Brego Data Processing Agreement

This Data Processing Agreement (the “DPA”) forms part of the Agreement between Brego and the Customer. It applies automatically, and only, to the extent that Brego processes Customer Personal Data on behalf of the Customer as processor or subprocessor in connection with the Services. It supplements clause 15.1 of the Master Services Agreement (the “MSA”), with its scope and the parties’ roles determined under clauses 1.1, 1.3, 1.4 and 1.5 of this DPA.

Capitalised terms not defined in this DPA have the meanings given in the MSA. The parties’ roles for the relevant processing are set out in clause 1.4. Nothing in this DPA changes either party’s role for processing for which it acts as an independent controller.

1. Definitions and scope

1.1 In this DPA:

“Customer Personal Data” means all personal data processed by Brego on behalf of the Customer as processor or subprocessor in connection with the Services, including personal data generated or derived in carrying out that processing and personal data comprised in Output Data, Usage Data or Supplier Data to the extent processed in that capacity. It excludes processing for which Brego acts as an independent controller under clause 1.3;

“Data Protection Laws” means the data protection, privacy and electronic communications laws applicable to the relevant processing, including the UK GDPR and the Data Protection Act 2018, and, where applicable, the EU GDPR;

“EU GDPR” means Regulation (EU) 2016/679;

“EU SCCs” means the standard contractual clauses adopted by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021;

“Personal Data Breach” has the meaning given in applicable Data Protection Laws;

“Restricted Transfer” means a transfer of personal data that requires an adequacy decision, standard contractual clauses or another safeguard under applicable Data Protection Laws;

“Subprocessor” means a third party engaged by Brego to process Customer Personal Data on behalf of the Customer;

“Transfer Clauses” means the EU SCCs and the UK Addendum, as applicable;

“UK Addendum” means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, as updated or replaced from time to time.

1.2 The subject matter, duration, nature and purposes of the processing, the categories of personal data and data subjects, and the Customer’s rights and obligations are described in Schedule 1 and the applicable Order. Where required for the relevant processing or transfer, these details shall be supplemented by a service-specific processing and transfer record expressly incorporated into the Order or otherwise agreed in writing under this DPA.

1.3 This DPA does not apply to processing for which Brego acts as an independent controller under clause 15.2 of the MSA, including its collection and use of Vehicle Listing Data licensed under clause 8.3(b) of the MSA. This exclusion applies only to processing for which Brego in fact determines its own purposes and means in accordance with Data Protection Laws. Security, fraud prevention, Usage Data or service-improvement activities carried out on the Customer’s behalf remain subject to this DPA to the extent they involve Customer Personal Data. Nothing in this clause expands Brego’s rights under the MSA to reuse Customer Personal Data.

1.4 For the purposes of clause 15.1 of the MSA, the Customer is the controller and Brego is the processor where the Customer determines the purposes and means of the relevant processing. Where the Customer acts as a processor for another controller and is authorised to appoint Brego, the Customer is a processor and Brego is its subprocessor. References in this DPA to Brego as processor include that subprocessor role.

1.5 The definition of Customer Personal Data in clause 1.1 applies to this DPA, the Security Measures and the data-protection, security, transfer and personal-data return or deletion obligations in clauses 15 and 17.6 of the MSA, notwithstanding the exclusions in the MSA definitions of Customer Data and Customer Personal Data. This does not change ownership, licence rights, the Permitted Purpose, other use restrictions or the liability allocation under clause 12 of this DPA.

2. Customer instructions and obligations

2.1 Brego shall process Customer Personal Data only on the Customer’s documented instructions, including in relation to a Restricted Transfer, unless required otherwise by UK law or, where the EU GDPR applies, EU or Member State law, in each case only to the extent permitted by applicable Data Protection Laws and Transfer Clauses. The Agreement, the Customer’s authorised configuration and use of the Services, and written instructions consistent with the Agreement constitute the Customer’s documented instructions.

2.2 Before processing under a legal requirement described in clause 2.1, Brego shall inform the Customer of that requirement unless the relevant law prohibits such information on important grounds of public interest. Any request for access or disclosure by a public authority remains subject to applicable Data Protection Laws and Transfer Clauses.

2.3 Brego shall promptly inform the Customer if, in Brego’s reasonable opinion, an instruction infringes Data Protection Laws. Brego may suspend the affected processing until the Customer withdraws or lawfully amends the instruction, without liability for resulting delay or non-performance.

