1. DEFINITIONS & INTERPRETATION

1.1 Capitalised terms shall have the meaning first ascribed to them, in particular:

2. COMMENCEMENT AND DURATION

2.1. The Company engages Manheim and Manheim agrees to provide the Services (in the United Kingdom Mainland) to the Company, commencing on the Commencement Date and continuing for the term of this Agreement, subject to the terms and conditions of this Agreement and payment of the Charges.

2.2. This Agreement shall come into force or came into force on the Commencement Date and shall continue until: (i) terminated under any of the early termination provisions in clause 10 or 11.2 or (ii) terminated by either party on 6 months’ written notice provided that the effective date of termination shall not be prior to the end of the Initial Term.

3. SERVICES

3.1. Subject to the terms of this Agreement, Manheim warrants that:

3.1.1. each applicable Service shall operate materially in accordance with the Services Descriptions when used in accordance with this Agreement under normal use and normal circumstances during the Term; and

3.1.2. it will provide each applicable Service with reasonable care and skill.

3.2. Manheim shall use reasonable endeavours to identify all consents (including for the avoidance of doubt all approvals necessary to produce artwork, illustration, photography, copy, drawings, literary and other such work) necessary for the fulfilment of its obligations under this Agreement and shall use its reasonable endeavours to obtain any such consent.

3.3. If Manheim’s performance of its obligations under this agreement is prevented or delayed by any act or omission of the Company, the Retailers, its agents, subcontractors, consultants or employees, then, without prejudice to any other right or remedy it may have, Manheim shall be allowed an extension of time to perform its obligations equal to the delay.

3.4. The Company acknowledges that clause 3.1 does not apply to any free, trial, or pilot services provided by Manheim.

3.5. The Services may be subject to delays, interruptions, errors, or other problems resulting from use of the internet or public electronic communications networks used by the parties or third parties. The Company acknowledges that such risks are inherent in cloud services and that Manheim shall have no liability for any such delays, interruptions, errors, or other problems.

3.6. The warranties in clause 3.1 are subject to the limitations set out in clause 9 and shall not apply to the extent that any error in the Services arises as a result of:

3.6.1. incorrect operation or use of the Services by the Company, the Retailers, its agents, subcontractors, consultants, or employees (including any failure to follow the Acceptable Use Policy or failure to meet minimum specifications);

3.6.2. use of any of the Services other than for the purposes for which it is intended;

3.6.3. use of any Services with other software or services or on equipment with which it is incompatible (unless Manheim recommended or required the use of that other software or service or equipment in the Services Descriptions);

3.6.4. any act by any third party (including hacking or the introduction of any virus or malicious code);

3.6.5. any modification of Services (other than that undertaken by Manheim or at its direction); or

3.6.6. any breach of this Agreement by the Company or a Retailer.

3.7. Manheim may at its absolute discretion make, and notify the Company of, updated versions Manheim Licensed Software from time to time by notifying the Company of such update by e-mail (together with a copy of the update or a link to a copy of the update) or by any other reasonable means which Manheim elects.

4. COMPANY OBLIGATIONS

4.1. The Company shall: (i) co-operate with Manheim in all matters relating to the Services; (ii) provide to Manheim all documents, information, items and materials in any form (whether owned by the Company or third party) reasonably required by Manheim in connection with the Services and ensure that they are accurate and complete; and (iii) comply with the Acceptable Use Policy.

4.2. The Company shall use reasonable endeavours to identify all consents (including for the avoidance of doubt all approvals necessary to produce artwork, illustration, photography, copy, drawings, literary and other such work) necessary for the fulfilment of its obligations under this Agreement and shall use its reasonable endeavours to obtain any such consent.

4.3. The Company acknowledges that if it is a Retailer or Verifying Retailer as defined in this Appendix 1 or in the Services Descriptions (Appendix 2), it shall be subject to the obligations that this Agreement imposes on a Retailer and/or Verifying Retailer. 4.4. Subject to clause 4.5, the Company shall be responsible for any third party platform integrations which are requested by the Company and accepted by Manheim to supplement the provision of Services. For the avoidance of doubt, any support by Manheim for third party integrations will be completed on an “as is” and “as available”, and reasonable endeavours basis, and Manheim will not be liable for any unsuccessful or incomplete integrations.

4.4. Subject to clause 4.5, the Company shall be responsible for any third party platform integrations which are requested by the Company and accepted by Manheim to supplement the provision of Services. For the avoidance of doubt, any support by Manheim for third party integrations will be completed on an “as is” and “as available”, and reasonable endeavours basis, and Manheim will not be liable for any unsuccessful or incomplete integrations.

4.5. Manheim shall not be liable for any service level failures relating to third party platform which results in the Company being unable to wholly or partially access the WebApp via the third party platform.

