This Data Transfer Addendum governs certain transfers of personal information from BHPH Success to participating vendors when each party acts independently with respect to the personal information it receives or processes.
This Data Transfer Addendum, or "DTA," is entered into between [INSERT LEGAL OPERATING ENTITY], operating as BHPH Success, and the vendor, service provider, technology company, consultant, advertiser, or other marketplace participant receiving Personal Data from BHPH Success, referred to in this Addendum as "Vendor."
This DTA is incorporated into the BHPH Success General Vendor Terms and any other agreement under which BHPH Success transfers Personal Data to Vendor in circumstances where BHPH Success and Vendor each independently determine the purposes and means of processing that Personal Data.
This DTA is intended primarily for controller-to-controller or business-to-business transfers of personal information. It is separate from the BHPH Success Data Processing Addendum, which applies when one party processes personal information on behalf of the other.
This DTA applies when BHPH Success transfers Personal Data to Vendor in connection with the BHPH Success marketplace and Vendor is permitted to use that information for its own legitimate business purposes consistent with the applicable marketplace service, user request, law, and agreement.
This DTA may apply to free or paid Vendor Services, including lead generation, inquiries, requests for information, requests for demonstrations, requests for quotes, consultations, marketplace communications, and similar dealer-to-vendor connections.
This DTA does not apply where Vendor acts solely as a processor or service provider on behalf of BHPH Success. Such processing may instead be governed by the Data Processing Addendum.
For purposes of this DTA:
Capitalized terms not defined in this DTA have the meaning given to them in the General Vendor Terms or applicable written agreement.
For transfers covered by this DTA, BHPH Success and Vendor generally act as independent businesses or controllers with respect to Personal Data transferred between them.
Each party independently determines the purposes and means of its own subsequent Processing, subject to:
Nothing in this DTA makes either party the general agent, employee, partner, or joint controller of the other except where Applicable Privacy Law expressly requires a different classification.
Personal Data transferred under this DTA may include information provided or generated when a dealer or other marketplace user:
Depending on the service, transferred information may include:
Receipt of a lead, inquiry, or other dealer information does not transfer ownership of the BHPH Success dealer database, behavioral dataset, marketplace database, or underlying marketplace intelligence to Vendor.
Vendor may Process transferred Personal Data only for lawful purposes reasonably related to the marketplace interaction or Vendor Service under which the information was provided.
Permitted purposes may include:
Vendor is independently responsible for establishing any legal basis, notice, consent, or other requirement applicable to Vendor's subsequent Processing.
Unless expressly authorized by BHPH Success and permitted by law, Vendor may not:
Each party will comply with Applicable Privacy Law with respect to its own Processing of Personal Data.
Vendor is responsible for determining which privacy, marketing, communications, data-security, breach-notification, and related legal requirements apply to Vendor after it receives Personal Data.
Vendor will not knowingly cause BHPH Success to violate Applicable Privacy Law through Vendor's use or handling of transferred Personal Data.
Vendor will promptly notify BHPH Success if Vendor determines that it can no longer Process transferred Personal Data in compliance with Applicable Privacy Law or this DTA.
Each party is responsible for responding to privacy requests that apply to Personal Data under its control.
Where reasonably necessary to fulfill a valid privacy request or comply with Applicable Privacy Law, Vendor will cooperate with BHPH Success regarding requests involving transferred Personal Data.
This cooperation may include:
Neither party is required to disclose information that Applicable Privacy Law permits or requires it to withhold.
Where Applicable Privacy Law regulates the sale, sharing, targeted advertising, cross-context behavioral advertising, or similar use of Personal Data, Vendor will comply with all applicable restrictions and consumer choices.
If BHPH Success communicates that a Data Subject has exercised a legally applicable opt-out relating to transferred Personal Data, Vendor will take any action required by Applicable Privacy Law and the applicable marketplace relationship.
BHPH Success may require reasonable documentation confirming that Vendor has stopped or remediated a use of Personal Data that is inconsistent with applicable opt-out rights or other legal requirements.
Vendor will maintain reasonable administrative, technical, and organizational safeguards appropriate to the nature of transferred Personal Data and the risks associated with its Processing.
Reasonable safeguards may include, as appropriate:
Vendor will limit access to transferred Personal Data to personnel and service providers who reasonably need access for permitted purposes.
Vendor will notify BHPH Success without unreasonable delay after confirming a Personal Data Breach involving Personal Data received from BHPH Success where notification is required by Applicable Privacy Law or reasonably necessary to protect BHPH Success or affected Data Subjects.
To the extent reasonably available, Vendor's notice should include:
Vendor will reasonably cooperate with BHPH Success in investigating and responding to the Personal Data Breach.
