Effective Date: 2025-03-01 | Version: 1.0

This Data Processing Addendum (DPA) is part of the Terms of Service and Privacy Policy of WrenchLane.com and applies when WrenchLane.com processes personal data on behalf of its corporate clients ("Customer").

1. Definitions

1.1 "Applicable Data Protection Laws" refers to all applicable privacy and data protection laws, including:

General Data Protection Regulation (EU) 2016/679 (GDPR)

UK GDPR and UK Data Protection Act 2018

California Consumer Privacy Act (CCPA)

Brazil's General Data Protection Law (LGPD)

Canada's Personal Information Protection and Electronic Documents Act (PIPEDA)

1.2 "Personal Data" means any data processed by WrenchLane.com on behalf of the Customer that relates to an identified or identifiable business representative or employee.

1.3 "Processor" refers to WrenchLane.com when processing Customer Data under this Addendum.

1.4 "Controller" refers to the Customer, who determines the purposes and means of processing personal data.

1.5 "Sub-Processor" refers to any third party that WrenchLane.com engages to process personal data.

2. Processing of Personal Data

2.1 Scope and Purpose

WrenchLane.com will process personal data solely for:

Providing, maintaining, and improving the Services.

Enhancing AI-driven vehicle diagnostics and workflow automation.

Complying with legal obligations.

2.2 Customer Instructions

WrenchLane.com will process personal data only per documented instructions from the Customer, unless required by law.

2.3 Confidentiality

All WrenchLane.com personnel processing personal data will be bound by strict confidentiality obligations.

3. Security Measures

WrenchLane.com implements technical and organizational measures to protect personal data, including:

Encryption of personal data (both in transit and at rest).

Access controls and authentication protocols.

Regular security audits and risk assessments.

4. Sub-Processors

4.1 Use of Third-Party Service Providers

WrenchLane.com uses trusted Sub-Processors for infrastructure, hosting, and payment processing, including but not limited to:

Amazon Web Services (AWS) (cloud hosting)

OpenAI (AI-powered automation services)

Stripe (payment processing)

4.2 Customer Right to Object

The Customer may object to a new Sub-Processor within 30 days of notice if they believe it negatively impacts their data protection rights.

5. International Data Transfers

5.1 Compliance with Transfer Laws

Personal data may be transferred outside of the EEA, UK, or other applicable jurisdictions, but only with appropriate safeguards such as:

Standard Contractual Clauses (SCCs) under GDPR

Data Privacy Framework (for US-based transfers, if applicable)

6. Data Subject Rights

WrenchLane.com will assist the Customer in fulfilling its obligations regarding individual rights, including:

Right to Access – Providing a copy of processed personal data.

Right to Deletion – Deleting data when requested, subject to legal retention periods.

Right to Restrict Processing – Limiting data processing upon request.

7. Data Retention & Deletion

WrenchLane.com will retain personal data only as long as necessary for the purposes outlined in the agreement. Upon termination of services, personal data will be deleted unless legal retention requirements apply. Data will be retained for 90 days post-termination, unless an explicit deletion request is made.

Any data that has been de-identified and aggregated before deletion may be retained indefinitely for AI model training and service improvements. This data cannot be traced back to any customer and does not contain personally identifiable or proprietary information.

Customers may opt out of AI training data usage at any time by notifying WrenchLane.com via support@wrenchlane.com. Once an opt-out request is processed:

No further data will be used for training.

Previously anonymized and aggregated data cannot be removed, as it is no longer linked to any identifiable entity.

8. Liability & Indemnification

Both parties shall be responsible for damages resulting from violations of data protection laws. WrenchLane.com is liable only for non-compliance caused by its own processing activities.

9. Term & Termination

This DPA remains effective as long as WrenchLane.com processes personal data on behalf of the Customer. Upon termination, WrenchLane.com will delete or return all personal data unless legally required to retain it.

10. Contact Information

For any data protection inquiries:

Email: support@wrenchlane.com