5. CHARGES & PAYMENT

5.1. In consideration of the provision of the Services by Manheim, the Company shall pay the Charges.

5.2. Manheim shall invoice the Company for the Charges on a monthly basis in arrears. The Company shall pay invoices within 30 days of receipt to a bank account nominated in writing by Manheim from time to time.

5.3. Manheim may increase the Charges on an annual basis. Manheim shall provide a minimum of 30 days’ notice before such changes take effect.

5.4. Without prejudice to any other right or remedy Manheim may have, if the Company fails to pay the Charges or any other sum due to Manheim under this agreement on the due date: (i) the Company shall pay interest on the overdue sum from the due date until payment of the overdue sum. Interest under this Clause 5.4 shall accrue each day at 4% a year above the Bank of England’s base rate from time to time; (ii) Manheim may suspend all or part of the Services until payment has been made in full.

5.5. The Charges shall be paid in full without any set-off, counterclaim, deduction or withholding (other than any deduction or withholding of tax as required by law).

5.6. All Charges payable hereunder are exclusive of VAT or any other applicable tax or duty payable upon such sums, which shall be added if appropriate at the rate prevailing at the relevant tax point. Manheim shall issue VAT invoices in respect of the sums payable by the Company prior to the relevant payment date.

6. INTELLECTUAL PROPERTY

6.1. All Intellectual Property Rights in Manheim Licensed Software, Manheim Background IPR whether existing prior to or following the Commencement Date, is the exclusive property of Manheim (or where applicable, its licensors) and shall at all times vest in and be owned by Manheim (or its licensors). Nothing in this Agreement shall have the effect of transferring or assigning in any way Manheim Intellectual Property Rights.

6.2. Manheim grants to the Company and its Retailers a limited, non-exclusive, non-transferrable and royalty-free licence during the Term to use Manheim Licensed Software solely to the extent required for the purpose of receiving the Services.

6.3. The Company and its Retailers shall have the right to use the WebApp in accordance with the terms of this Agreement for the purpose of making it available on the Online Platform and for the purpose of carrying out and generating Valuations.

6.4. The Company grants to Manheim, a worldwide, non-exclusive, perpetual, irrevocable and royalty-free licence to retain and use the Transaction Data in connection with its business or any other legal or regulatory purpose. Manheim shall have the right to share the Transaction Data within its Group and with selected third parties for the purposes set out above provided that the Transaction Data is anonymised and does not link to the Company in any way.

6.5. Subject to any other agreement and any applicable branding guidelines provided to Manheim by the Company, the Company grants to Manheim, a non-exclusive, sub-licensable, revocable, and royalty-free licence to use the Company’s name, branding, logos, registered trademarks and unregistered trademarks (“Company Branding”), for display on the relevant Manheim website and any promotional, marketing, similar material, or announcement for the duration of the Services. Manheim agrees that it shall cease to use the Company Branding if requested to do so by the Company (or its licensors).

6.6. The Company hereby grants to Manheim a fully paid-up, non-exclusive, royalty-free, non-transferable licence for the Term to use, copy and modify the Company Materials for the purpose of providing the Services.

6.7. The Company (or its licensors) shall retain ownership of all Intellectual Property Rights in the Company Materials and the Company Branding.

6.8. Manheim warrants that the Company’s use of the Manheim Licensed Software and Manheim Background IPR under the terms of this Agreement, shall not infringe the Intellectual Property Rights of any third party. The Company warrants that the use by Manheim of the Company Materials, Transaction Data, and the Company Branding, in accordance with the terms of this Agreement shall not infringe the Intellectual Property Rights of any third party.

6.9. The Company shall procure that each of its Retailers, at the request of Manheim, enter into an agreement with Manheim that is materially the same as the terms of this Agreement.

7. DATA PROTECTION

7.1. The parties acknowledge that when processing Personal Data, they will generally process the personal data as separate Data Controllers however there are times when they may act as a Data Processor of the other party, as follows:

7.1.1. If the Company is acting as a Verifying Retailer processing Provenance Material as defined and described in Appendix 2, the Company shall process such data as a Data Processor of Manheim and the parties shall comply with the Data Processing Terms in Appendix 4;

7.1.2. If Manheim transfers personal data to the Company that a Consumer has entered into the WebApp during a Valuation, Manheim shall be a Data Processor for the Company for the processing of such personal data and the parties shall comply with the Data Processing Terms in Appendix 3.

7.2. Each party warrants and represents that, in respect of such data, it shall comply in all respects with Data Protection Legislation.

8. CONFIDENTIALITY

8.1. Each party undertakes that it shall not at any time during the Term, and for a period of 3 (three) years after termination of this Agreement, disclose to any person any Confidential Information of the other party or of any member of the Group to which the other party belongs, except as permitted by this Agreement.

