Data Processing Addendum (DPA)

By signing a MIRA Business order form or using MIRA Business, Customer agrees to be bound by this DPA. If this DPA conflicts with the partner agreement or the Terms of Service on a data protection matter, this DPA prevails.

1. Definitions & Statutory Context

Terms such as "Personal Data", "Processing", "Data Subject", "Supervisory Authority", and "Technical and Organisational Measures" have the meanings given in the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Scope of Processing & Data Categories

Motorsync processes Customer Personal Data only to provide MIRA Business to Customer:

• Nature and Purpose: storing, organising and displaying Customer's records; sending messages and notifications Customer asks for; running vehicle handovers and identity checks; passing finance applications to the finance panel Customer chooses; publishing to the social channels Customer connects; and answering questions through Mira.
• Categories of Data Subjects: Customer's leads, customers and vehicle buyers, showroom visitors, finance applicants, and Customer's own staff users.
• Categories of Personal Data: names and contact details (email, phone, address); vehicle interests, purchases and e-garage records; appointments, including driving licence details for test drives; messages and conversation records; finance application details (address and employment history, income and outgoings); and handover records.
• Special Category Data: at a vehicle handover, a customer's photo and short videos of their face are compared with their identity document to confirm they are the buyer. This biometric data is used only for that check.
• Location: the customer's location at the moment they record handover videos, to confirm the handover happened at the agreed place.
• Duration of Processing: for as long as Customer keeps a MIRA Business account, then until deletion under section 9.

3. Data Processor Obligations

Motorsync agrees that it shall:

• Process Customer Personal Data only on Customer's documented instructions, which are this DPA, the partner agreement, and Customer's use and settings of MIRA Business, unless the law requires otherwise (in which case Motorsync will tell Customer first, unless the law forbids it).
• Ensure that everyone authorised to process Customer Personal Data is bound by confidentiality obligations.
• Apply the security measures in section 4.
• Use sub-processors only as set out in section 5.
• Help Customer meet its obligations on security, breach notification, data protection impact assessments and consultation with the ICO, taking into account the nature of the processing and the information available to Motorsync.
• Tell Customer promptly if, in Motorsync's opinion, an instruction infringes the UK GDPR or other data protection law.
• Never sell Customer Personal Data, or use it for Motorsync's own purposes beyond providing, securing and improving MIRA Business.

4. Technical & Organisational Security Measures

5. Sub-Processors

Customer gives Motorsync general authorisation to use the following sub-processors:

• AI Processing: Google processes Mira's data only to produce answers for Motorsync and does not use it to train its models or for advertising. Before a typed message is sent, email addresses, phone numbers, postcodes, payment card numbers, bank details and National Insurance numbers are removed.
• Sub-Processor Terms: Motorsync puts each sub-processor under written data protection terms that protect Customer Personal Data at least as well as this DPA, and remains responsible to Customer for their performance.
• Changes: Motorsync will give Customer at least 14 days' notice, by email or by updating this page, before adding or replacing a sub-processor. Customer may object on reasonable data protection grounds; if the parties cannot resolve the objection, Customer may end the affected service.
• Services Customer Chooses: when Customer sends a finance application to a finance panel or lender, or connects Facebook, Instagram or YouTube to publish posts, Motorsync passes the data on Customer's instruction. Those providers are not Motorsync's sub-processors; their own terms and privacy policies apply.

6. Personal Data Breach Notification

If a Security Incident involves Customer Personal Data, Motorsync shall:

• Notify Customer in writing without undue delay, and in any event within 72 hours of becoming aware of it.
• Give the details it has about the nature of the breach, the categories of data and the approximate number of people affected, the likely consequences, and the steps taken or proposed, adding further details as they become known.
• Take prompt steps to contain the incident, limit its effects and prevent it happening again.

7. Data Subject Rights Assistance

Motorsync shall help Customer respond to requests from people exercising their data protection rights, such as access, correction, erasure and restriction. MIRA Business lets Customer export and delete its records directly. If Motorsync receives a request about Customer Personal Data, it will pass it to Customer without undue delay and will not answer it itself, unless Customer asks it to or the law requires it.

8. International Data Transfers

Customer Personal Data is stored in the United Kingdom. Mira, the assistant, runs within the European Union, which the UK recognises as giving personal data the same level of protection.

Where a sub-processor in section 5 processes Customer Personal Data in another country, Motorsync relies on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or, where none applies, the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.

9. Data Return, Export & Deletion

Customer can download a copy of its data from MIRA Business at any time before its account closes. When Customer closes its account or the partner agreement ends, Motorsync shall delete Customer Personal Data within 30 days, after a 14-day period during which Customer can cancel the closure. Deleted data leaves Motorsync's backups within 7 days after that. Motorsync keeps data longer only where the law requires it, such as invoices and billing records.

10. Audit Rights & Compliance Verification

Motorsync shall make available to Customer the information needed to show that it meets its Article 28 obligations, including a description of its security measures and its current list of sub-processors. Customer, or an independent auditor bound by confidentiality, may audit Motorsync's compliance with this DPA once a year, or after a Security Incident, on at least 30 days' written notice, during business hours and at Customer's cost.

11. Term, Governing Law & Contact

This DPA lasts as long as Motorsync processes Customer Personal Data for Customer.