or your failure to secure your own environment.

6. Sub-processors

6.1 Authorisation. You give a general written authorisation for us to engage Sub-Processors to process Personal Data on your behalf in connection with the Service.

6.2 List. Our current Sub-Processors, what each does, and where each processes, are listed at ai.marketcheck.com/sub-processors.

6.3 Notice of change. We give at least 30 days' notice before adding or replacing a Sub-Processor, by email to your account address or by updating that page.

6.4 Objection. You may object in writing within 30 days of notice. If your objection is reasonable we will use commercially reasonable efforts to offer an alternative. If none is agreed within 30 days, your sole remedy is to stop using the affected part of the Service and close your account.

6.5 Flow-down and liability. Each Sub-Processor is bound by written terms no less protective than this DPA. We are liable for a Sub-Processor's performance of those obligations to the same extent we would be liable for our own acts, subject to the limitations of liability in the Terms.

6.6 AI providers. Some parts of the Service send vehicle listing content to AI providers: photographs published by the selling dealer, and the text of a dealer listing page. This is done to produce a specific result, such as identifying visible wear on a comparable vehicle or reading an advertised price. Those providers do not use the content to train their models. The consumer details you enter on a worksheet, such as a name, address, or telephone number, are not sent to them. Where a report includes a condition assessment, we retain the findings and the photographs they were drawn from so that a disputed result can be re-checked. AI output is not always accurate, and Section 5 of the Terms applies to it.

7. Data subject rights

7.1 Taking account of the nature of the processing, we assist you by appropriate technical and organisational measures, so far as reasonably possible, in responding to requests from Data Subjects exercising their rights, including access, correction, deletion, restriction, portability, and objection.

7.2 If we receive such a request about Personal Data processed under this DPA, we will tell you promptly. We will not respond substantively unless you authorise it in writing or the law requires us to. You remain responsible for assessing and answering the request.

7.3 Where the law requires us to respond, we will tell you first unless prohibited from doing so.

7.4 Assistance that goes beyond our ordinary operation of the Service may be charged at our reasonable cost, notified to you in advance.

8. Breach notification

8.1 We notify you without undue delay after confirming a reportable Personal Data Breach affecting Personal Data processed on your behalf. An initial notification is for your information and is not an admission of fault or liability.

8.2 The notification will include, so far as then reasonably available to us:

• the nature of the breach, including where possible the categories and approximate number of Data Subjects and records concerned;
• a contact point for further information;
• the likely consequences; and
• the measures taken or proposed, including to mitigate adverse effects.

8.3 Where we cannot provide everything at once, we will provide the rest in phases without undue delay.

8.4 We will cooperate with you and take reasonable steps to assist in investigating and remediating the breach and in meeting your own notification obligations. Assistance beyond our ordinary operation of the Service may be charged at our reasonable cost.

9. Impact assessments

9.1 Where your processing under the Service requires a data protection impact assessment or prior consultation with a supervisory authority, we will give you reasonable assistance.

9.2 That assistance may include information about our processing activities, our security measures, and our Sub-Processor arrangements, so far as reasonably necessary for you to complete the assessment.

9.3 Ask in writing with reasonable notice. We may charge our reasonable costs, notified in advance.

10. Complaints

10.1 As Controller you are responsible for handling and resolving complaints from Data Subjects about the processing of their Personal Data, including acknowledging a complaint, taking reasonable steps to resolve it without undue delay, and telling the Data Subject the outcome.

10.2 We will give you reasonable assistance, taking account of the nature of the processing. If we receive a complaint directly we will pass it to you promptly and will not respond except as you instruct or as the law requires.

11. International transfers

11.1 We are established in the United States and our Sub-Processors process there, except as noted on the sub-processor list.

11.2 Where you are established in the United Kingdom or the European Economic Area and Personal Data is transferred out of it, that transfer is made under an approved mechanism: the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the EU Standard Contractual Clauses, as applicable. The applicable instrument is incorporated into this DPA by reference, and the parties will execute it separately where required.

11.3 On reasonable written request we will make available a summary of our transfer risk assessment. We need not disclose confidential or commercially sensitive detail, including detailed descriptions of our security architecture.

11.4 If a change in law or regulatory guidance makes the mechanism we rely on invalid, the parties will cooperate in good faith to put an alternative lawful mechanism in place without undue delay. Such a change, being outside our reasonable control, is not by itself a breach by us.

12. Audits

12.1 We will make available the information reasonably necessary to demonstrate compliance with this DPA.

12.2 We will permit and contribute to an audit by you or a qualified auditor you appoint, on these conditions: at least 30 days' written notice; no more than once in any 12 months unless required by a supervisory authority or triggered by a Personal Data Breach; at your cost; during normal business hours and with minimal disruption; and with the auditor bound by confidentiality obligations no less protective than this DPA.

12.3 Where we hold a relevant third-party audit report or certification less than 12 months old that addresses your request, we may satisfy an audit request by providing it.

13. Retention and deletion

13.1 You can delete a report from your account at any time, which removes the report and the Personal Data on it, including its hosted link.

13.2 On termination of the Terms we will, at your written election, return Personal Data to you in a commonly used machine-readable format or delete it, including existing copies. Tell us which within 30 days of termination. If you do not, we will delete it. We will complete the return or deletion within 60 days.

13.3 We may retain Personal Data where the law requires, in routine backups until they are overwritten on our normal cycle, and in aggregated or de-identified form that identifies neither you nor any Data Subject. Retained Personal Data stays subject to the security measures in Section 5 and Annex 2.

13.4 We will certify deletion in writing on reasonable request.

14. Term, liability, and general

14.1 Term. This DPA starts when you accept the Terms and continues while they are in force. It then terminates automatically, subject to Section 13 and anything that by its nature survives.

14.2 Liability. Liability under this DPA is subject to the limitations and exclusions in the Terms. This DPA does not create liability for us greater than, or in addition to, our liability under the Terms, and all liability under it counts toward those aggregate limits. Nothing here limits either party's liability for breach of Data Protection Laws where the law forbids that limit.

14.3 Conflict. If this DPA and the Terms conflict on the processing of Personal Data, this DPA prevails to that extent.

14.4 Governing law. This DPA is governed by, and construed in accordance with, the law stated in Section 11 of the Terms, and the same courts have jurisdiction. This is without prejudice to any mandatory provision of Data Protection Laws, and to any right a Data Subject or supervisory authority has to bring proceedings in their own jurisdiction.

14.5 Amendments. We may update this DPA to reflect changes in Data Protection Laws or in our processing. The current version is posted here, and material changes are notified under the notice provisions of the Terms.

Annex 1: Details of processing

Annex 2: Technical and organisational measures

We may update these measures provided the overall level of protection is not materially reduced.

Annex 3: Sub-processors

The current list of Sub-Processors authorised to process Personal Data on your behalf is maintained at ai.marketcheck.com/sub-processors.