8.2. A party may disclose the other party’s Confidential Information:

8.2.1. to its employees, officers, representatives, or advisers who need to know such information for the purposes of exercising the party’s rights or carrying out its obligations under or in connection with this Agreement. Each party shall ensure that its employees, officers, representatives, or advisers to whom it discloses the other party’s Confidential Information comply with this Clause 8; and

8.2.2. as may be required by law, a court of competent jurisdiction or any governmental or regulatory authority.

8.3. A party shall not use any other party’s Confidential Information for any purpose other than to exercise its rights and perform its obligations under or in connection with this Agreement.

8.4. The obligations of confidentiality imposed under this Clause 8 does not apply to any Confidential Information that:

8.4.1. is or was already, or has subsequently become generally available to the public other than as a result of a disclosure by the receiving party in breach of this Clause 8.

8.4.2. was already in the receiving party’s possession at the time of disclosure by the other party other than as a result of a breach of this Agreement; or

8.4.3. is disclosed by the receiving party as may be required by law, a court of competent jurisdiction or any governmental or regulatory authority.

9. LIMITATION OF LIABILITY

9.1. Nothing in this Agreement shall limit or exclude a party’s liability for any matters which it would be illegal for it to exclude or limit its liability, including but not limited to:

9.1.1. Death or personal injury caused by negligence; and

9.1.2. Fraud or fraudulent misrepresentation.

9.2. Except for warranties, conditions or terms expressly stated in this Agreement, each party excludes all warranties, conditions and other terms that may be impliedly incorporated by statue or common law into this Agreement to the fullest extent permitted by law. 9.3. Subject to Clause 9.1, neither party shall, save where expressly stated, have any liability to the other for any of the following losses, damage, injury or expense (in each case whether direct or indirect): loss of profits; loss of opportunity; loss or depletion of goodwill; loss of anticipated savings or any special, indirect or consequential damage or loss of any nature whatsoever arising out of or relating to any breach of this Agreement, even if any such losses, damage, injury or expense are foreseeable. 9.4. Subject to Clauses 9.1 and 9.3, Manheim’s total liability in a Contract Year to the Company arising under or in connection with this Agreement shall not exceed an amount equal to 100% of the Charges paid to Manheim by the Company in the twelve months preceding its breach.

9.3. Subject to Clause 9.1, neither party shall, save where expressly stated, have any liability to the other for any of the following losses, damage, injury or expense (in each case whether direct or indirect): loss of profits; loss of opportunity; loss or depletion of goodwill; loss of anticipated savings or any special, indirect or consequential damage or loss of any nature whatsoever arising out of or relating to any breach of this Agreement, even if any such losses, damage, injury or expense are foreseeable.

9.4. Subject to Clauses 9.1 and 9.3, Manheim’s total liability in a Contract Year to the Company arising under or in connection with this Agreement shall not exceed an amount equal to 100% of the Charges paid to Manheim by the Company in the twelve months preceding its breach.

9.5. Nothing under this Clause 9 shall limit the Company’s payment obligations under this Agreement.

10. TERMINATION

10.1. A party may immediately terminate this Agreement without payment of compensation or other damages caused to the other party solely by such termination by giving notice in writing to the other party if any one or more of the following events happens:

10.1.1. the other party commits a material breach of this Agreement which breach is irremediable or (if such breach is remediable) fails to remedy that breach within a period of 30 days after being notified in writing to do so;

10.1.2. the other party proposes a voluntary arrangement within the meaning of Section 1 or Section 253 of the Insolvency Act 1986, or an interim order is made in relation to the other party under Section 252 of the Insolvency Act 1986, or any other steps are taken or negotiations commenced by the other party or any of its creditors with a view to proposing any kind of composition, compromise or arrangement involving the other party and any of its creditors;

10.1.3. the other party has any distress or execution levied on its assets which is not paid out within seven days of its being levied, or a secured lender of the other party takes any steps to obtain possession of the property on which it has security or otherwise to enforce its security;

10.1.4. the other party is deemed to be unable to pay its debts within the meaning of Section 123 of the Insolvency Act 1986, or calls a meeting for the purpose of passing a resolution to wind it up, or such a resolution is passed, or a resolution is passed by the directors of the other party to seek a winding up or administration order, or the other party presents, or has presented, a petition for a winding up order, or presents, or has presented, a

petition to appoint an administrator, or has an administrative receiver, or receiver appointed over all or any part of its business, undertaking, property or assets;

10.1.5. the other party is constituted, established, or domiciled against or to an insolvent debtor or available to the creditors of such a debtor;

10.1.6. the other party undergoes a change of Control and for the purposes of this Clause 10.1.6, “Control” has the meaning specified in Section 416 of the Income and Corporation Taxes Act 1988, save as where such change of Control is for the purpose of an intra-group restructure;

10.1.7. a Linked Agreement expires or is terminated.

