This Data Processing Addendum ("DPA") is entered into between Differ-X, Inc. ("Differ-X") and the licensed automobile dealership accepting this Addendum (the "Dealer"). It governs the processing of personal information about consumers ("Lead Data") that Differ-X transfers to Dealer through the Differ-X platform.
For Lead Data transferred to Dealer, Dealer is the Data Controllerand Differ-X acts as a Processor during transfer and a Service Provider / Contractor under CCPA/CPRA. Each party is independently responsible for its own compliance with applicable law after the transfer.
Dealer may use Lead Data only to contact the consumer about the specific vehicle the consumer inquired about, and for the narrow operational purposes incidental to that contact (CRM entry, appointment scheduling, financing pre-qualification when initiated by the consumer).
Dealer will honor consumer opt-out, deletion, and Do-Not-Call / Do-Not-Text requests within 10 business days of receipt, whether received directly or forwarded from Differ-X. Dealer will treat a Global Privacy Control (GPC) signal forwarded by Differ-X as a valid CCPA/CPRA opt-out of sale/share.
Dealer represents that it will contact consumers only for the purpose of the specific vehicle inquiry and in compliance with the TCPA, CAN-SPAM, and state telemarketing laws. Dealer is solely responsible for its own compliance with these laws.
Dealer represents that it holds all required state motor vehicle dealer licenses and complies with the FTC CARS Rule, state auto-lead-generator regulations, and state advertising laws applicable to its sales activity.
Dealer will maintain commercially reasonable administrative, physical, and technical safeguards for Lead Data, including encryption in transit, access controls limited to personnel with a need-to-know, and prompt revocation of access for departing personnel.
Dealer will notify Differ-X at security@differ-x.com within 72 hours of confirming any security incident or unauthorized access affecting Differ-X-sourced Lead Data, and will cooperate with reasonable remediation requests.
Dealer may engage sub-processors (CRM vendors, dialers, etc.) to assist with the permitted use, provided each sub-processor is bound by written terms at least as protective as this DPA.
Dealer will maintain records of its processing activities sufficient to demonstrate compliance with this DPA and applicable law, and will make summary records available to Differ-X upon reasonable written request.
This DPA takes effect on Dealer's electronic acceptance and continues until terminated. Differ-X may suspend Dealer's access immediately for material breach. Either party may terminate on 30 days written notice. On termination, Dealer will cease processing Lead Data and, within 30 days, delete or return Lead Data except where retention is required by law.
Dealer will indemnify Differ-X against claims arising from Dealer's breach of this DPA, including TCPA, CCPA/CPRA, FTC CARS Rule, and state auto-lead-generator violations attributable to Dealer's processing.
This DPA is governed by the law of the State of Nevada, without regard to conflict-of-laws principles, except where mandatory consumer-protection law of the consumer's state of residence applies.