2.4 The Customer is responsible for ensuring that its instructions, collection and disclosure of Customer Personal Data, and use of the Services comply with Data Protection Laws. The Customer shall provide all required privacy information, establish an appropriate lawful basis, obtain any required consent or permission, and submit only personal data that is adequate, relevant and reasonably necessary for the Permitted Purpose.

2.5 The Customer shall not submit special category personal data or personal data relating to criminal convictions and offences unless Brego has expressly agreed in writing and the parties have documented any additional processing, security and legal requirements.

2.6 Where the Customer acts as a processor, it warrants that it has and shall maintain the relevant controller’s authorisation to appoint Brego and its Subprocessors and to give the instructions contemplated by this DPA. It shall ensure that those instructions are consistent with its obligations to the controller and shall pass on notices and assistance to the controller where required.

3. Confidentiality and personnel

3.1 Brego shall ensure that persons authorised to process Customer Personal Data are subject to an appropriate duty of confidentiality and process it only as necessary to perform their duties.

3.2 Brego shall take reasonable steps to ensure that authorised personnel receive security and data-protection awareness appropriate to their roles.

4. Security

4.1 Taking into account the state of the art, implementation costs, and the nature, scope, context and purposes of processing and the risks to individuals, Brego shall implement and maintain appropriate technical and organisational measures designed to protect Customer Personal Data in accordance with Article 32 of the UK GDPR or EU GDPR, as applicable.

4.2 Brego’s Security Measures form part of this DPA. Subject to clause 4.1 and any expressly agreed security requirements, Brego determines and may change the technologies, processes and individual controls used without the Customer’s prior approval, provided that the overall level of protection for Customer Personal Data is not materially reduced. Any applicable change-notification requirement under clause 19.5 of the MSA or the Transfer Clauses remains in force.

4.3 No particular provider, product, technical architecture, encryption algorithm, certification, audit standard, testing method, remediation deadline or review frequency is warranted unless expressly stated in an Order or expressly incorporated service-specific security description. Nothing in this clause limits an obligation imposed by applicable Data Protection Laws or Transfer Clauses.

5. Subprocessors

5.1 The Customer gives Brego general written authorisation to select, appoint and replace Subprocessors, including Brego Affiliates, subject to this clause. Separate approval is not required for each appointment made under that authorisation. The current authorised Subprocessors are listed at https://www.brego.io/legal/sub-processors or a replacement location notified by Brego.

5.2 Brego shall notify the Customer by email in accordance with clause 19.3 of the MSA of an intended new or replacement Subprocessor at least 10 Business Days before it begins processing Customer Personal Data. Brego shall allow any longer period required by applicable Data Protection Laws to provide a meaningful opportunity to object, or expressly agreed in the applicable Order or Transfer Clauses. The notice shall identify the Subprocessor, its processing role, relevant processing locations, intended start date and objection deadline, and provide information reasonably necessary to exercise the right to object. The Customer may agree in writing to a shorter period to the extent permitted by applicable Data Protection Laws and Transfer Clauses. Updating the published list alone does not constitute notice.

5.3 The Customer may object by the deadline stated in the notice, which shall be no earlier than 10 Business Days after receipt of the information required by clause 5.2 unless a shorter period is agreed under that clause. An objection must be on reasonable and documented grounds relating to the protection of Customer Personal Data. The parties shall use reasonable efforts to address a valid objection. If no valid objection is received by that deadline, Brego may proceed under the general authorisation in clause 5.1 without further confirmation from the Customer, subject to applicable Data Protection Laws and Transfer Clauses.

5.4 If Brego cannot reasonably address the objection without disproportionate cost or disruption, Brego may refrain from appointing the Subprocessor, offer a reasonable alternative, or suspend or terminate the affected Service in accordance with the MSA. The Customer has no right to object on purely commercial or competitive grounds. Brego shall not permit the proposed Subprocessor to process the affected Customer Personal Data while a valid objection remains unresolved.

5.5 Before a Subprocessor processes Customer Personal Data, Brego shall enter into a binding written contract imposing data-protection obligations that provide an equivalent level of protection for Customer Personal Data to the obligations in this DPA, including sufficient guarantees to implement appropriate technical and organisational measures. Brego remains responsible for the Subprocessor’s performance of those obligations, subject to clause 12 of this DPA.

