LEMON LAW LOGIC (LLL) DATA PRIVACY AGREEMENT & DATA PROCESSING ADDENDUM

Last Updated: September 30, 2026 Document Version: 2.4.0

This Data Privacy Agreement and Data Processing Addendum ("DPA" or "Agreement") is entered into by and between Lemon Law Logic, Inc. ("LLL", "Processor", or "Service Provider") and the automotive original equipment manufacturer ("OEM"), brand division, authorized dealership group, or defense litigation law firm agreeing to these terms ("Customer", "Controller", or "Business").

This DPA supplements and forms an integral part of the Lemon Law Logic Enterprise End User License Agreement ("EULA") or other master services agreement governing Customer's access to and use of the Lemon Law Logic cloud platform and services (the "Principal Agreement").

1. PREAMBLE & REGULATORY CONTEXT

1.1 Purpose: The Lemon Law Logic platform processes warranty defense records, dealership repair orders, connected vehicle telematics snapshots, consumer lemon law arbitration filings, attorney demand letters, and litigation dockets. This DPA governs the collection, storage, transfer, and processing of Personal Data in compliance with applicable Privacy Laws.

1.2 Roles of the Parties: * Customer is a Data Controller (and a "Business" under the California Consumer Privacy Act as amended by the California Privacy Rights Act, "CCPA/CPRA") with respect to Customer Personal Data. * LLL is a Data Processor (and a "Service Provider" under CCPA/CPRA) acting solely on behalf of, and pursuant to the documented instructions of, Customer.

1.3 Precedence: In the event of any direct conflict between the terms of this DPA and the Principal Agreement, the terms of this DPA shall control with respect to the protection and processing of Personal Data.

2. DEFINITIONS

* "Applicable Privacy Laws" means all federal, state, and international privacy, data protection, and cybersecurity laws and regulations applicable to the processing of Personal Data under this Agreement, including without limitation: 1. The California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (Cal. Civ. Code § 1798.100 et seq., "CCPA/CPRA"); 2. The Illinois Personal Information Protection Act (815 ILCS 530/, "PIPA") and the Illinois Biometric Information Privacy Act (740 ILCS 14/, "BIPA"); 3. Comprehensive state consumer data privacy statutes enacted in Virginia, Colorado, Connecticut, Utah, Texas, Florida, and other applicable U.S. jurisdictions; 4. The European Union General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the UK Data Protection Act 2018 (where applicable to multinational OEM corporate groups); 5. Applicable federal laws governing automotive telematics and warranty records. * "Customer Personal Data" means any Personal Data provided, uploaded, or transmitted to the Platform by or on behalf of Customer, including vehicle owner and lessee records, dealer repair orders, warranty dispute files, and associated vehicle telematics. * "Data Subject" means an identified or identifiable natural person to whom Personal Data relates, including vehicle purchasers, lessees, claimants, dealership technicians, and legal representatives. * "Personal Data" means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer, household, or vehicle owner, as defined under Applicable Privacy Laws. * "Personal Data Breach" means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data in the custody or control of LLL. * "Sub-processor" means any third-party infrastructure provider, cloud hosting vendor, or data processing service engaged by LLL to assist in performing processing activities on behalf of Customer.

3. SCOPE & DETAILS OF PROCESSING

3.1 Subject Matter: The subject matter of the data processing is the provision of the Lemon Law Logic cloud platform, early service bay defect intercept analysis, living case timeline generation, statutory rules evaluations, and warranty dispute resolution workflows.

3.2 Duration: The processing of Customer Personal Data shall continue for the duration of the Principal Agreement, plus the post-termination retention window specified in Section 11 of this DPA.

3.3 Categories of Data Subjects: 1. Vehicle purchasers, lessees, co-signers, and secondary drivers; 2. Warranty claimants and legal dispute representatives; 3. In-house legal counsel, retained defense attorneys, and claims managers; 4. Dealership service advisors, certified technicians, and dealership personnel named on repair orders.

