Data Processing Addendum

This Data Processing Addendum ("DPA") is entered into between Truck Hero LLC ("Truck Hero") and the customer that accepts the Truck Hero Terms and Conditions ("Customer"). This DPA forms part of, and is incorporated into, the Terms and Conditions between Truck Hero and Customer (the "Terms").

Acceptance. Customer accepts this DPA at Account Setup through a separate, affirmative acknowledgement that is not pre-checked. If the individual completing Account Setup accepts the Terms on behalf of Customer, that acceptance also binds Customer to this DPA.

1. Scope and Order of Precedence

This DPA applies to Personal Data processed by Truck Hero on behalf of Customer in connection with the Services, including the Truck Hero web application, Hero Connect, Repair Explainer customer-facing services, secure links, SMS and email delivery, repair timelines and milestone tracking, workflow execution, support, administration, security, analytics, and related service operations.

This DPA supplements the Terms. If there is a conflict between this DPA and the Terms solely with respect to the processing of Personal Data, this DPA controls to the extent of that conflict. Otherwise, the Terms remain in full force.

This DPA is intended to satisfy applicable contractual requirements governing processor, service provider, and contractor relationships under U.S. privacy laws, including, where applicable, the Texas Data Privacy and Security Act and the California Consumer Privacy Act, as amended by the California Privacy Rights Act.

2. Definitions

"Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with a party.

"Applicable Privacy Law" means any U.S. federal, state, or local law applicable to the processing of Personal Data under the Terms, including to the extent applicable the Texas Data Privacy and Security Act, the California Consumer Privacy Act, and the California Privacy Rights Act.

"Controller" / "Business" means the person or entity that, alone or jointly with others, determines the purposes and means of processing Personal Data, or the analogous term under Applicable Privacy Law.

"Processor" / "Service Provider" / "Contractor" means the person or entity that processes Personal Data on behalf of a Controller or Business, or the analogous term under Applicable Privacy Law.

"Personal Data" means personal information, personal data, or other equivalent term under Applicable Privacy Law that Truck Hero processes on behalf of Customer under the Terms. Personal Data does not include deidentified, anonymized, or aggregated information to the extent such information no longer constitutes personal data under Applicable Privacy Law.

"Process" / "Processing" means any operation performed on Personal Data, whether or not by automated means, including access, collection, storage, use, organization, transmission, disclosure, analysis, combination, deletion, and destruction.

"Security Incident" means a confirmed unauthorized acquisition of, or unauthorized access, use, disclosure, alteration, or destruction of, Personal Data in Truck Hero's possession or control. Security Incident does not include unsuccessful attempts or activities that do not compromise the security of Personal Data, such as pings, scans, denied login attempts, or other unsuccessful attacks.

3. Roles of the Parties

Customer is the Controller or Business for Personal Data processed under the Terms, except to the extent Customer and a third party agree otherwise outside of Truck Hero's control.

Truck Hero acts as Customer's Processor, Service Provider, and/or Contractor, as applicable, when processing Personal Data on behalf of Customer under the Terms and this DPA.

Customer acknowledges and agrees that certain components of the Services, including Hero Connect and related operational or support functions, may be provided, operated, hosted, or supported by Truck Hero directly and/or through one or more Affiliates, including Hero Group LLC. Hero Group LLC is an authorized Affiliate subprocessor under this DPA.

Hero Group LLC may provide customer-facing components under the Repair Explainer assumed name. Repair Explainer is not a separate legal entity and does not alter the parties’ respective roles under this DPA. Truck Hero remains Customer’s Processor, Service Provider, and/or Contractor, and Hero Group LLC remains an authorized Affiliate subprocessor.

4. Customer Instructions and Scope of Processing

Truck Hero shall process Personal Data as set forth in the Terms, this DPA, Customer's account configuration, Customer's administrative settings, Customer's support requests, Customer's use of Hero Connect, and Customer's other documented instructions that are consistent with the Terms and the nature of the Services.