6. International transfers

6.1 Brego may process and permit the processing of Customer Personal Data in any location permitted by the Agreement and Data Protection Laws, provided that each Restricted Transfer is covered by an applicable adequacy decision, the Transfer Clauses or another lawful transfer mechanism.

6.2 Where a Restricted Transfer from the Customer to Brego requires and may lawfully rely on the EU SCCs or UK Addendum, the parties enter into the applicable Transfer Clauses as completed by Schedule 2. All required Appendix Information shall be completed before the transfer begins. The Transfer Clauses take priority over the Agreement to the extent of any conflict, in accordance with their mandatory hierarchy provisions.

6.3 Brego shall ensure that onward Restricted Transfers by Brego or its Subprocessors are covered by an appropriate lawful transfer mechanism, including a separate binding transfer agreement where required. Schedule 2 does not itself execute transfer clauses with a Subprocessor. Each party remains responsible for any transfer assessment or supplementary measure that applicable Data Protection Laws or Transfer Clauses require it to carry out or implement.

7. Data subject requests

7.1 Taking into account the nature of the processing, Brego shall provide reasonable assistance through appropriate technical and organisational measures to enable the Customer to respond to requests by data subjects exercising their rights under Data Protection Laws.

7.2 If Brego receives a request relating to Customer Personal Data, it shall refer the request to the Customer and shall not respond substantively unless instructed by the Customer or required by law. The Customer is responsible for determining the appropriate response.

8. Assistance and compliance

8.1 Taking into account the nature of the processing and the information available to Brego, Brego shall provide reasonable assistance to the Customer with its obligations concerning security, Personal Data Breach notification, data protection impact assessments and prior consultation with a supervisory authority.

8.2 Brego may charge its reasonable costs for assistance, audits, bespoke reports or technical work under this DPA, except to the extent the assistance is required because of Brego’s breach of this DPA or charging would be prohibited by applicable Data Protection Laws or Transfer Clauses. Cost-recovery arrangements shall not prevent or delay compliance with a mandatory obligation.

8.3 Each party shall comply with its direct obligations under applicable Data Protection Laws and shall cooperate with a competent supervisory authority where legally required.

9. Personal Data Breaches

9.1 Brego shall notify the Customer without undue delay and, in any event, within 72 hours after becoming aware of a Personal Data Breach affecting Customer Personal Data.

9.2 To the extent information is reasonably available, the notification shall describe the nature of the breach, the categories and approximate number of affected data subjects and records, the likely consequences, and measures taken or proposed to address it. Brego may provide information in phases as it becomes available.

9.3 Brego shall take reasonable measures to contain, investigate and remediate the Personal Data Breach. Notification or cooperation under this clause is not an admission of fault or liability.

10. Information, audits and inspections

10.1 Brego shall make available information reasonably necessary to demonstrate compliance with Article 28 of the UK GDPR or EU GDPR, as applicable. The Customer shall first review Brego’s then-current policies, questionnaires, independent reports, certifications or other compliance materials made available by Brego.

10.2 If those materials are reasonably insufficient, the Customer may conduct one audit in any 12-month period, unless a competent supervisory authority requires more frequent audit or a material Personal Data Breach reasonably justifies it. An audit must:

(a) be limited to processing of Customer Personal Data and matters reasonably necessary to verify compliance with this DPA;

(b) be carried out at the Customer’s expense, on at least four weeks’ notice, during normal business hours and with minimal disruption;

(c) be conducted by the Customer or an independent auditor that is not a competitor of Brego and is bound by appropriate confidentiality obligations;

(d) not involve access to source code, penetration testing, vulnerability scanning, information relating to another customer, or facilities or systems not relevant to the Customer’s processing, unless Brego expressly agrees in writing; and

(e) comply with Brego’s reasonable security and confidentiality requirements.

10.3 The Customer shall provide Brego with a copy of any audit report and shall not disclose it except where legally required. Subject to clause 8.2, Brego may charge its reasonable time and costs in supporting an audit, except where the audit identifies a material breach of this DPA by Brego.

10.4 The procedures and restrictions in this clause do not limit information, audit or inspection rights required by applicable Data Protection Laws or Transfer Clauses. To the extent those requirements necessitate an earlier or additional audit, or information or access beyond the ordinary restrictions above, Brego shall permit and contribute to it subject to lawful and appropriate confidentiality and security safeguards.