10.2. The termination of this Agreement or of any of the Services shall be without prejudice to the rights and remedies of either party, which may have accrued up to the date of termination.

10.3. Any expiry or termination of this Agreement (for whatever reason) shall not affect the coming into force or the continuance in force of any provision of this Agreement that is expressly or by implication intended to come into or continue in force on or after such termination.

10.4. Upon termination of this Agreement for any reason whatsoever the Company shall immediately cease using and remove all copies of Manheim Licensed Software. The Company shall procure that each of its Retailers also immediately cease using and remove all copies of Manheim Licensed Software.

11. GENERAL

11.1. Nothing in this Agreement shall create, or be deemed to create a partnership or joint venture or relationship of employer and employee or principal and agent between the parties.

11.2. Manheim shall not be in breach of this Agreement nor liable for delay in performing, or failure to perform, any of its obligations under this Agreement if such delay or failure result from events, circumstances or causes beyond its reasonable control. In such circumstances, Manheim shall be entitled to a reasonable extension of the time for performing such obligations. If the period of delay or non-performance continues for a period exceeding four (4) weeks, the Company may terminate this Agreement by giving 15 days’ written notice to Manheim.

11.3. The Company irrevocably and unconditionally waives any right it may have to claim damages for, and/or to rescind this Agreement because of a breach of any warranty not contained in this Agreement, or any misrepresentation whether or not contained in this Agreement, unless such misrepresentation was made fraudulently.

11.4. No purported alteration or variation of this Agreement shall be effective unless it is in writing, refers specifically to this Agreement and is duly executed by each of the parties to this Agreement.

11.5. The waiver by either party of any breach of a provision of this Agreement shall not prevent the subsequent enforcement of that provision and shall not be deemed to be a waiver of any subsequent breach of that or any other provision.

11.6. If at any time any part of this Agreement is held to be or becomes void or otherwise unenforceable for any reason under any applicable law, the same shall be deemed omitted from this Agreement and the validity and/or enforceability of the remaining provisions of this Agreement shall not in any way be affected or impaired as a result of that omission.

11.7. Each of the parties shall, and shall use their reasonable endeavours to procure that any necessary third parties shall, execute and deliver to the other party such other instruments and documents and take such other action as is necessary to fulfil the provisions of this Agreement in accordance with its terms.

11.8. This Agreement constitutes the entire agreement between the parties and supersedes and extinguishes all previous agreements, promises, assurances, warranties, representations and understandings between them, whether written or oral, relating to its subject matter.

11.9. No person who is not a party to this Agreement (including any employee, officer, agent, representative or subcontractor of either party) shall have the right (whether under the Contracts (Rights of Third Parties) Act 1999 or otherwise) to enforce any provision of this Agreement which expressly or by implication confers a benefit on that person without the express prior agreement in writing of the parties to this Agreement.

11.10. Any notice given to a party under or in connection with this Agreement shall be in writing and shall be delivered by hand or by pre-paid first-class post or other next Working Day delivery service at its registered office (if a company) or its principal place of business (in any other case); or sent by email to the address of the party’s authorised representative. A notice shall be deemed to have been received: if delivered by hand, on signature of a delivery receipt or at the time the notice is left at the proper address; if sent by pre-paid first-class post or other next Working Day delivery service, at 9.00 am on the second Working Day after posting; if sent by email, at the time of sending (provided the email is supported by a valid server delivery receipt), or, if this time falls outside business hours in the place of receipt, when business hours resume. In this Clause 11.10, mean 9.00am to 5.00pm on a Working Day. This Clause does not apply to the service of any proceedings or other documents in any legal action or, where applicable, any other method of dispute resolution. It is noted that Manheim does not accept notice by e-mail or facsimile.

11.11. The Agreement shall be governed and construed and have effect in all respects in accordance with English Law. Each party irrevocably agrees that the courts of England and Wales shall have exclusive jurisdiction to settle any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with this Agreement or its subject matter or formation.

1. DEFINITIONS AND INTERPRETATION

1.1. Capitalised terms shall have the meaning first ascribed to them in this Agreement, including:

2. OVERVIEW

2.1. If the Company subscribes to Services solely for the purpose of Valuations, Manheim shall provide a licence to the Company to access the WebApp.

2.2. If the Company subscribes to eVA Premium Services or eVA Pro Services, Manheim provides a licence to and hosting of the WebApp.

2.3. The WebApp will be embedded (via API integration or container solution) onto the Online Platform for the duration of, and in accordance with, the terms of this Agreement.