Customer instructs Truck Hero to process Personal Data as reasonably necessary to provide, secure, support, maintain, improve, and administer the Services; to perform workflow execution requested or enabled by Customer; to host, transmit, and store Personal Data; to authenticate users; to generate outputs and perform workflow actions directed or authorized by Customer; to detect and prevent fraud, abuse, misuse, and security incidents; to perform internal quality assurance and troubleshooting; and to comply with applicable law.

Customer is solely responsible for the lawfulness, accuracy, quality, and appropriateness of the Personal Data it submits to the Services, provides through connected systems, makes available through Hero Connect, or otherwise instructs Truck Hero to process.

Customer further instructs Truck Hero and its authorized subprocessors to generate and display Repair Explainers; create secure links; associate content with the applicable recipient and repair; send links and related communications by SMS or email; maintain repair timelines and milestones; process repair-status, appointment, approval, delay, completion, and pickup updates; process delivery and failure events; record secure-link access; process STOP, HELP, and other preference requests; maintain suppression records; and maintain authorization evidence where provided by Customer.

5. Customer Obligations

Customer represents and warrants that it has provided all notices, obtained all rights, consents, authorizations, and permissions, and established all lawful bases necessary for Truck Hero to process Personal Data as contemplated by the Terms, this DPA, Customer's configuration of the Services, and Customer's use of Hero Connect.

Customer is solely responsible for responding to requests from individuals exercising rights under Applicable Privacy Law, except to the extent Truck Hero is required to assist Customer as described in this DPA.

Customer will not instruct Truck Hero to process Personal Data in violation of Applicable Privacy Law.

Customer is responsible for providing any required employee, contractor, or workplace notices in connection with Hero Connect, device-side activity, screenshots, transcripts, local file access, browser or application interaction, or related monitoring or workflow activity authorized by Customer.

Customer represents and warrants that it has implemented and will maintain a documented workflow reasonably designed to provide legally required notices and obtain, record, and retain all authorizations, consents, permissions, and lawful bases required before Personal Data, including a mobile number or email address, is used to deliver a Repair Explainer or related repair communication. Customer will associate authorization with the correct recipient and contact information, maintain evidence of the date, method, and scope of authorization, provide accurate recipient and repair-status information, keep communication preferences current, promptly report withdrawals received outside the Services, honor suppression records, and not use repair communications for unauthorized marketing.

6. Truck Hero Personnel Confidentiality and Access Controls

Truck Hero shall ensure that personnel authorized to process Personal Data are subject to appropriate confidentiality obligations and receive access to Personal Data only to the extent reasonably necessary for their roles.

Truck Hero shall maintain administrative, technical, and physical safeguards designed to protect Personal Data against unauthorized or unlawful access, destruction, loss, alteration, disclosure, or misuse, taking into account the nature of the Personal Data and the Services. A summary of Truck Hero's baseline safeguards is set forth in Schedule 2.

7. Security Incident Response

If Truck Hero becomes aware of a Security Incident, Truck Hero shall notify Customer without undue delay and shall provide information reasonably available to Truck Hero regarding the nature of the Security Incident, the affected categories of Personal Data, the measures taken or proposed to address the Security Incident, and steps Customer may consider taking to mitigate potential adverse effects.

Truck Hero shall take reasonable steps to contain, investigate, remediate, and document the Security Incident and shall reasonably cooperate with Customer in connection with Customer's compliance obligations arising from the Security Incident.

Truck Hero's notification of a Security Incident is not an admission of fault or liability.

8. Assistance with Consumer and Data Subject Requests

Taking into account the nature of the processing and the information available to Truck Hero, Truck Hero shall provide commercially reasonable assistance to Customer in responding to verifiable consumer or data subject requests relating to access, deletion, correction, portability, appeal, opt-out, or other rights under Applicable Privacy Law, to the extent Customer cannot reasonably fulfill the request without Truck Hero's assistance.

If Truck Hero receives a request directly from an individual relating to Personal Data processed on behalf of Customer, Truck Hero may direct the individual to Customer and is not required to respond to the request except as required by law or as instructed by Customer. If Truck Hero is legally required to respond directly, Truck Hero shall, to the extent legally permitted, notify Customer.

