Data Processing Agreement
DPA
ECNU Auto, Inc. d/b/a Always Audit
1500 1st Ave N
Birmingham, AL 35203
Most recent version: July 17, 2026
1. Parties and Scope
This Data Processing Agreement ("DPA") forms part of the agreement for services ("Agreement") between ECNU Auto, Inc., a Delaware corporation doing business as Always Audit ("Always Audit," "Processor"), and the customer identified in the Agreement ("Customer," "Controller").
This DPA applies to Always Audit's processing of Personal Data on behalf of Customer in connection with the Always Audit vehicle inventory tracking and lot audit platform (the "Service").
2. Definitions
- "Personal Data" means any information relating to an identified or identifiable natural person that Always Audit processes on Customer's behalf under the Agreement.
- "Processing" means any operation performed on Personal Data, such as collection, storage, retrieval, use, disclosure, or deletion.
- "Subprocessor" means a third party engaged by Always Audit to process Personal Data in support of the Service.
- "Data Protection Laws" means all applicable laws relating to privacy and data protection, including, where applicable, U.S. state privacy laws (e.g., CCPA/CPRA) and the EU/UK GDPR.
- "Security Incident" means a confirmed breach of security leading to accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, Personal Data.
3. Roles and Instructions
- Customer is the Controller and Always Audit is the Processor of Personal Data processed through the Service.
- Always Audit will process Personal Data only on documented instructions from Customer, including as set out in the Agreement and this DPA, unless required otherwise by applicable law (in which case Always Audit will notify Customer unless legally prohibited).
- Always Audit will promptly inform Customer if, in its opinion, an instruction infringes Data Protection Laws.
4. Categories of Data and Data Subjects
| Data subjects | Customer's employees and authorized users (dealership staff, managers, administrators); Customer's own customers only to the extent Customer submits such data through the Service. |
|---|---|
| Categories of Personal Data | Name, business email address, business phone number, login credentials (managed by our authentication provider; Always Audit does not store passwords), role and permission assignments, activity logs (scans, audits, edits), device and usage metadata, approximate location data associated with vehicle scans on Customer lots. |
| Special categories | None. Customer agrees not to submit sensitive personal data (e.g., health, biometric, or government ID data) to the Service. |
| Duration | The term of the Agreement plus the deletion period in Section 10. |
| Purpose | Providing, securing, supporting, and improving the Service as described in the Agreement. |
5. Confidentiality
Always Audit ensures that personnel authorized to process Personal Data are bound by written confidentiality obligations and receive appropriate training on data protection. Access to Personal Data is limited to personnel who require it to perform their duties.
6. Security Measures
Always Audit implements and maintains appropriate technical and organizational measures, including:
- Encryption of Personal Data in transit (TLS 1.2 or higher) and at rest (AES-256);
- Hosting on enterprise cloud infrastructure certified under SOC 2 Type 2 and ISO 27001;
- Role-based access control within the Service, with per-dealership data isolation;
- Authentication delegated to a SOC 2 Type 2 certified identity provider; Always Audit does not store user passwords;
- Payment card data handled exclusively by a PCI DSS Level 1 certified payment processor; card data never touches Always Audit systems;
- Logical separation of production and development environments;
- Audit logging of administrative and data-modifying actions;
- Regular review of access rights and prompt revocation upon role change or termination.
7. Subprocessors
- Customer provides general authorization for Always Audit to engage the Subprocessors listed below.
- Always Audit will impose data protection obligations on each Subprocessor that are no less protective than those in this DPA and remains liable for Subprocessors' performance.
- Always Audit will provide notice of new Subprocessors (via this page or email) at least 15 days before granting them access to Personal Data. Customer may object on reasonable data protection grounds; if the objection cannot be resolved, Customer may terminate the affected Service.
| Subprocessor | Purpose | Location |
|---|---|---|
| Google Cloud Platform | Cloud hosting and application infrastructure | United States |
| Neon, Inc. | Managed database services | United States |
| Clerk, Inc. | User authentication and identity management | United States |
| Stripe, Inc. | Payment processing and billing | United States |
| Twilio Inc. | Transactional SMS delivery | United States |
| AgentMail | Transactional email delivery | United States |
8. Data Subject Requests
Taking into account the nature of the processing, Always Audit will assist Customer, by appropriate technical and organizational measures, in responding to requests from data subjects to exercise their rights (access, correction, deletion, portability, restriction, objection). If a data subject contacts Always Audit directly, Always Audit will promptly redirect the request to Customer and will not respond substantively without Customer's authorization, unless required by law.
9. Security Incident Notification
Always Audit will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident affecting Customer's Personal Data. The notification will describe, to the extent known, the nature of the incident, the categories and approximate volume of affected data, likely consequences, and measures taken or proposed. Always Audit will cooperate with Customer's reasonable efforts to investigate, mitigate, and comply with legal notification obligations.
10. Return and Deletion of Data
Upon termination or expiration of the Agreement, Always Audit will, at Customer's choice, return Customer's Personal Data in a commonly used format or delete it, and will delete remaining copies within 90 days, except where retention is required by applicable law. Backup copies are deleted in the ordinary course of backup rotation.
11. Audits and Information
Always Audit will make available to Customer information reasonably necessary to demonstrate compliance with this DPA, including summaries of third-party certifications and attestations held by its infrastructure providers. No more than once per year, and subject to reasonable confidentiality and scheduling requirements, Customer may conduct (directly or through an independent auditor) an audit limited to Always Audit's compliance with this DPA. Customer bears the costs of any such audit.
12. International Transfers
Personal Data is stored and processed in the United States. If the parties' relationship requires transfer of Personal Data subject to GDPR or UK data protection law, the parties will execute the applicable Standard Contractual Clauses or an equivalent lawful transfer mechanism, which is incorporated by reference upon execution.
13. Liability and Order of Precedence
- Each party's liability under this DPA is subject to the limitations of liability in the Agreement.
- In case of conflict between this DPA and the Agreement regarding the processing of Personal Data, this DPA controls.
14. Term
This DPA takes effect on the effective date of the Agreement and remains in force for as long as Always Audit processes Personal Data on behalf of Customer.
Questions about this DPA or requests for a countersigned copy can be directed to your Always Audit account contact.