3.4 Categories of Personal Data Processed: 1. Consumer Identifiers: Full names, mailing addresses, residential addresses, telephone numbers, and email addresses. 2. Vehicle Identifiers: Vehicle Identification Numbers (VINs), license plate numbers, vehicle registration certificates, and odometer milestones. 3. Financial & Contractual Records: Vehicle purchase prices, down payments, finance charges, monthly lease amounts, lease inception dates, payoff quotes, and statutory mileage offset deductions. 4. Service & Defect History: Dealership repair order (RO) numbers, technician diagnostic notes, customer verbatim complaint descriptions, parts replacement invoices, loaner vehicle rental agreements, and days out of service. 5. Diagnostic Telematics: Diagnostic Trouble Codes (DTCs), electronic control unit (ECU) freeze-frame logs, high-voltage battery cell isolation records, thermal warning triggers, and shock sensor spikes. 6. Dispute & Legal Dockets: Court case captions, filing dates, docket numbers, attorney demand letters, and settlement release agreements.

4. PROCESSOR OBLIGATIONS & CCPA SERVICE PROVIDER CERTIFICATION

4.1 Documented Instructions: LLL shall process Customer Personal Data strictly in accordance with Customer's documented instructions, including as set forth in the Principal Agreement, this DPA, and any applicable Order Form, unless required to do so by applicable law.

4.2 CCPA/CPRA Service Provider Terms & Restrictions: LLL explicitly certifies that it acts as a Service Provider with respect to Customer Personal Data under the CCPA/CPRA and agrees that: 1. No Sale: LLL does not and shall not "sell" Customer Personal Data (as the term "sell" is defined in Cal. Civ. Code § 1798.140(ad)); 2. No Sharing: LLL does not and shall not "share" Customer Personal Data for cross-context behavioral advertising (as defined in Cal. Civ. Code § 1798.140(ah)); 3. Strict Business Purpose: LLL shall not retain, use, or disclose Customer Personal Data for any purpose other than the specific business purposes specified in the Principal Agreement and this DPA, or as otherwise permitted by the CCPA/CPRA; 4. No Commercial Use Outside the Relationship: LLL shall not retain, use, or disclose Customer Personal Data outside of the direct commercial relationship between LLL and Customer; 5. No Cross-Customer Data Combining: LLL shall not combine Customer Personal Data with Personal Data received from or on behalf of any other customer, person, or entity, except to the minimal extent permitted by applicable regulations to detect security incidents or protect against fraudulent activity.

4.3 Compliance Certification: LLL certifies that it understands the restrictions in Section 4.2 and shall comply with all applicable provisions of the CCPA/CPRA. If LLL determines that it can no longer meet its obligations under Applicable Privacy Laws, it shall promptly notify Customer.

4.4 Customer Verification & Remediation: Customer has the right to take reasonable and appropriate steps to ensure that LLL uses Customer Personal Data in a manner consistent with Customer's obligations under Applicable Privacy Laws. Upon written notice, Customer may request reasonable evidence of compliance, and LLL shall remediate any unauthorized processing promptly.

5. BIOMETRIC INFORMATION & SYNTHETIC VOICE SAFEGUARDS

5.1 No Biometric Data Collection: LLL does not collect, capture, purchase, receive through trade, or otherwise obtain biometric identifiers or biometric information (as defined under the Illinois Biometric Information Privacy Act, 740 ILCS 14/10 ("BIPA"), or other state biometric privacy statutes) from Customer, vehicle owners, or claimants.

5.2 Synthetic Text-to-Speech Architecture: The Platform provides algorithmic text-to-speech audio playback and timeline narration. Customer acknowledges and LLL warrants that: 1. All narrative audio playback streams are generated strictly through licensed algorithmic neural text-to-speech synthesizers operating from written case transcripts; 2. The Platform does not process, record, analyze, or extract biometric voiceprints, vocal frequencies, or biometric templates of any human individual; 3. No consumer telephone audio or recorded voice calls are converted into biometric voice identifiers.

6. MULTI-TENANT ISOLATION & TECHNICAL BOUNDARIES

6.1 Strict Tenant Segregation: LLL maintains strict logical and cryptographic separation of Customer Personal Data across its multi-tenant cloud architecture. Customer Personal Data is tagged with Customer's unique tenant identifier and protected by database-level Row Level Security (RLS) enforcement policies.

