KarLink Data Processing Addendum (DPA)

This Data Processing Addendum ("DPA") forms part of the agreement between KarLink LLC and dealership customers using the KarLink platform.

1. Roles of the Parties

Dealerships act as the data controller/business, determining the purposes for which personal information is processed.

KarLink acts as a service provider/processor, processing information only to provide the KarLink platform.

2. Scope of Processing

KarLink processes information necessary to provide the platform, including:

• dealership staff account information
• operational service records
• vehicle identification data
• technician media uploads
• temporary customer service page data

3. Instructions from Dealerships

KarLink processes personal information only according to instructions provided by dealership users through normal use of the platform.

4. Confidentiality

KarLink personnel with access to system data are subject to confidentiality obligations and access controls.

5. Security Measures

KarLink implements technical and organizational safeguards including:

• encrypted connections
• role-based access controls
• authentication protections
• backup and recovery procedures

6. Subprocessors

KarLink may engage trusted subprocessors to provide platform services, including infrastructure hosting, storage, communications delivery, and system operations.

These providers process information only as necessary to deliver their services.

7. Assistance with Data Requests

Where applicable, KarLink will assist dealerships in responding to consumer privacy requests under applicable law.

8. Data Retention and Deletion

Data is retained according to KarLink’s operational retention schedules and may remain in archived backup systems for defined periods.

9. Updates

KarLink may update this DPA as infrastructure or services evolve.

Continued use of the platform constitutes acceptance of the updated DPA.