2.4. The WebApp will enable:

2.4.1. interface into Manheim’s used vehicle valuation algorithm (“Algorithm”); and

2.4.2. subject to the category of Services contracted by the Company, use by the Company and Retailers of the Output Data as set out in clause 6 of this Appendix; and 2.4.3. Manheim will provide support and maintenance services in accordance with clause 8 (Service Levels) of this Appendix.

3. APPRAISAL AND VALUATION

3.1. This clause 3 is applicable only to a Company subscribing to eVA Premium Services or eVA Pro Services.

3.2. A Consumer visiting the Online Platform will input their details onto the Online Platform and carry out an Appraisal of the Vehicle. The Appraisal is a set process in the WebApp with standard questions and fields to be completed, in order to allow the WebApp to generate a Valuation (“Consumer Appraisal”).

3.3. The Valuation will be valid for a period of 7 days unless otherwise agreed between the parties. Subject to the category of Services contracted by the Company under this Agreement, longer term Valuations may be adjusted to account for depreciation.

3.4. The Valuation is based on the Consumer Appraisal and is dependent on the Consumer’s accuracy and honesty in carrying out the Consumer Appraisal.

3.5. Subject to the category of Services contracted by the Company under this Agreement and the functionality of the Online Platform:

3.5.1. the Consumer will then be given the option to part exchange the Vehicle for a new vehicle from any one of the Retailers; and

3.5.2. the Consumer Appraisal will then be made available to the relevant Retailer. The Retailer will verify the accuracy of the Appraisal, the resulting Valuation and the condition of the Vehicle (“Retailer Appraisal”).

3.6. The Retailer that has completed a Retailer Appraisal will be referred to as the Verifying Retailer.

3.7. The Retailer acknowledges and agrees that any Appraisal and Valuation shall be subject to the Assumptions and that Manheim will not be liable for any incorrect or misleading information which is provided by the Consumer or Verifying Retailer, or any Assumptions which are incorrect that results in an incorrect or incomplete Valuation being provided.

4. ADDITIONAL SERVICES

4.1. The Verifying Retailer, subject to the category of Services provided by Manheim under this Agreement, may:

4.1.1. retain the Vehicle, by purchasing it from the Consumer subject to the terms of clause 5 of this Appendix (“Retailer Purchase”); or

4.1.2. sell the Vehicle through a Manheim auction (subject to Manheim’s standard terms and conditions).

5. RETAILER PURCHASE

If the Verifying Retailer chooses to purchase the Vehicle from the Consumer and retain it, it will agree the purchase terms with the Consumer (“Retailer Purchase”). Manheim shall not be a party to such Retailer Purchase contract.

6. CATEGORY OF SERVICES AND FUNCTIONALITY OF THE OUTPUT DATA AND THE WEBAPP

6.1. The Services provided to the Company and the Retailers by Manheim will be dependent on the category of Services contracted under this Agreement. The different categories are described below:

6.2. Manheim will take reasonable steps to ensure the WebApp is accessible through defined web services in line with the agreed availability and response time requirements set out in Clause 7 of this Appendix.

6.3. For eVA Premium and eVA Pro customers, the WebApp will display:

6.3.1. information inputted by the Consumer on the Online Platform, which is required by Manheim and/or for the Retailer to undertake Appraisal and Valuation;

6.3.2. the ability for the Company or the Retailer to comment on the Vehicle’s condition and the Valuation;

6.3.3. instructions for the Retailer to use the WebApp effectively. 6.4. For eVA Premium and eVA Pro customers the Retailer may adjust the Valuation if it wishes to contribute to the purchase price of the Vehicle. Where the Retailer chooses to increase the Valuation, it can choose to make its contribution to the Valuation invisible to the Consumer. Where the Retailer chooses to decrease the Valuation, this shall be accurately recorded by the Retailer on the WebApp or Manheim’s in-store Appraisal tool for audit purposes.

6.4. For eVA Premium and eVA Pro customers the Retailer may adjust the Valuation if it wishes to contribute to the purchase price of the Vehicle. Where the Retailer chooses to increase the Valuation, it can choose to make its contribution to the Valuation invisible to the Consumer. Where the Retailer chooses to decrease the Valuation, this shall be accurately recorded by the Retailer on the WebApp or Manheim’s in-store Appraisal tool for audit purposes.

6.5. For the avoidance of doubt, any Valuation used by Manheim for the purposes of calculating the purchase price of a Vehicle (where Manheim or an authorised third party has agreed to purchase the Vehicle) shall not include the any Retailer contribution that results in an increased Valuation being provided to the Consumer.

