Data Processing Addendum

Effective Date: May 7, 2026

This Data Processing Addendum ("DPA") forms part of the Terms of Service between TowPin LLC ("TowPin," Processor) and Vendor (Controller). Capitalized terms not defined here have the meanings given in the Terms.

1. Definitions

"Personal Data," "Controller," "Processor," and "Processing" have the meanings given in applicable data protection law (including CCPA/CPRA and TDPSA where applicable). "Subprocessors" means the third parties listed in the Privacy Policy §4.

2. Subject Matter

TowPin processes Personal Data of Vendor's customers and drivers solely to operate the dispatch Service for the duration of the Terms.

3. Nature and Purpose of Processing

Operating the TowPin dispatch Service: job creation, SMS dispatch, driver-location sharing, and customer payment facilitation.

4. Categories of Data Subjects and Personal Data

Data subjects: Vendor's customers and drivers. Personal data: name, phone, address, GPS location, payment confirmation token.

5. Vendor (Controller) Obligations

Vendor is responsible for: lawful basis for processing, accuracy of data entered, and providing customer and driver notices required by law.

6. TowPin (Processor) Obligations

TowPin will: process only per Vendor's instructions; maintain confidentiality; implement appropriate security; assist with data subject rights requests; notify Vendor of any Personal Data breach within 72 hours of becoming aware.

7. Subprocessors

TowPin may use the subprocessors listed in the Privacy Policy §4. Vendor may object to a new subprocessor within 30 days of notice. If TowPin cannot accommodate the objection, Vendor may terminate for cause.

8. Security

TowPin implements encryption in transit (TLS) and at rest, role-based access control, and multi-factor authentication for personnel with access to Personal Data.

9. Data Subject Rights

TowPin will assist Vendor in responding to data subject rights requests within 45 days.

10. Return or Deletion

Upon termination of the Terms, TowPin will delete or return Personal Data within 90 days at Vendor's election.

11. Liability

Liability is capped per the Terms §11. This DPA controls in any conflict with the Terms on data-protection topics.

Questions: privacy@towpin.net