Responsibility for notification costs, investigation costs, remediation costs, and other breach-related expenses will be determined under the General Vendor Terms, this DTA, applicable written agreements, and Applicable Privacy Law.
Vendor will not retain transferred Personal Data longer than reasonably necessary for the permitted purpose, legitimate legal obligations, dispute resolution, fraud prevention, recordkeeping, or another lawful basis.
When transferred Personal Data is no longer reasonably necessary, Vendor will delete, anonymize, aggregate, or otherwise appropriately dispose of the information in accordance with Applicable Privacy Law and Vendor's lawful retention requirements.
Where required to satisfy a valid privacy request or remediate unauthorized use, BHPH Success may require Vendor to confirm deletion or cessation of use of specified transferred Personal Data.
Vendor may disclose transferred Personal Data to its employees, affiliates, contractors, professional advisors, service providers, or other recipients only where reasonably necessary for a permitted purpose and where the disclosure complies with Applicable Privacy Law.
Vendor is responsible for taking reasonable steps to ensure that recipients receiving transferred Personal Data protect the information appropriately.
Vendor may not avoid the restrictions in this DTA by routing transferred Personal Data through another company, affiliate, reseller, contractor, or intermediary.
If Vendor receives a subpoena, court order, governmental request, regulatory demand, or other legal request requiring disclosure of transferred Personal Data, Vendor may disclose information as required by law.
Where legally permitted and reasonably appropriate, Vendor will:
Where reasonably necessary to satisfy legal obligations or investigate suspected misuse, BHPH Success may take reasonable steps to verify that Vendor uses transferred Personal Data consistently with this DTA and Applicable Privacy Law.
BHPH Success may request information reasonably necessary to verify:
BHPH Success will not use this section to demand unrelated confidential information or conduct unreasonable audits unrelated to transferred Personal Data.
If BHPH Success reasonably believes Vendor is using transferred Personal Data in violation of this DTA, Applicable Privacy Law, or an applicable user privacy choice, BHPH Success may require Vendor to stop or remediate the unauthorized Processing.
Remedial measures may include:
BHPH Success may take immediate action where reasonably necessary to address fraud, security risks, unlawful Processing, serious privacy violations, or material risks to Data Subjects.
BHPH Success is primarily intended for the United States independent automotive industry.
If a transfer covered by this DTA becomes subject to international data-transfer requirements, the parties will implement any transfer mechanism required by Applicable Privacy Law.
This may include, where applicable:
BHPH Success does not represent in this DTA that any particular international transfer framework applies unless that framework is actually implemented for the relevant transfer.
Each party is responsible for its own Processing of Personal Data and its own compliance with Applicable Privacy Law.
Vendor is responsible for claims, losses, liabilities, regulatory penalties, or other consequences arising from Vendor's unauthorized or unlawful Processing of transferred Personal Data to the extent provided in the General Vendor Terms, applicable written agreements, and Applicable Privacy Law.
Any indemnification obligations, liability limitations, exclusions, or financial caps contained in the General Vendor Terms or other controlling agreement will apply except to the extent this DTA or Applicable Privacy Law expressly provides otherwise.
This DTA becomes effective when Vendor first receives Personal Data from BHPH Success in a transfer covered by this DTA and remains effective for as long as Vendor retains or Processes that Personal Data.
Termination of Vendor Services does not eliminate obligations relating to Personal Data previously received.
Sections concerning permitted use, prohibited use, privacy rights, security, breaches, retention, confidentiality, liability, and other obligations that by their nature should survive will remain effective for as long as applicable Personal Data is retained or as otherwise required by law.
This DTA supplements the BHPH Success General Vendor Terms and other applicable written agreements.
If there is a conflict involving the Processing or transfer of Personal Data, this DTA will control with respect to the specific data-transfer issue unless another written agreement expressly states that it supersedes this DTA.
The BHPH Success Privacy Policy governs BHPH Success's privacy disclosures to users and does not replace Vendor's independent obligation to maintain its own legally compliant privacy practices.
BHPH Success may update this DTA to reflect changes in Vendor Services, marketplace functionality, data-transfer practices, Applicable Privacy Law, or legal requirements.
The "Last Updated" date at the top of this page will identify the most recent revision.
Where required by applicable law or contract, BHPH Success may provide additional notice of material changes.
Questions concerning this Data Transfer Addendum or transferred Personal Data may be directed to:
BHPH Success
Legal Entity: [INSERT LEGAL OPERATING ENTITY]
Privacy Email: [INSERT PRIVACY EMAIL ADDRESS]
Legal Email: [INSERT LEGAL EMAIL ADDRESS]
Mailing Address: [INSERT BUSINESS MAILING ADDRESS]