7. SUPPORT AND MAINTENANCE SERVICES

7.1. Manheim will provide support and maintenance services in respect of the WebApp.

7.2. Manheim will provide a helpdesk through which issues with the WebApp and/or Algorithm can be reported by the Company.

8. SERVICE LEVELS

8.1. Subject to the terms of this Agreement, Manheim will use reasonable endeavours to provide the Services in accordance with the Service Levels detailed in the table below.

8.2. Table of Service Levels:

DEFINITIONS AND INTERPRETATION

The following definitions shall apply in these Data Processing Terms:

1. DATA PROTECTION

1.1. The Parties agree that, in connection with the performance of their obligations under the Agreement, they shall comply with all applicable requirements of the Data Protection Legislation.

1.2. The Parties acknowledge that, depending on the configuration of the WebApp, Manheim may collect from a Consumer, Personal Data and provide such Personal Data to the Company

during the term of this Agreement. The purpose of this transfer of Personal Data is to allow the Company to respond to the Consumer’s interest in the purchase of a new vehicle.

1.3. The parties agree that, for the processing of the Personal Data referred to in clause 1.2, the Company shall be the Data Controller and Manheim shall be the Data Processor. Manheim shall, unless required to do otherwise by any applicable law, process the Personal Data only on and in accordance with the Company’s documented instructions set out in clause 1.2 (‘Processing Instructions’).

2. MANHEIM’S OBLIGATIONS

2.1. If any applicable law requires Manheim to process Personal Data other than in accordance with the Processing Instructions, it shall notify the Company of any such requirement before processing the Personal Data. Manheim will not process the Personal Data in a way that does not comply with the Data Protection Legislation and shall notify the Company if, in its opinion, the Processing Instructions would not comply with the Data Protection Legislation.

2.2. Subject to the Company paying Manheim’s reasonable charges, Manheim shall assist the Company in the fulfilment of the Company’s obligations to respond to Data Subject Requests relating to Personal Data.

2.3. Manheim shall in relation to the Personal Data:

2.3.1. refer all Data Subject Requests it receives to the Company within three Business Days of receipt of the request;

2.3.2. subject to the Company paying Manheim’s reasonable charges, provide such information and cooperation and take such action the Company reasonably requests in relation to a Data Subject Request, within any timescale reasonably required by the Company; and

2.3.3. not respond to any Data Subject Request or Complaint without the Company’s prior written approval.

2.4. Manheim shall, subject to the Company paying Manheim’s reasonable costs, provide such information, co-operation and other assistance that the Company requires (considering the nature of processing and the information available to Manheim) to ensure compliance with the Company obligations under Data Protection Legislation, specifically with respect to:

2.4.1. security of processing of Personal Data;

2.4.2. data protection impact assessments (as such term is defined in Data Protection Legislation) that relate to Personal Data;

2.4.3. prior consultation with a Supervisory Authority regarding high risk processing of Personal Data; and

2.4.4. any remedial action and/or notifications in relation to Personal Data to be taken in response to any Personal Data Breach and/or Complaint, including (subject in each case to the Company’s prior written authorisation) regarding any notification of the Personal Data Breach to Supervisory Authorities and/or communication to any affected Data Subjects.

3. TECHNICAL AND ORGANISATIONAL MEASURES

3.1. Manheim shall implement and maintain appropriate technical and organisational measures in relation to the processing of Personal Data by Manheim such that the processing will meet the requirements of Data Protection Legislation, and ensure the protection of the rights of Data Subjects; so as to ensure a level of security in respect of Personal Data processed by it is appropriate to the risks that are presented by the processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data transmitted, stored or otherwise processed.

3.2. Manheim shall ensure that all staff entrusted to handle Personal Data are appropriately trained and have committed themselves to a contractual or legal duty of confidentiality in respect of the Personal Data

4. CROSS-BORDER TRANSFERS OF PERSONAL DATA AND SUB-PROCESSING

4.1. Subject to 4.2, Manheim shall be authorised by the Company to transfer Personal Data outside of the Approved Countries.

4.2. Manheim will process or transfer any Personal Data outside the Approved Countries under the following conditions:

4.2.1. Manheim is processing the Personal Data in a territory which is subject to a current finding by the European Commission, for Personal Data subject to the EU GDPR, or current finding by the UK government, for Personal Data subject to UK GDPR, that the territory provides adequate protection for the privacy rights of individuals and such processing shall be subject to clause 4.4 of this Appendix 3; or

4.2.2. Manheim participates in a valid cross-border transfer mechanism under the Data Protection Legislation, so that Manheim and where appropriate, the Company, can ensure that the appropriate safeguards are in place to ensure an adequate level of protection with respect to the privacy rights of individuals; or

4.2.3. The transfer of any Personal Data otherwise complies with the Data Protection Legislation for the reasons set out in this Appendix 3 or Appendix 1.

