Data Processing Addendum

This Data Processing Addendum, including any Appendixes (“DPA”) is entered into by and between Oili, Inc. (“Company”) and the entity that agreed to the terms of the Terms of Use (“User”) (each referred to individually as a “Party” and collectively as the “Parties”).

This DPA is deemed an amendment to the Terms of Use and any documents incorporated therein by reference, by and between Company and User (collectively, the “Terms”).

The Parties have entered into the Terms that involve the processing of personal data. The Parties seek to implement a data processing addendum that complies with the requirements of the current legal framework in relation to the processing of personal data. The Parties wish to set forth their rights and obligations herein.

In consideration of the mutual covenants and agreements of the Parties as set forth in this DPA, the Parties agree as follows:

1.0 DEFINITIONS

1.1 Defined Terms. All defined terms used in this DPA with initial capital letters have the meaning as set forth in Appendix A, unless defined elsewhere in this DPA or as otherwise set forth in this Section 1. “Section” and “Appendix” means a section and appendix of this DPA. The singular meaning of a defined term shall have the same meaning as the plural meaning and vice versa.

1.2 Terms without Definition. Capitalized terms used without definition in this DPA will have the same meaning as set forth in the Terms.

2.0 PROCESSING OF PERSONAL DATA

2.1 The Parties’ Roles. The processing of Personal Data will occur in the following form: User is the Business and Company is the Service Provider.

2.2 Data Processing. Business is allowing the Service Provider to perform data processing activities as specified in Appendix B. Appendix B describes the subject matter, purpose, and nature of the Personal Data processing, its duration, the categories of Personal Data, and types of Personal Data processed.

2.3 Instructions. Service Provider agrees to comply with all applicable Data Protection Laws in the processing of the Personal Data; and not process the Personal Data other than based upon Business’s instructions, as set forth in this DPA, Service Provider’s business obligations, or as otherwise agreed by the Parties. Further, unless otherwise instructed by the Business or otherwise set forth in this DPA and/or the Terms, Service Provider will not (a) retain, use, or disclose Personal Data for any purpose, including any commercial purposes; (b) retain, use, or disclose Personal Data outside the direct business relationship between Company and User; (c) combine the Personal Data with any information received from or on behalf of any other person or entity; or (d) sell or share the Personal Data.

3.0 SERVICE PROVIDER’S PERSONNEL

3.1 Access to Personal Data. Service Provider agrees to take reasonable steps to ensure the reliability of any of their Personnel who may have access to Personal Data, ensuring in each case that (a) access is limited to those Personnel who have a need to know the Personal Data, as necessary for the purposes of the Terms, and (b) all such Personnel have a signed written agreement with Service Provider requiring such Personnel to be subject to and comply with obligations of confidentiality.

4.0 SECURITY

4.1 Security Implementation. Taking into account the state of the art, the costs of implementation and the nature, scope, context, and purposes of processing, as well as, the risk of varying likelihood and severity for the rights and freedoms of natural persons, Service Provider agree to, in relation to the Personal Data, implement appropriate technical and organizational measures to ensure a level of security appropriate to that risk, including, as appropriate, the measures referred to in the Data Protection Laws.

4.2 Appropriate Levels of Security. In assessing the appropriate level of security, Service Provider will take into account the risks that are presented by processing the Personal Data, in particular from a personal data breach.

5.0 SUBPROCESSORS

5.1 Engaging with Subprocessors. To the extent that Subprocessors are applicable, Business acknowledges and agrees that Service Provider may engage with Subprocessors in connection with the fulfillment of their obligations under the Terms; provided, that, Service Provider agrees to (a) restrict Subprocessors’ access to Personal Data only to the extent necessary to fulfill Service Provider’s obligations under the Terms; and (b) enter into a written agreement with each Subprocessor containing data protection obligations at least as protective as those set forth in this DPA with respect to the protection of the Personal Data.

5.2 List of Subprocessors. Company will maintain a current list of Subprocessors, describing their services and processing locations, and provide the list or its location within ten (10) business days after Business requests it. Company will give Business written notice of a proposed new or replacement Subprocessor at least thirty (30) calendar days before that Subprocessor first processes Business’s Personal Data. Business may object on reasonable data-protection grounds during that period. The Parties will work in good faith to resolve the objection; if they cannot, Business may terminate the affected services before the new or replacement Subprocessor processes its Personal Data, without a penalty arising solely from that objection. Until resolution or termination, the disputed Subprocessor will not process Business’s Personal Data.

5.3 Responsible for Subprocessors. Service Provider will remain responsible for any acts or omissions of their Subprocessors that cause Service Provider to breach any of Service Provider’s obligations under this DPA.

6.0 DATA SUBJECT RIGHTS

6.1 Requests from Data Subjects. Service Provider agrees to promptly notify Business if it receives a request from a data subject in respect to their Personal Data and protected under any Data Protection Laws. Service Provider agrees that they will not respond to any such requests, except on the written instructions of the Business.

7.0 PERSONAL DATA BREACH

7.1 Notice of Personal Data Breach. Service Provider agrees to notify Business without undue delay upon Service Provider becoming aware of a personal data breach affecting the Personal Data. Further, Service Provider agrees to provide Business with sufficient information to allow Business to meet any obligations to report or inform data subjects of the personal data breach under the Data Protection Laws.

7.2 Cooperation. Service Provider agrees to cooperate with Business and take reasonable commercial steps as directed by Business to assist in the investigation, mitigation, and remediation of each such personal data breach.