Assistance may include communication-preference requests, SMS opt-outs, suppression requests, correction of recipient contact information, and Repair Explainer access or deletion requests. Customer remains responsible for the accuracy of the underlying estimate, repair, timeline, milestone, and status records.

9. Assistance with Assessments and Compliance

Taking into account the nature of the processing and the information available to Truck Hero, Truck Hero shall provide commercially reasonable assistance to Customer in meeting Customer's obligations under Applicable Privacy Law with respect to security measures, Security Incident response, required privacy assessments, and prior consultations with regulators, where applicable and to the extent Customer cannot reasonably fulfill such obligations without Truck Hero's assistance.

Truck Hero may satisfy its obligations under this Section by providing documentation, summaries, white papers, responses to reasonable questionnaires, or other materials describing relevant safeguards and practices.

10. Subprocessors and Affiliates

Customer grants Truck Hero a general authorization to engage Affiliates and third-party subprocessors to assist in providing the Services. Truck Hero shall remain responsible for the acts and omissions of its subprocessors to the extent required by Applicable Privacy Law and the Terms.

Truck Hero shall impose written data protection obligations on each subprocessor that are no less protective than the obligations applicable to Truck Hero under this DPA, as appropriate to the nature of the services provided by the subprocessor, including obligations relating to confidentiality, security, restricted processing, and deletion or return of Personal Data where appropriate.

Hero Group LLC is expressly authorized as an Affiliate subprocessor and internal service provider for purposes that may include operation or support of Hero Connect, customer support, platform operations, service administration, development support, security functions, compliance functions, operation or support of Repair Explainer, customer-facing hosting, secure links, repair timelines and tracking, SMS and email communications, delivery and access analytics, authorization, preference, and suppression processing, customer support, platform operations, service administration, development support, security functions, compliance functions, and related internal operational support.

Upon Customer's reasonable written request, Truck Hero shall make available current information regarding its material subprocessors that process Personal Data on behalf of Customer in connection with the Services. Truck Hero may satisfy this obligation by providing a list, notice, or other written disclosure identifying such subprocessors.

If Truck Hero engages a new material subprocessor that will materially change the categories of recipients or nature of processing described in this DPA, Truck Hero shall provide commercially reasonable notice to Customer, which may be provided by email, in-product notice, or updated documentation. If Customer reasonably objects on documented privacy or security grounds, the parties shall discuss the objection in good faith. If the parties cannot reasonably resolve the objection, Truck Hero may, at its option, provide the affected functionality without use of the objected-to subprocessor, recommend a reasonable alternative configuration, or permit Customer to discontinue the affected functionality or terminate the affected Services in accordance with the Terms.

11. Audits and Demonstration of Compliance

Upon Customer's reasonable written request, and no more than once in any rolling twelve-month period unless required by Applicable Privacy Law or following a confirmed Security Incident, Truck Hero shall make available information reasonably necessary to demonstrate Truck Hero's compliance with this DPA.

Where the information made available by Truck Hero is not reasonably sufficient for Customer to demonstrate compliance under Applicable Privacy Law, Customer may request a reasonable audit by Customer or an independent auditor bound by confidentiality obligations, during normal business hours, on reasonable advance written notice, and in a manner that does not unreasonably interfere with Truck Hero's operations, compromise security, or expose the Personal Data of other customers.

Customer shall bear its own costs for any audit and shall reimburse Truck Hero for Truck Hero's reasonable costs incurred in supporting any onsite audit or audit materially beyond standard diligence requests, unless the audit reveals a material breach of this DPA by Truck Hero.

12. Deletion, Return, and Retention

Upon termination or expiration of the Terms, Truck Hero shall, upon Customer's written request, delete Customer Personal Data from Truck Hero's active systems and backups within thirty (30) days, unless a longer retention period is required by applicable law or expressly permitted by the Terms, this DPA, or Customer's written instructions.