6.2 Zero Cross-Tenant Leakage: LLL warrants that its system architecture prevents Customer Personal Data from being accessed, queried, exposed, or co-mingled with records belonging to any other automotive manufacturer, competitive distributor, or unrelated licensee.

6.3 Access Control & Principle of Least Privilege: Access to Customer Personal Data by LLL personnel is strictly restricted to authorized engineering and technical support personnel who have a documented operational need to know (such as troubleshooting verified ingestion errors or executing authorized batch transformations).

7. TECHNICAL & ORGANIZATIONAL SECURITY MEASURES

7.1 Security Standard: LLL shall implement and maintain appropriate administrative, physical, and technical safeguards designed to protect Customer Personal Data against accidental, unauthorized, or unlawful destruction, loss, alteration, disclosure, or access.

7.2 Core Safeguards Implemented: * Encryption in Transit: All data transmitted over public networks between Customer, dealership endpoints, court docket integrations, and the Platform is encrypted using modern TLS (TLS 1.2 or TLS 1.3) protocols. * Encryption at Rest: All databases, file storage volumes, evidence documents, and backup archives containing Customer Personal Data are encrypted at rest using AES-256 or equivalent cryptographic standards. * Role-Based Access Control (RBAC): Fine-grained access privileges governing administrative, case manager, counsel, and defense specialist roles. * Audit Logging: Comprehensive, tamper-evident audit logs recording user access, document downloads, statutory recalculations, and administrative modifications. * Vulnerability Management: Periodic automated dependency audits, code security linting passes, and container vulnerability scanning.

8. SUB-PROCESSORS

8.1 Authorized Sub-processors: Customer grants general authorization to LLL to engage Sub-processors to support Platform infrastructure, cloud hosting, and data transmission. LLL's currently approved infrastructure Sub-processors include: * Google Cloud Platform (Cloud infrastructure, database hosting, managed storage, and speech synthesis services, us-central1 region); * Keycloak Identity Foundation (Authentication, token issuance, and enterprise SSO integration).

8.2 Sub-processor Requirements: LLL shall: 1. Impose data protection terms on each Sub-processor that are substantially similar to and no less protective than those set forth in this DPA; 2. Remain fully liable to Customer for the performance of each Sub-processor's data protection obligations.

8.3 Notification of Sub-processor Changes: LLL shall notify Customer at least thirty (30) days in advance of adding or replacing any infrastructure Sub-processor. Customer may object in writing on reasonable data protection grounds within fifteen (15) days of such notice. If Customer objects and the parties cannot resolve the concern, Customer may terminate the affected service tier without penalty.

9. DATA SUBJECT RIGHTS ASSISTANCE

9.1 Cooperation on Consumer Inquiries: Taking into account the nature of the processing, LLL shall provide reasonable assistance to Customer to enable Customer to respond to requests from Data Subjects exercising their rights under Applicable Privacy Laws (including rights of access, correction, deletion, and portability).

9.2 Direct Inquiries Received by LLL: If LLL receives a request directly from a vehicle owner, claimant, or Data Subject regarding Customer Personal Data, LLL shall not respond directly to that Data Subject (except to advise them that the request relates to Customer) and shall promptly redirect the request to Customer within three (3) business days.

9.3 Deletion & Rectification Execution: Upon written instruction from Customer, LLL shall promptly delete, redact, or correct identified Customer Personal Data across its active databases and indexing tables within the timeframes mandated by Applicable Privacy Laws.

10. PERSONAL DATA BREACH NOTIFICATION

10.1 Notification Timeline: In the event of a confirmed Personal Data Breach impacting Customer Personal Data, LLL shall notify Customer in writing without unreasonable delay, and in all events within forty-eight (48) hours of becoming aware of the breach.