4.3. Manheim shall be generally authorised to appoint and use Sub-Processors under the Agreement. Manheim shall maintain a list of Sub-Processors currently in use on its website at https://evavaluations.com/services-terms-and-conditions/. The Company shall have a period of 30 days from the point at which any changes are made to the website to object, on reasonable grounds, to any change in the use of Sub-Processors. If no objection is received within 30 days but the Company has continued to use our products and services the changes shall be deemed as accepted.

4.4. Manheim shall maintain complete, accurate and up to date written records of all categories of processing activities carried out on behalf of the Company, containing such information as the Company may reasonably require, including:

4.4.1. the name and contact details of the Data Processors;

4.4.2. the categories of processing carried out by the relevant Data Processor;

4.4.3. details of any transfers of Personal Data outside of the Approved Countries; and

4.4.4. a general description of the technical and organisational security measures implemented by Manheim as required under the Data Protection Legislation.

5. BREACH NOTIFICATION

5.1. In respect of any Personal Data Breach, Manheim, shall:

5.1.1. notify the Company of the Personal Data Breach without undue delay; and

5.1.2. provide the Company without undue delay with such details as the Company reasonably requires regarding:

5.1.2.1. the nature of the Personal Data Breach, including the categories and approximate numbers of Data Subjects and Personal Data records concerned;

5.1.2.2. any investigations into such Personal Data Breach;

5.1.2.3. the likely consequences of the Personal Data Breach; and

5.1.2.4. any measures taken, or that Manheim recommends, to address the Personal Data Breach, including to mitigate its possible adverse effects,

provided that, (without prejudice to the above obligations) if Manheim cannot provide all these details within such timeframes, it shall (in the same timeframe) provide the Company with reasons for the delay and when it expects to be able to provide the relevant details (which may be phased) and give the Company regular updates on these matters.

5.2. Manheim shall promptly (and in any event within two Business Days) inform the Company if it receives a Complaint and provide the Company with full written details of such Complaint.

6. END OF CONTRACT PROVISIONS

Manheim will, upon termination of the Agreement, delete or return (at the Company’s choice) all the Personal Data processed on behalf of the Company. If no notification to either effect is received from the Company within 30 days of the termination of the Agreement then the Personal Data will be deleted.

7. AUDITS & INSPECTIONS

Manheim will allow for and contribute to audits undertaken by the Company or the Company’s appointed representative. Such audits shall be limited to a review of documentation reasonably required by the Company to demonstrate Manheim’s compliance with the obligations under this Appendix 3. The Company must give a minimum notice of 10 business days, in writing, before such an audit can take place.

DEFINITIONS AND INTERPRETATION

The following definitions shall apply in these Data Processing Terms:

1. DATA PROTECTION

1.1. The Parties agree that, in connection with the performance of their obligations under the Agreement, they shall comply with all applicable requirements of the Data Protection Legislation.

1.2. The parties agree that, for the processing of the personal data collected by the Verifying Retailer collected on Manheim’s behalf (including the Provenance Material), the Verifying Retailer shall be the Data Processor and Manheim shall be the Data Controller.

1.3. The Verifying Retailer shall, unless required to do otherwise by any applicable law, process the Personal Data only on and in accordance with Manheim’s documented instructions (‘Processing Instructions’). The Processing Instructions are detailed in Appendix 2 of this Agreement (Service Descriptions).

2. VERIFYING RETAILER OBLIGATIONS

2.1. If any applicable law requires the Verifying Retailer to process Personal Data other than in accordance with the Processing Instructions, it shall notify Manheim of any such requirement before processing the Personal Data. The Verifying Retailer will not process the Personal Data in a way that does not comply with Data Protection Legislation and shall notify Manheim if, in its opinion, the Processing Instructions would not comply with Data Protection Legislation.

2.2. The Verifying Retailer shall assist Manheim in the fulfilment of Manheim’s obligations to respond to Data Subject Requests relating to Personal Data.

2.3. The Verifying Retailer shall in relation to the Personal Data:

2.3.1. immediately record and then refer all Data Subject Requests it receives to Manheim within three Business Days of receipt of the request;

2.3.2. provide such information and cooperation and take such action Manheim requests in relation to a Data Subject Request, within any timescale reasonably required by Manheim; and

2.3.3. not respond to any Data Subject Request or Complaint without Manheim’s prior written approval.