If Customer does not request deletion, Truck Hero may retain Customer Personal Data for up to one (1) year after termination for purposes reasonably related to service continuity, account reactivation, dispute resolution, recordkeeping, security, or compliance, after which Truck Hero may delete such data in accordance with its retention practices.

Notwithstanding the foregoing, Truck Hero may retain audit logs, fraud-prevention data, billing records, security records, legal-hold materials, and other records required for legal compliance, dispute resolution, or protection of the Services, provided such retained data remains subject to applicable confidentiality and security protections.

To the extent technically feasible and requested by Customer, Truck Hero shall provide commercially reasonable assistance with export of Customer Personal Data before deletion.

Authorization, consent, opt-out, suppression, complaint, security, and communications-compliance records may be retained where reasonably necessary to demonstrate compliance, prevent future unwanted messages, resolve complaints or disputes, defend claims, or maintain system integrity, subject to applicable confidentiality and security protections.

13. Service Provider / Contractor Terms for California

To the extent the California Consumer Privacy Act, as amended, applies to the processing of Personal Data under the Terms, the parties agree that Customer is a Business and Truck Hero is a Service Provider and/or Contractor with respect to Personal Data processed by Truck Hero on behalf of Customer.

Truck Hero shall not sell or share Personal Data received from or on behalf of Customer. Truck Hero shall not retain, use, or disclose Personal Data: (a) for any purpose other than the limited and specified purposes set forth in the Terms and this DPA, including the business purposes and operational purposes reasonably necessary to provide the Services; (b) outside of the direct business relationship between Customer and Truck Hero; or (c) except as otherwise permitted by the CCPA.

Truck Hero shall provide the same level of privacy protection required by the CCPA and shall notify Customer if Truck Hero determines it can no longer meet its obligations under the CCPA. Customer has the right, upon notice, to take reasonable and appropriate steps to help ensure that Truck Hero uses Personal Data in a manner consistent with Customer's obligations under the CCPA and to stop and remediate unauthorized use of Personal Data.

Truck Hero certifies that it understands the restrictions set forth in this Section and will comply with them.

Truck Hero shall not combine Personal Data received from or on behalf of Customer with personal information received from another source, except as permitted by the CCPA.

14. Texas and Other State Processor Terms

To the extent the Texas Data Privacy and Security Act or another Applicable Privacy Law imposes processor obligations on Truck Hero, Truck Hero shall process Personal Data in accordance with Customer's instructions, implement appropriate technical and organizational measures, ensure each person processing Personal Data is subject to a duty of confidentiality, assist Customer in meeting applicable obligations, delete or return Personal Data at Customer's direction as provided in this DPA, make available information reasonably necessary to demonstrate compliance, and ensure any subcontractor is bound by an appropriate written contract.

Customer acknowledges that some obligations imposed by Applicable Privacy Law depend on the nature of Customer's business, Customer's role with respect to the Personal Data, and Customer's own policies and notices, all of which remain Customer's responsibility.

15. Cross-Border Processing

The Services are primarily designed and offered as a U.S.-focused service. Customer acknowledges and agrees that Truck Hero, Hero Group LLC, and authorized subprocessors may process Personal Data in the United States.

Truck Hero will not intentionally move Customer Personal Data to a jurisdiction outside the United States solely for routine service delivery unless doing so is reasonably necessary for support, security, infrastructure, continuity, subprocessor operations, legal compliance, or another legitimate purpose consistent with this DPA and Applicable Privacy Law.

If Truck Hero or an authorized subprocessor processes Customer Personal Data outside the United States, Truck Hero shall ensure that such processing remains subject to appropriate contractual, technical, and organizational protections reasonably designed to protect Personal Data in a manner consistent with this DPA and Applicable Privacy Law.

If the parties determine that an additional transfer mechanism is legally required for a specific processing activity, the parties shall cooperate in good faith to implement a reasonable supplemental transfer mechanism appropriate to the circumstances.

16. AI and Processing Boundaries

Customer acknowledges that Personal Data may be processed by the Services for storage, transmission, authentication, workflow execution, logging, security, troubleshooting, billing, customer support, analytics, administration, and other non-AI operational purposes consistent with the Terms, this DPA, and Customer's instructions.

