Data Processing Addendum

This Addendum forms part of the Terms of Service between MAP SENSE MEDIA CORP., a British Columbia corporation of 32835 South Fraser Way, Abbotsford, British Columbia (“Processor”), and the dealership using the service (“Controller”).

You are the controller of the photographs and personal information you upload. We process it only on your documented instructions — which, in the ordinary course, are the actions you take in the application and through the API.

Subject matter: replacement of photographic backgrounds and removal of distractions from vehicle photographs, and production of the accompanying integrity audit.

Duration: for as long as your account is active, plus the retention period set out in the Privacy Policy.

Nature and purpose: automated image processing, storage, and delivery.

Data subjects: your staff who hold accounts; and any individuals incidentally identifiable in uploaded photographs.

Categories of personal data: account email addresses; and personal information contained within photographs. The latter warrants specific attention: vehicle registration plates are deliberately preserved by the service rather than obscured, and photographs may also capture people, vehicles belonging to others, or documents in the background.

Special category data: none is required or requested. You must not upload photographs containing special category data.

• Process personal data only on your documented instructions.
• Ensure personnel with access are bound by confidentiality.
• Apply the technical and organisational measures described in the Security document.
• Not engage a new sub-processor without notice and the chance to object.
• Assist you, as far as reasonably possible, with data subject requests.
• Assist you with data protection impact assessments and consultations with regulators where the law requires.
• Delete or return personal data at the end of the engagement, as you elect.
• Make available the information needed to demonstrate compliance.

You confirm that:

• you have a lawful basis for the personal information contained in the photographs you upload, including any registration plates and any individuals visible in them;
• your instructions to us will not cause us to breach applicable data protection law; and
• you have given any notices and obtained any consents your own privacy obligations require.

You authorise the following sub-processors:

• OpenAI — image processing. Uploaded photographs are transmitted to OpenAI to generate the replacement background. Region: United States.
• Render — hosting and storage. Region: United States (Oregon).
• Supabase — authentication and account records. Region: United States.

We will give at least 30 days notice before adding or replacing a sub-processor. If you reasonably object on data protection grounds, you may terminate the affected service without penalty.

Processing takes place in the United States. Where you are established in Canada, the EU, or the UK, this is a cross-border transfer.

For Canadian controllers, we make this disclosure so you can meet your own transparency obligations under PIPEDA and, in British Columbia, PIPA — including telling your own customers and staff that their information may be stored and processed outside Canada and may be accessible to US authorities under US law.

For EU and UK controllers, transfers are made under the UK and EU Standard Contractual Clauses, incorporated by reference, with the transfer impact assessment available on request.

We will notify you without undue delay, and in any event within 72 hours of becoming aware of a personal data breach affecting your data. The notice will describe the nature of the breach, the categories and approximate volume of data affected, the likely consequences, and the measures taken or proposed.

On reasonable written notice, and no more than once per calendar year unless a regulator requires otherwise, we will make available information necessary to demonstrate compliance with this Addendum and allow for an audit conducted by you or a mutually agreed auditor, subject to confidentiality and to reasonable limits on disruption.

On termination you may request return or deletion of personal data. We will comply within 30 days except where law requires us to retain a copy, in which case we will tell you what is retained and why. Backups are overwritten on a rolling schedule.

Where this Addendum conflicts with the Terms of Service, this Addendum prevails in respect of the processing of personal data.