8.0 DATA PROTECTION IMPACT ASSESSMENT AND CONSULTATION

8.1 Reasonable Assistance. Service Provider agrees to provide reasonable assistance to Business with any data protection impact assessments, and consultations with supervising authorities or other competent data privacy authorities, which Business reasonably considers to be required by the Data Protection Laws, if applicable, in each case solely in relation to processing of the Personal Data by, and taking into account the nature of the processing and information available to Service Provider.

9.0 DELETION OR RETURN OF PERSONAL INFORMATION

9.1 Deletion of Personal Data. Service Provider promptly and in any event within thirty (30) calendar days of the date of termination of the Terms involving the processing of Personal Data (the “Termination Date”), delete and procure the deletion of all copies of Personal Data. Further, Service Provider may retain Personal Data to the extent required by applicable laws, but only to the extent and for the period of time as required by applicable law.

9.2 Notice to Business. Service Provider will provide written certification to Business when it has complied with the terms of Section 9.1, and will advise if there are any exceptions with regard to deletion of Personal Data as specified in Section 9.1.

10.0 AUDIT RIGHTS

10.1 Compliance. Service Provider will make available to Business, upon written request, all information necessary to demonstrate compliance with this DPA and Data Protection Laws, and will allow for and contribute to audits, including inspections, by Business or an auditor mandated by Business, at Business’s expense, in relation to the processing of Personal Data, as set forth in this DPA.

11.0 TERM AND TERMINATION

11.1 Term of this DPA. This DPA will remain in effect until terminated in accordance with its terms, as set forth in this DPA.

11.2 Material Breach. If Business determines that Service Provider has violated or breached a material term and/or condition of this DPA or Service Provider can no longer meet their obligations under this DPA, then Business may immediately terminate this DPA and the Terms with written notice to Service Provider.

11.3 Termination in Connection with Subprocessors. Business may terminate the affected services and this DPA in accordance with Section 5.2 if the Parties cannot resolve a timely objection to a new or replacement Subprocessor. No general notice period in the Terms will prevent termination before that Subprocessor begins processing Business’s Personal Data.

11.4 Termination of the Terms. If the Terms are terminated pursuant to the terms of the Terms of Use, then this DPA will immediately and automatically terminate, unless another agreement is entered into by and between the Parties where personal information is being processed.

12.0 GENERAL

12.1 Modifications to this DPA. Company will provide User with written notice of a proposed material change to this DPA, the revised text and its proposed effective date at least thirty (30) calendar days before the change takes effect. User may reject the change by written notice before the effective date and terminate the affected Terms and this DPA on or before that date without a penalty arising solely from that rejection. Continued use before the effective date, or solely for an agreed wind-down after timely rejection, does not constitute acceptance. The existing DPA will govern that wind-down until termination. If User does not reject the change and continues the affected services after the effective date, the revised DPA will apply. Neither course of conduct nor trade usage otherwise modifies this DPA.

12.2 Provisions of the Terms. Except as expressly set forth in this DPA, this DPA is subject to each and every provision of the Terms, all of which are incorporated in this DPA by reference. Except as expressly set forth in this DPA, all other provisions of the Terms will remain in full force and effect.

APPENDIX A DEFINITIONS

1. “Contractors” means a person or entity that enters into a written agreement with Service Provider to perform services for the Service Provider. For purposes of clarification, Contractors includes consultants, agents, and advisors.

2. “Business” means a person or entity that decides the purpose of the processing of personal information and how personal information is processed.

3. “Service Provider” means a person or entity that processes personal information on behalf of a business, and under the instructions of such business.

4. “Data Protection Laws” means the laws of the applicable state to which Company and User are subject, including California Consumer Privacy Act and California Privacy Rights Act.

5. “Personnel” means the employees and Contractors that are hired by the Service Provider.

6. “Privacy Policy” means a document that explains how a Party collects, uses, stores, and shares personal information of various users, and informs users about their rights with respect to their personal information.

7. “Subprocessor” means any entity engaged by the Service Provider that processes Personal Data on behalf of the service provider.

APPENDIX B DESCRIPTION OF DATA PROCESSING

Subject matter and purpose: processing fleet-related Personal Data on Business’s behalf to administer authorized fleet accounts, book and provide vehicle services, identify and verify vehicles, communicate about those services and maintain service records under Business’s instructions.

Nature of processing: collection, access, storage, retrieval, matching and correction of vehicle information; authorized vehicle-information lookup, including AI-assisted lookup if used; technician review; service scheduling, communications and recordkeeping; return or deletion as required by this DPA.

Data subjects: Business’s fleet administrators, employees, drivers and other authorized service contacts whose Personal Data Business provides or authorizes Company to process.

Categories and types of Personal Data: names, business contact details, account and fleet identifiers, relevant service locations, vehicle identifiers including plate and jurisdiction and VIN, vehicle attributes, vehicle-linked booking and service records, lookup results, technician corrections and applicable communication/authorization records, to the extent processed on Business’s behalf.

Duration: for the period required to perform the authorized services under the Terms, followed by deletion and any specifically required lawful retention under Section 9.

Subprocessors and processing locations: identify in the current list maintained under Section 5.2.

Processing restrictions: vehicle-lookup and AI providers may process Business’s Personal Data only for the authorized service purposes under written obligations consistent with this DPA. Processing for a provider’s independent marketing or general model training is not authorized by this Appendix. Any additional proposed use must be evaluated under applicable law and the Parties’ agreed instructions before processing.