GetMotors Data Processing Agreement

1. Parties and roles

This agreement is between the Dealer (the controller) and [GetMotors legal entity name, company number and registered address — to be confirmed] (GetMotors, the processor). It forms part of the GetMotors Dealer Terms of Service and meets the requirements of Article 28 of the UK GDPR.

2. Subject matter and duration

GetMotors processes personal data on the Dealer's behalf to provide the Service, for as long as the Dealer's account is open and for the deletion period in section 10 afterwards.

3. Nature and purpose of the processing

Hosting the Dealer's storefront; receiving and storing enquiries, test-drive bookings, part-exchange requests, reservations and saved-car lists; taking reservation deposits through the payment provider; sending the transactional and alert messages the Dealer's customers ask for; and providing the dashboard the Dealer uses to manage them.

4. Types of personal data and data subjects

•Data subjects: the Dealer's customers and prospective customers who use its storefront.

•Personal data: names, email addresses, phone numbers, messages, vehicle and part-exchange details, reservation and payment references (never card numbers), saved cars, stock-alert searches and consent records, and records of messages sent.

5. GetMotors' obligations

•Process personal data only on the Dealer's documented instructions, which are these terms and the Dealer's use of the Service, unless the law requires otherwise.

•Make sure everyone who processes the data is under a duty of confidentiality.

•Keep the data secure with appropriate technical and organisational measures, including tenant isolation in the database, encryption in transit, and access control with two-factor authentication.

•Help the Dealer answer data-subject requests (access, correction, erasure and the others) within the time the law allows.

•Notify the Dealer without undue delay, and in any event within [48] hours, after becoming aware of a personal data breach affecting the Dealer's data.

•Help the Dealer with data-protection impact assessments and consultations with the ICO where the processing requires them.

•Make available the information needed to show compliance with this agreement, and allow for audits on reasonable notice.

6. Sub-processors

The Dealer gives general authorisation for GetMotors to use the sub-processors below. GetMotors will give at least [30] days' notice of a new sub-processor, during which the Dealer may object.

•Hosting and database: [provider and region — to be confirmed; UK/EU hosting is required]

•Payments: Stripe Payments Europe Ltd (reservation deposits)

•Email and SMS delivery: [providers — to be confirmed]

•AI assistant on the storefront: Anthropic (questions typed into the chat assistant; not stored by GetMotors)

7. International transfers

Where a sub-processor processes data outside the UK, GetMotors will rely on UK adequacy regulations or the International Data Transfer Agreement / Addendum. [Transfer assessment — to be confirmed.]

8. Data GetMotors controls itself

GetMotors is a controller, not a processor, for the account details of the Dealer's own staff and for its own billing records; those are covered by the GetMotors privacy notice. [Whether GetMotors' own aggregate website analytics across dealer storefronts makes it a controller for that processing is an open question for review.]

9. Retention inside the Service

Message delivery logs have their recipient and content removed after a retention period set by the platform. Other records are kept while the Dealer's account is open unless the Dealer asks for them to be deleted.

10. End of the agreement

When the Dealer's account ends, GetMotors will, at the Dealer's choice, return or delete the Dealer's customers' personal data within [90] days, unless the law requires it to be kept.