11. Return and deletion

11.1 At the end of the relevant processing, Brego shall, at the Customer’s written choice, delete or return Customer Personal Data and delete existing copies, unless storage is required by law and permitted by applicable Data Protection Laws and Transfer Clauses. The Customer must communicate its choice within 30 days after the affected Service ends; if it does not, it instructs Brego to delete the data. Brego shall complete the return or deletion without undue delay in accordance with the documented periods or criteria described in clause 11.4, subject to clauses 11.2 and 11.3. Pending completion, the data shall remain protected and used only as necessary for return, deletion or lawful retention.

11.2 Customer Personal Data in routine backups may remain until overwritten or deleted through Brego’s documented ordinary backup cycle, provided that it is put beyond ordinary use, remains protected under this DPA and is not restored except where necessary for disaster recovery or legal compliance. On restoration, Brego shall reapply relevant deletion and access restrictions before the restored data is made available for operational use, except to the extent lawfully required otherwise. Any shorter deletion requirement imposed by applicable Data Protection Laws or Transfer Clauses prevails.

11.3 Where Brego is legally required to retain Customer Personal Data, it shall isolate and protect the retained data and process it only for the legally required purpose.

11.4 Brego shall document and make available to the Customer the deletion periods and backup-rotation periods, or objective criteria determining them, applicable to the relevant processing. The applicable Order or an agreed processing and transfer record shall identify any service-specific retention requirements. Customer Personal Data shall not be retained for longer than is necessary for a permitted purpose under this clause. General record-keeping or dispute-resolution provisions elsewhere in the Agreement do not, of themselves, authorise continued retention of processor-held Customer Personal Data.

12. Liability

12.1 The exclusions and limitations in clauses 13 and 15.7 of the MSA apply to Brego’s contractual liability under or in connection with this DPA and the Security Measures. That liability forms part of, and does not increase, the applicable aggregate cap. A different contractual allocation must satisfy clause 15.7 of the MSA. Nothing in this DPA limits mandatory liability under Data Protection Laws or the Transfer Clauses, including liability between the parties or rights of data subjects to the extent those cannot be limited.

12.2 Neither party may recover more than once in respect of the same loss. Any amount recovered under this DPA, the Agreement or the Transfer Clauses shall be taken into account in calculating any other recovery for the same event.

13. General

13.1 Document priority is governed by clause 19.8 of the MSA, subject to clause 15.7 of the MSA. Nothing in that priority or in this DPA overrides applicable Data Protection Laws or the mandatory hierarchy and requirements of the Transfer Clauses.

13.2 Brego may update this DPA in accordance with clause 19.5 of the MSA. An update shall not materially reduce the protection of Customer Personal Data or remove a mandatory requirement of applicable Data Protection Laws.

13.3 Third-party enforcement rights are governed by clause 19.11 of the MSA, without limiting rights conferred by applicable Data Protection Laws or Transfer Clauses, including rights of data subjects. No additional third-party enforcement right is created by this DPA.

Schedule 1. Details of processing

The following describes the permitted processing. The applicable Order, including any expressly incorporated plan description or processing and transfer record, identifies the Services and the categories, purposes, frequency and retention applicable to them. Additional information required for a Restricted Transfer shall be completed under Schedule 2 before that transfer begins.

Schedule 2. International transfer clauses

1. EU restricted transfers. Where the EU SCCs are required and legally applicable to a Restricted Transfer from the Customer to Brego, the official clauses in the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 are incorporated into the Agreement, with the following selections:

(a) Module Two applies where the Customer is a controller and Brego is a processor; Module Three applies where the Customer is a processor and Brego is a subprocessor. Modules One and Four do not apply;

(b) the optional docking clause in Clause 7 does not apply unless the parties agree otherwise;

(c) Option 2 (general written authorisation) in Clause 9 applies, with a specified notice period of 10 Business Days, subject to any longer period applicable under clause 5.2 of this DPA. Any shorter period must be specifically authorised in advance in writing by the Customer and permitted under the applicable Transfer Clauses;

(d) the optional language in Clause 11 does not apply;

(e) Option 1 in Clause 17 applies. The governing law is the law of the EU Member State in which the data exporter is established, provided that law permits third-party beneficiary rights; otherwise Irish law applies;

