Data Processing Addendum

This Data Processing Addendum ("DPA") is part of the Terms of Service between X3 Fleet Safety LLC ("X3") and the customer ("Customer"). It applies to every X3 product and governs the personal data Customer submits to the Services. If this DPA and the Terms conflict on the handling of personal data, this DPA controls.

1. Roles

For driver, applicant, and employee data that Customer submits, Customer is the controller (or "business") and X3 is the processor (or "service provider"). X3 processes that data only to provide the Services and only on Customer's documented instructions, which are the Terms, this DPA, and Customer's configuration and use of the Services.

2. What is processed

• Whose data: Customer's drivers, applicants, employees, and account users.

• What data: identifiers and contact details; driver-license and driver-qualification records; motor-vehicle records; background and consumer-report information; DOT drug and alcohol testing information; medical-certification status; hours-of-service, inspection, accident, and training records; and documents Customer uploads.

• Why and how long: to run Customer's compliance program in the Services, for the term of the subscription and the retention periods described in Section 8.

3. What X3 commits to

• Process personal data only as described in Section 1, and tell Customer if an instruction appears to break the law.

• Not sell personal data, not share it for advertising, and not use it to train artificial-intelligence models. X3 uses AI sub-processors only under terms that do not allow them to train their models on Customer's personal data.

• Keep personal data confidential and limit access to people who need it and are bound by confidentiality.

• Help Customer answer requests from individuals to access, correct, or delete their data, and pass along any request X3 receives directly.

4. What Customer commits to

Customer is responsible for having the legal right to submit the data. That includes the standalone disclosure and written authorization required by the Fair Credit Reporting Act, a permitted use under the Driver's Privacy Protection Act for motor-vehicle records, and the authority to handle testing information under 49 CFR Part 40.

5. Security

X3 maintains administrative, technical, and physical safeguards appropriate to the data, including encryption in transit and at rest, access controls, tenant isolation, logging, and vendor oversight. The Trust & Security overview describes the program.

6. Sub-processors

Customer authorizes X3 to use the sub-processors below. Each is bound by a written agreement to protect the data, and X3 remains responsible for their work. X3 will update this list and email account owners at least 30 days before a new sub-processor starts handling personal data. Customer may object in writing within those 30 days, and if the objection cannot be resolved Customer may cancel the affected Service.

• Cloudflare: hosting, databases, file storage, network security, and on-platform AI processing.

• Anthropic: AI processing for answers, document extraction, and analysis.

• Stripe: subscription billing and payments. X3 does not store full card numbers.

• Resend: account, reminder, and notification email.

• Checkr: background checks, only when Customer orders them.

Providers that Customer connects itself, such as an ELD or applicant-tracking system, are Customer's own vendors and not X3 sub-processors.

7. Security incidents

X3 will notify Customer without undue delay, and within seventy-two (72) hours of confirming it, of any unauthorized access to Customer's personal data. The notice will describe what happened, the data affected, and the steps being taken.

8. Return and deletion

For 30 days after the subscription ends, Customer may export its data. After that, X3 deletes it, except where a law requires a record to be kept longer (for example, driver-qualification and testing-record retention rules) and for backups, which age out on their normal schedule.

9. Location of processing

The Services are operated from the United States for U.S. motor carriers. X3 does not direct the Services to individuals outside the United States.

10. Information and audits

On reasonable written request, and no more than once a year, X3 will give Customer the information reasonably needed to confirm that X3 is meeting this DPA.

11. Liability

Each party's liability under this DPA is subject to the limits in the Terms of Service.

12. Contact

Questions about this DPA or a request for a signed copy: [email protected].