Data Processing Agreement

1. INTRODUCTION

This Data Processing Agreement (“DPA”) is incorporated into and forms part of the Road Rescue Network Terms of Use. It governs how Road Rescue Network (“Processor,” “we,” “us,” or “our”) processes personal data on behalf of customers and rescuers (“Controller,” “you,” or “your”).

By using our services, you agree to this DPA.

2. DEFINITIONS

• “Personal Data” means any information relating to an identified or identifiable natural person.
• “Processing” means any operation performed on personal data, including collection, storage, use, disclosure, or deletion.
• “Controller” means the party that determines the purposes and means of processing (customers and rescuers).
• “Processor” means Road Rescue Network, which processes personal data on behalf of the Controller.
• “Sub-Processor” means any third party engaged by Road Rescue Network to process personal data.

3. SCOPE OF PROCESSING

Road Rescue Network processes personal data only as necessary to:

• Provide and operate the Road Rescue Network platform
• Match customers with rescuers
• Process payments and maintain financial records
• Conduct background checks for rescuer onboarding
• Ensure safety, security, and fraud prevention
• Comply with applicable laws and regulatory requirements

Road Rescue Network will not process personal data for any purpose other than those documented in this DPA.

4. CONTROLLER RESPONSIBILITIES

As the Controller, you agree to:

• Provide only the personal data necessary for the Service
• Ensure that your instructions for processing are lawful
• Obtain all required consents from data subjects (customers, rescuers, applicants)
• Notify Road Rescue Network of any inaccuracies or changes in personal data

5. PROCESSOR RESPONSIBILITIES

Road Rescue Network agrees to:

• Process personal data only in accordance with this DPA and lawful instructions from the Controller
• Implement appropriate technical and organizational measures to protect personal data
• Ensure employees and contractors authorized to process personal data are bound by confidentiality obligations
• Notify the Controller without undue delay of any personal data breach
• Assist the Controller with data subject requests (access, correction, deletion, etc.)
• Assist the Controller in demonstrating compliance with GDPR, CCPA, and other applicable laws

6. SUB-PROCESSORS

Road Rescue Network may engage third-party service providers (payment processors, background check providers, hosting companies, SMS vendors, etc.) as Sub-Processors.

• Road Rescue Network remains fully responsible for the actions of Sub-Processors.
• A current list of Sub-Processors is available upon request.
• Controllers will be notified of any significant changes to Sub-Processors.

7. DATA TRANSFERS

Where personal data is transferred outside the United States, Road Rescue Network ensures adequate safeguards are in place, including Standard Contractual Clauses (SCCs) under GDPR.

8. DATA SECURITY

Road Rescue Network maintains industry-standard security measures, including:

• Encryption of personal data in transit and at rest
• Firewalls and access controls
• Role-based permissions for employees and contractors
• Ongoing monitoring and incident response procedures

9. DATA BREACH NOTIFICATION

In the event of a personal data breach, Road Rescue Network will:

• Notify the Controller without undue delay
• Provide relevant details of the breach (nature, scope, affected data, mitigation measures)
• Cooperate with investigations and regulatory reporting obligations

10. DATA SUBJECT RIGHTS

Road Rescue Network will support the Controller in responding to data subject requests, including:

• Access to personal data
• Correction of inaccurate information
• Deletion requests (right to be forgotten)
• Data portability requests
• Objection to certain processing activities

Requests must be submitted in writing to [email protected].

11. RETENTION & DELETION

Upon termination of services, Road Rescue Network will, at the Controller’s choice:

• Return all personal data, or
• Delete all personal data (unless retention is required by law, regulatory obligations, or safety concerns).

12. AUDITS & COMPLIANCE

Road Rescue Network will make available all necessary information to demonstrate compliance with this DPA and allow audits by the Controller or independent auditors, subject to reasonable notice and confidentiality obligations.

13. LIABILITY

Road Rescue Network’s liability under this DPA is limited to the maximum extent permitted under applicable law and consistent with the liability limits in the Terms of Use.

14. GOVERNING LAW

This DPA is governed by the laws of the state where the service is provided, with disputes resolved through binding arbitration in Montgomery County, Pennsylvania, as set forth in the Terms of Use.

15. CONTACT INFORMATION

Questions regarding this DPA should be directed to: Email: [email protected]