2.4. The Verifying Retailer shall provide such information, co-operation and other assistance Manheim requires (considering the nature of processing and the information available to the Verifying Retailer) to ensure compliance with Manheim’s obligations under Data Protection Legislation, including with respect to:

2.4.1. security of processing of Personal Data;

2.4.2. data protection impact assessments (as such term is defined in Data Protection Legislation) that relate to Personal Data;

2.4.3. prior consultation with a Supervisory Authority regarding high risk processing of Personal Data; and

2.4.4. any remedial action and/or notifications in relation to Personal Data to be taken in response to any Personal Data Breach and/or Complaint, including (subject in each case to Manheim’s prior written authorisation) regarding any notification of the Personal Data Breach to Supervisory Authorities and/or communication to any affected Data Subjects.

3. TECHNICAL AND ORGANISATIONAL MEASURES

3.1. The Verifying Retailer shall implement and maintain appropriate technical and organisational measures in relation to the processing of Personal Data by the Verifying Retailer such that the processing will meet the requirements of Data Protection Legislation, and ensure the protection of the rights of Data Subjects; so as to ensure a level of security in respect of Personal Data processed by it is appropriate to the risks that are presented by the processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data transmitted, stored or otherwise processed.

3.2. The Verifying Retailer shall ensure that all staff entrusted to handle Personal Data are appropriately trained and have committed themselves to a contractual or legal duty of confidentiality in respect of the Personal Data.

4. CROSS-BORDER TRANSFERS OF PERSONAL DATA AND SUB-PROCESSING

4.1. The Verifying Retailer shall not transfer any Personal Data to any country outside the Approved Countries without the Manheim’s prior written consent.

4.2. If consent is given under clause 4.1, the Verifying Retailer will only process or transfer any Personal Data outside the Approved Countries under the following conditions:

4.2.1. the Verifying Retailer is processing the Personal Data in a territory which is subject to a current finding by the European Commission, for Personal Data subject to the EU GDPR, or current finding by the UK government, for Personal Data subject to UK GDPR, that the territory provides adequate protection for the privacy rights of individuals and such processing shall be subject to clause 4 of this Appendix 4; or

4.2.2. the Verifying Retailer participates in a valid cross-border transfer mechanism under the Data Protection Legislation, so that the Verifying Retailer can ensure that the appropriate safeguards are in place to ensure an adequate level of protection with respect to the privacy rights of individuals; or

4.2.3. the transfer of any Personal Data otherwise complies with the Data Protection Legislation for the reasons set out in this Appendix 4 or Appendix 1 (Terms and Conditions).

4.3. The Verifying Retailer may not appoint a third-party processor of Personal Data under the Agreement without Manheim’s prior written consent which shall not be unreasonably withheld.

4.4. The Verifying Retailer shall maintain complete, accurate and up to date written records of all categories of processing activities carried out on behalf of Manheim, containing such information as Manheim may reasonably require, including:

4.4.1. the name and contact details of the Data Processors;

4.4.2. the categories of processing carried out by the relevant Data Processor;

4.4.3. details of any transfers of Personal Data outside of the Approved Countries; and

4.4.4. a general description of the technical and organisational security measures implemented by the Verifying Retailer as required under the Data Protection Legislation.

5. BREACH NOTIFICATION

5.1. In respect of any Personal Data Breach, the Verifying Retailer, shall:

5.1.1. notify Manheim of the Personal Data Breach without undue delay (and always within 1 Business Day after becoming aware of the Personal Data Breach); and

5.1.2. provide Manheim without undue delay (wherever possible, no later than 48 hours after becoming aware of the Personal Data Breach) with such details as Manheim reasonably requires regarding:

5.1.2.1. the nature of the Personal Data Breach, including the categories and approximate numbers of Data Subjects and Personal Data types and records concerned;

5.1.2.2. any investigations into such Personal Data Breach;

5.1.2.3. the likely consequences of the Personal Data Breach; and

5.1.2.4. any measures taken, or that the Verifying Retailer recommends, to address the Personal Data Breach, including to mitigate its possible adverse effects,

provided that, (without prejudice to the above obligations) if the Verifying Retailer cannot provide all these details within such time frames, it shall (in the same timeframe) provide Manheim with reasons for the delay and when it expects to be able to provide the relevant details (which may be phased) and give Manheim regular updates on these matters.

5.2. The Verifying Retailer shall promptly (and in any event within two Business Days) inform Manheim if it receives a Complaint and provide Manheim with full written details of such Complaint.

6. END OF CONTRACT PROVISIONS

The Verifying Retailer will, upon termination of the Agreement, delete or return (at Manheim’s choice) all the Personal Data processed on behalf of Manheim.

7. AUDITS & INSPECTIONS

The Verifying Retailer will allow for and contribute to audits undertaken by Manheim or Manheim’s appointed representative. Such audits shall be limited to a review of documentation reasonably required by Manheim to demonstrate Verifying Retailer’s compliance with the obligations under this Appendix 4.

Sub-processors used to provide the core functionality of the eVA service

Published: 1st May 2021