(f) the courts under Clause 18 are the courts of that same EU Member State, or Ireland where Irish law applies, without restricting the additional courts available to data subjects under the EU SCCs;

(g) Annex I.A is completed by the parties’ details and roles specified in paragraph 4(a) and the applicable Order or agreed processing and transfer record. Annex I.B is completed by Schedule 1 and the transfer-specific information identified under paragraph 4(b). Annex I.C identifies the competent supervisory authority determined under Clause 13, as recorded under paragraph 4(c); and

(h) Annex II comprises the Security Measures and the incorporated description of measures actually implemented for the relevant processing under paragraph 4(d). The relevant Subprocessors and their details are identified under paragraph 4(e). Where Annex III is required, that information completes it.

2. UK restricted transfers. Where the UK Addendum is required, the Approved EU SCCs, including the Appendix Information and only the modules and optional provisions selected in paragraph 1, are incorporated as amended by the UK Addendum. The parties agree the following completion of Part 1:

(a) Table 1: the parties and key contacts are identified in paragraph 4(a) and the applicable Order or agreed processing and transfer record. The start date and execution are determined under paragraph 3;

(b) Table 2: the Approved EU SCCs are those in the Annex to Decision (EU) 2021/914, with Module Two or Module Three and the Clause 7, 9 and 11 selections in paragraph 1. Clause 9 uses general authorisation and the notice period selected in paragraph 1(c). The Module Four data-combination option is not applicable;

(c) Table 3: Annex I.A and I.B are completed as described in paragraph 1(g); Annex II and the relevant Subprocessor information are completed as described in paragraph 1(h). The adjustments to supervisory authority, governing law and jurisdiction required by the UK Addendum apply; and

(d) Table 4: both the data exporter and the data importer may exercise the termination right in Section 19 of the UK Addendum if its conditions are met.

The Alternative Part 2 Mandatory Clauses are incorporated as follows:

Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses.

3. Execution and changes. The parties’ acceptance of an Order incorporating this DPA in accordance with the MSA constitutes their execution of the applicable Transfer Clauses. Their start date is the date the relevant Order becomes binding, unless a later date is expressly agreed before the relevant transfer begins. The Transfer Clauses apply only where required under clause 6.2. If a regulator replaces or approves a successor mechanism, Brego may update this Schedule under clause 13.2, subject to the mandatory amendment provisions of the applicable Transfer Clauses.

4. Appendix Information. Before a transfer relying on this Schedule begins, the parties shall complete and retain the following information in the applicable Order or an agreed processing and transfer record, to the extent it is not already supplied by this DPA and its incorporated documents. Only the parts relevant to the covered transfer apply:

(a) Parties and activities: the exporter is the Customer identified in the Order, with its legal and any different trading name, registered or principal address, registration number (if any), relevant role, key contact’s role and contact details, including email, and any required EU representative. The importer is Brego Ltd, company number 13710133, of The Stable Yard, Vicarage Road, Stony Stratford, Milton Keynes, Buckinghamshire, England, MK11 1BN; its key contact is the Legal and Data Protection contact at legal@brego.io. Its role is processor or subprocessor under clause 1.4. The relevant activities are the Customer’s provision of personal data for, and Brego’s processing to supply, the Services identified in the Order. Acceptance details and dates shall be recorded under paragraph 3;

(b) Transfer description: the relevant Services, countries and processing or remote-access locations, applicable data-subject and personal-data categories, transfer frequency, nature and purposes, retention periods or objective criteria, and any agreed sensitive-data safeguards. For processing by Subprocessors, identify its subject matter, nature and duration;

(c) Supervision: identify the competent EU supervisory authority under Clause 13 using the exporter’s circumstances, including any relevant EU representative or affected data subjects. For UK transfers, the UK Addendum’s Information Commissioner provisions apply;

(d) Security: identify the version of the Security Measures and any expressly incorporated service-specific security description detailing the technical and organisational measures actually applied to the relevant processing, including relevant transmission, storage, access, segregation, logging, backup and deletion controls. Describe any supplementary measures and any necessary safeguards for data expressly permitted under clause 2.5; and

(e) Subprocessors: identify the relevant entries in the list at https://www.brego.io/legal/sub-processors, with legal names, addresses, contact information, processing roles and locations and the processing subject matter, nature and duration. Brego shall make any required detail not included in the public list available in the agreed record. A copy of the relevant information shall be retained, with changes governed by clause 5.