Data Processing Addendum

Effective: July 15, 2026

This Data Processing Addendum ("DPA") forms part of the Autoflow Terms & Conditions between Autoflow ("Processor," "we," "us") and the fleet operator using the Services ("Customer," "Controller," "you"). It applies where and to the extent Autoflow processes Personal Data on your behalf that is subject to the EU General Data Protection Regulation ("GDPR"), the UK GDPR, or similar data protection laws ("Data Protection Laws"). By using the Services, you accept this DPA. A countersigned copy is available on request at contact@getautoflow.io.

1. Roles and Scope

You are the Controller of Personal Data relating to your customers and renters ("Renter Data") and your own staff. Autoflow is your Processor. Each party will comply with the Data Protection Laws applicable to it. Where Autoflow processes personal data for its own purposes (e.g., your account data, product analytics, billing), Autoflow acts as an independent controller under its Privacy Policy.

2. Details of Processing

• Subject matter and nature: hosting, storage, transmission, and display of fleet-operations data; booking management; digital contracts and e-signature; payment facilitation; and, where you enable them, identity, insurance, and background verification performed by the sub-processors listed below.
• Purpose: providing the Services described in the Terms.
• Duration: the term of your subscription, plus the deletion period in Section 9.
• Categories of data subjects: your Renters and prospective Renters; your staff and team members.
• Categories of Personal Data: contact details; booking and rental details; government-ID data and verification outcomes; insurance policy details; screening outcomes; contract and signature records (including IP addresses and timestamps); payment metadata (processed by the payment processor).
• Special categories: biometric identifiers used for identity matching are processed by the identity-verification sub-processor under its own consent flow presented to the data subject; Autoflow stores verification outcomes, not raw biometric templates.

3. Processor Obligations

Autoflow will:

• process Personal Data only on your documented instructions (the Terms, this DPA, and your configuration and use of the Services constitute such instructions), unless required otherwise by law, in which case we will inform you unless prohibited;
• ensure persons authorized to process Personal Data are bound by confidentiality obligations;
• implement and maintain the technical and organizational measures described in Section 6;
• assist you, taking into account the nature of processing, in responding to data subject requests (access, rectification, erasure, restriction, portability, objection);
• assist you with your obligations regarding security, breach notification, and data protection impact assessments, taking into account the information available to us;
• notify you without undue delay after becoming aware of a Personal Data breach affecting your data, and provide information reasonably required for your own notification obligations; and
• delete or return Personal Data as described in Section 9.

4. Sub-processors

You provide general authorization for the sub-processors listed below. We will notify operators of material changes to this list (via this page and, for material additions, email or in-app notice) at least 14 days before the change takes effect; you may object on reasonable data-protection grounds, in which case we will work with you in good faith on a resolution, including allowing termination of the affected Service.

5. International Transfers

Where Personal Data protected by the GDPR or UK GDPR is transferred to a country without an adequacy decision (including the United States), the parties rely on the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), Module Two (controller-to-processor) and Module Three (processor-to-processor), which are incorporated into this DPA by reference, with you as data exporter and Autoflow as data importer; for UK transfers, the UK International Data Transfer Addendum applies. Where a sub-processor is certified under the EU-U.S. Data Privacy Framework, transfers to it may also rely on that framework.

6. Security Measures

• Encryption of data in transit (HTTPS/TLS) and at rest
• Role-based access controls and least-privilege access to production systems
• OAuth token encryption; no storage of full card numbers (payment data is held by the payment processor)
• Raw ID images and biometric data held by the verification provider, not on Autoflow systems
• Logical separation of customer data; backups; audit logging
• Personnel confidentiality obligations and access reviews

7. Audits

On written request no more than once per year (unless required by a supervisory authority or following a breach), we will make available information reasonably necessary to demonstrate compliance with this DPA, including summaries of third-party assessments where available, and will allow audits conducted in a manner that does not compromise the security of other customers' data, subject to confidentiality obligations.

8. Data Subject Requests

If a Renter contacts Autoflow directly with a privacy request relating to Renter Data, we will route the request to you without undue delay and, where feasible, provide tools in the Services for you to fulfill it. We will not respond directly on your behalf except where required by law.

9. Deletion and Return

During the subscription term you can export and delete Renter Data through the Services. Upon termination, we will delete Personal Data processed on your behalf within 30 days, except where retention is required by law, in which case the data remains protected under this DPA until deletion. Deletion of verification records triggers redaction of the corresponding data held by the verification provider.

10. Liability and Order of Precedence

The parties' liability under this DPA is subject to the limitations of liability in the Terms. In case of conflict between this DPA and the Terms with respect to processing of Personal Data, this DPA prevails; the Standard Contractual Clauses prevail over this DPA where they apply.

Contact

Privacy and data-protection inquiries: contact@getautoflow.io