For estimate-related AI processing within the Services, Truck Hero's processing design is that personal information appearing on estimates is excluded from AI model inputs. This excluded estimate-level personal information includes customer name, home or mailing address, phone number, email address, driver's license number, date of birth, payment card information, banking information, insurance policy number, and claim number when tied to a specific person. Features that use AI outside of estimate-related processing, such as conversational assistance, communications drafting, and voice features, may process Personal Data that Customer or its users choose to submit to those features, in accordance with Customer's instructions and this DPA.

Nothing in this Section limits Truck Hero's ability to process Personal Data for non-AI operational purposes otherwise permitted by the Terms, this DPA, or Customer's instructions, including storage, workflow execution, credential use, logging, security, troubleshooting, support, billing, and compliance functions.

Customer remains responsible for determining whether its use of AI-enabled features is appropriate for its business, regulatory obligations, customer communications, insurer interactions, and internal workflows. Customer also remains responsible for reviewing outputs except to the extent Customer affirmatively enables automation, in which case Customer accepts responsibility for outputs and actions taken on its behalf as set forth in the Terms.

Truck Hero may change models, model providers, prompts, routing logic, or related AI-enabled processing components from time to time in order to provide, maintain, improve, secure, or support the Services, provided that such changes remain subject to this DPA and Applicable Privacy Law.

17. Liability, Term, and Miscellaneous

The limitations of liability, exclusions, disclaimers, dispute-resolution terms, and other relevant provisions of the Terms apply to this DPA unless Applicable Privacy Law requires otherwise.

This DPA remains in effect for so long as Truck Hero processes Personal Data on behalf of Customer under the Terms.

Any notices under this DPA may be provided to support@truckhero.ai, with a copy to the notice address identified in the Terms, unless Truck Hero updates its notice information in accordance with the Terms.

Truck Hero may update this DPA from time to time to reflect changes in the Services, Affiliates, subprocessors, applicable law, or processing practices. Any update that materially reduces Customer's privacy protections or materially expands the permitted scope of processing shall not take effect for Customer until the updated DPA is presented through an updated acceptance flow, written amendment, or another legally sufficient notice-and-consent mechanism if required by Applicable Privacy Law. Non-material updates may take effect as provided in the Terms or by posting updated documentation.

Except as expressly modified by this DPA, the Terms remain in full force and effect.

Schedule 1 — Details of Processing

Schedule 2 — Baseline Security Measures

Access controls, role-based permissions, and account-management processes designed to limit access to Personal Data to authorized personnel with a legitimate business need;

Authentication measures reasonably designed to protect user and administrative accounts, including password and session controls and multi-factor authentication for appropriate administrative access;

Confidentiality obligations for personnel authorized to access Personal Data;

Encryption of Personal Data in transit over public networks and encryption of Personal Data at rest in production systems;

Logging, monitoring, alerting, and troubleshooting practices reasonably designed to support system integrity, incident detection, investigation, and service reliability;

Change-management, backup, restoration, and resiliency practices reasonably designed to support continuity of the Services and recovery from operational disruption;

Vulnerability-management, patching, and security-maintenance practices reasonably designed to identify, assess, and address material security risks in systems used to provide the Services;

Vendor and subprocessor management practices reasonably designed to impose appropriate privacy and security obligations in light of the services provided;

Incident-response processes reasonably designed to identify, contain, investigate, remediate, document, and communicate Security Incidents;

Measures reasonably tailored to Hero Connect and related device-side activity, including controls around session artifacts, screenshots, transcripts, operational logs, and authorized workflow execution; and

Application of these safeguards, as appropriate, to Repair Explainer-hosted pages, secure links, SMS and email records, authorization and suppression records, repair timelines, milestones, and status data.

Execution and Incorporation

This DPA does not require a wet signature unless Truck Hero and Customer separately agree otherwise. Where Customer accepts the Terms through Truck Hero’s account setup flow, this DPA becomes binding on Customer as described above and remains incorporated into the Terms.