Data Processing Addendum

1. Roles

For personal information you or your users put into Parq.ai - staff names, carrier and driver contacts, sign-offs, and any personal information captured in condition evidence - you act as controller and ParkMyFleet LLC acts as processor. For our own business contacts, including demo enquiries, we act as controller under the Privacy Policy.

2. Subject matter and duration

We process customer personal information for the purpose of providing the Parq.ai platform, for the term of your subscription and for a commercially reasonable period after termination to allow export.

3. Processing on instruction

We process customer personal information only to provide and support the service, to keep it secure, and as otherwise instructed by you in writing. We will tell you if an instruction appears to conflict with applicable data protection law, and we will not use customer personal information to train general-purpose models.

4. Personnel and confidentiality

Access is limited to personnel who need it to deliver or support the service, each bound by confidentiality obligations and controlled by role-based permissions with audit logging.

5. Security measures

We maintain administrative, technical, and physical safeguards appropriate to the risk, including encryption, single sign-on, role-based access control, logging of record changes, monitoring, and backup and recovery procedures. Where a customer requires specific controls, certifications, or evidence, those are agreed in that customer’s contract. Documentation we hold is available to customers under NDA.

6. Subprocessors

We use subprocessors for infrastructure hosting, transactional email, error monitoring, and customer support tooling. Each is bound by data protection terms no less protective than this addendum. A current list is available on request, and we will give you notice before adding a new subprocessor so you can object on reasonable data protection grounds.

7. Data subject requests and assistance

The platform lets you access, correct, export, and delete records directly. Where a data subject contacts us instead of you, we will refer them to you and assist you in responding, taking into account the nature of the processing.

8. Security incidents

We will notify you without undue delay after confirming a security incident affecting your personal information, and in any case within the time applicable law requires, with the information reasonably available to help you meet your own notification duties. We will document what happened and what we did about it.

9. Audits

On reasonable notice, and no more than once a year unless a regulator requires otherwise or a security incident has occurred, we will make available the information reasonably necessary to demonstrate compliance with this addendum, including any current third-party audit report we hold.

10. United States processing

Customer personal information is stored and processed in the United States, by us and by our subprocessors. This addendum is written to the US state privacy laws that apply to our customers - including the CCPA as amended by the CPRA, where we act as a "service provider" and process personal information only for the business purposes you specify. We do not sell customer personal information, we do not share it for cross-context behavioral advertising, and we do not retain, use, or disclose it outside the direct business relationship with you.

11. Return and deletion

On termination we make customer personal information available for export and then delete or return it within a commercially reasonable period, except where law requires longer retention. Backups age out on their normal cycle.

12. Contact

Data protection enquiries: info@parkmyfleet.com, ParkMyFleet LLC, 8 The Green, STE A, Dover, DE 19901.