10.2 Content of Notification: The breach notification shall contain, to the extent known at the time of reporting: 1. A description of the nature of the incident, including the categories and approximate number of Data Subjects and records affected; 2. The identity of the affected tenant environment; 3. The likely consequences and potential risks of the incident; 4. The immediate mitigation and containment measures taken or planned by LLL; 5. The contact details of LLL's designated security or privacy officer.

10.3 Investigation & Remediation: LLL shall take prompt and appropriate remedial measures to contain and mitigate the effects of any Personal Data Breach, preserve relevant forensic evidence, and provide reasonable cooperation to Customer in satisfying its statutory breach disclosure obligations.

11. DATA RETURN, PORTABILITY & DELETION

11.1 Return of Customer Data: Upon expiration or termination of the Principal Agreement, LLL shall provide Customer with a period of thirty (30) calendar days to export all Customer Personal Data in standard structured formats (CSV, JSON, and original uploaded PDF evidence documents).

11.2 Secure Cryptographic Erasure: Following the thirty-day post-termination window, LLL shall securely de-provision Customer's tenant partition and cryptographically overwrite or delete all copies of Customer Personal Data residing on active LLL servers, storage volumes, and database records, except to the extent that retention is strictly required by applicable law, statutory audit rules, or legitimate litigation holds. Any retained data shall remain subject to the confidentiality and security protections of this DPA.

12. AUDIT RIGHTS & COMPLIANCE VERIFICATION

12.1 Audit Information: Upon Customer's written request (no more than once per twelve-month calendar period), LLL shall provide reasonable documentation, summaries of third-party security audits (e.g., SOC 2 Type II reports, penetration testing summaries), and written questionnaire responses to confirm LLL's compliance with this DPA.

12.2 On-Site Inspection: If Customer reasonably demonstrates that written documentation is insufficient to verify compliance following a material Personal Data Breach, Customer (or an independent, mutually agreed-upon third-party auditor bound by strict confidentiality) may conduct a targeted inspection of LLL's operating procedures during normal business hours, subject to reasonable advance notice (at least thirty days) and strict security restrictions to ensure no disruption of LLL systems or access to other tenants' data.

13. INTERNATIONAL DATA TRANSFERS

13.1 Primary Processing Location: Customer Personal Data is primarily hosted and processed within cloud data centers located in the United States (us-central1 and associated domestic availability zones).

13.2 Cross-Border Transfers: To the extent Customer transmits Personal Data originating from the European Economic Area, Switzerland, or the United Kingdom, the parties agree that the Standard Contractual Clauses (SCCs) approved by the European Commission (Module 2: Controller-to-Processor) shall be deemed incorporated by reference and executed between the parties.

14. GOVERNING LAW & JURISDICTION

14.1 Governing Law: This DPA, and any non-contractual obligations arising out of or in connection with it, shall be governed by and construed in accordance with the substantive internal laws of the State of Illinois, without giving effect to any choice of law or conflict of laws principles that would cause the application of the laws of any other jurisdiction.

14.2 Dispute Resolution: Any dispute, controversy, or claim arising under, out of, or in relation to this DPA shall be resolved in accordance with the dispute resolution and binding JAMS arbitration procedures set forth in Section 14 of the Principal Agreement, seated in Chicago, Illinois (or conducted virtually by mutual agreement).

15. GENERAL PROVISIONS

15.1 Severability: If any individual clause or provision of this DPA is determined to be invalid, illegal, or unenforceable by an arbitrator or court of competent jurisdiction, such invalidity shall not affect the validity of the remaining provisions, which shall continue in full legal force and effect.

15.2 Amendments: Any modification or amendment of this DPA must be in writing and signed by authorized representatives of both parties.

15.3 Contact Information: * For Licensor / Processor: Lemon Law Logic, Inc. Attn: Privacy & Data Protection Officer Email: privacy@lemonlawlogic.com Physical Address: Lemon Law Logic Corporate Legal, Chicago, IL * For Customer / Controller: To the primary privacy, legal, or compliance contact designated in Customer's administrative tenant profile or Order Form.

*IN WITNESS WHEREOF, the parties have executed and agreed to this Data Privacy Agreement as of the date of Customer's acceptance or initial access to the Platform.*