Data Processing Agreement.

This Data Processing Agreement (“DPA”) is between the customer (“Customer,” the controller) and AutoKnerd LLC (“AutoKnerd,” the processor / service provider). It is incorporated into the Terms of Service.

1. Scope and roles

This DPA governs AutoKnerd's processing of personal information contained in Customer Data on Customer's behalf when Customer uses the Service. Customer is the controller / business; AutoKnerd is the processor / service provider.

2. Definitions

“Personal Information,” “Customer Data,” “Sub-processor,” “Security Incident,” and “Process” have the meanings given here and in applicable US privacy laws, including the CCPA/CPRA and other state consumer-privacy laws.

3. Processing details

• Subject matter: provision of the AutoKnerd Service.
• Duration: the term of the Terms of Service plus the deletion period below.
• Nature and purpose: hosting, storing, and processing team members' practice responses, performance data, and coaching inputs to run coaching sessions, show results, and generate reports at Customer's direction.
• Types of personal information: team-member names and roles; responses submitted during practice sessions (roleplay messages and choices); customer-experience and behavior scores, XP, streaks, and progress; coaching notes and weekly-focus settings; and session metadata.
• Categories of data subjects: Customer's team members (salespeople, service advisors, and other staff) and Customer's own owners, managers, and administrators.

4. AutoKnerd's obligations

AutoKnerd will:

• Process Customer Data only on Customer's documented instructions (including the configuration Customer selects in the product), and only to provide the Service — not for its own commercial purposes, not sold, and not used to train third-party AI models or for advertising.
• Ensure personnel authorized to process Customer Data are bound by confidentiality.
• Implement and maintain the security measures described in the Security Overview (Section 6 below).
• Assist Customer, taking into account the nature of processing, with (a) responding to data-subject requests, and (b) Customer's own security, breach-notification, and privacy-assessment obligations.
• Make available information reasonably necessary to demonstrate compliance with this DPA.

5. Sub-processors

Customer authorizes AutoKnerd to use the sub-processors listed on our Sub-processors page to provide the Service. AutoKnerd will (a) impose data-protection obligations on each sub-processor no less protective than this DPA, (b) remain responsible for their performance, and (c) give Customer [30 days'] notice of any new sub-processor, with a right to object on reasonable data-protection grounds.

6. Security

AutoKnerd will maintain reasonable and appropriate administrative, technical, and physical safeguards, including: encryption of Customer Data in transit and at rest; role-based access control and least-privilege access; logical tenant isolation between customers; authentication with server-side session verification; default-deny data-store rules; and secure software-development and access practices. Details are in the Security Overview.

7. Security incidents

AutoKnerd will notify Customer without undue delay (and in any event within [72 hours]) after becoming aware of a Security Incident affecting Customer Data, will provide information reasonably available to Customer, and will take reasonable steps to mitigate and remediate. [Attorney/ops to confirm the exact window.]

8. Data-subject requests

If AutoKnerd receives a request from a data subject regarding Customer Data, it will, to the extent legally permitted, direct them to Customer and assist Customer in responding.

9. Return and deletion

On termination, or on Customer's request, AutoKnerd will delete or return Customer Data within [30 days] and delete existing copies, except as required by law. [Confirm mechanism and timeline; product deletion tooling is being added.]

10. Audits

AutoKnerd will make available information necessary to demonstrate compliance and will allow for and contribute to audits conducted by Customer or its auditor, subject to reasonable notice, confidentiality, and frequency limits. [Attorney to scope.]

11. International transfers

Customer Data is processed in the United States. AutoKnerd does not transfer Customer Data outside the US.

12. Order of precedence

In the event of a conflict, this DPA controls over the Terms of Service with respect to the processing of Customer Data.

13. Signatures

[Signature blocks — Customer and AutoKnerd LLC.]