Membership Review
Draft, for lawyer review. This text has not been reviewed by a lawyer yet and may change.

Data processing addendum

Draft prepared 2026-10-17. Not yet reviewed by a lawyer.

This addendum forms part of the agreement between [Entity name pending] ("Provider") and the car wash business that subscribes to Membership Review ("Customer").

Key clauses

  1. Roles. Customer is the controller (CCPA: "business") of Member Personal Data; [Entity name pending] is the processor ("service provider"). [Entity name pending] is an independent controller only of Customer account data (wash-owner names, logins, billing).
  2. Instructions; nature, purpose, duration, data types (TDPSA 541.104(b)(1)-(5)). Annex 1 lists: purpose "administration of Customer's unlimited-wash membership programme, including verification that memberships are used on the registered vehicle, security of Customer's premises, and defence of related disputes"; data types (plates, vehicle images, vehicle descriptions, member identifiers and contact data received from Customer's membership provider, visit timestamps, review outcomes); duration = subscription term plus the deletion period.
  3. Processing limits (CCPA 7051(a)(1)-(4)). [Entity name pending] shall not sell or share Customer Personal Data; shall not retain, use or disclose it for any purpose other than the specified business purposes; shall not use it outside the direct business relationship; and shall not combine it with personal information from any other source except as the CCPA regulations expressly permit. [Entity name pending] waives even that permission, except for security and fraud detection within Customer's own tenant.
  4. No secondary use, including de-identified data. Repeat 7.1 sections 3 and 3a. Add: "[Entity name pending] shall not create or retain de-identified or aggregated data derived from Customer Personal Data for any purpose other than returning it to Customer. Any profile, index, weighting or model derived from Customer Data is Customer Data, is used solely to provide the Service to Customer, and is returned or deleted with it."
  5. No biometrics. [Entity name pending] shall not generate, store or compare biometric identifiers or templates (as defined in Tex. Bus. & Com. Code 503.001, 740 ILCS 14/10, and similar laws) from Customer Data, and shall configure all subprocessors to prevent it.
  6. Confidentiality (541.104(b)(6)(A)). Every person processing Customer Data is bound by written confidentiality obligations that survive the end of their work.
  7. Security. Encryption in transit and at rest with per-tenant keys; multi-factor authentication for all staff; least privilege; logging of all access; an annual third-party penetration test; vulnerability management; and an incident response plan.
  8. Subprocessors (541.104(b)(6)(E); 7051(a)(8)). The list is at Annex 3; equivalent terms are flowed down in writing; [30] days' advance notice of changes; Customer has a right to object and terminate; [Entity name pending] is liable for its subprocessors.
  9. Assistance (541.104(a); 7051(a)(9)). Consumer rights requests (access, correction, deletion, portability, opt-out) are answered within [5] business days of Customer forwarding them; [Entity name pending] assists with breach response and data protection assessments.
  10. Audit (541.104(b)(6)(C)-(D), (c)). Compliance information is provided on request; Customer may assess annually, or rely on an independent assessor's report such as a SOC 2 Type II when one is available; Customer may take reasonable steps to stop and remediate unauthorised use (7051(a)(7)).
  11. Notice of inability to comply (7051(a)(6)). [Entity name pending] notifies Customer within [5] business days if it determines it can no longer meet these obligations; Customer may then suspend processing and terminate.
  12. Breach notification. Within [72 hours] of confirmation, with the content required by Tex. Bus. & Com. Code 521.053(i); and cooperation with regulators.
  13. Deletion or return at end (541.104(b)(6)(B)). As in 7.1 section 8, with a certificate of deletion; any legally required retention is identified in writing.
  14. Support access. As in 7.1 section 5. The access log is available to Customer.
  15. Data location. United States only, unless Customer agrees otherwise in writing.
  16. Government and third-party requests. As in 7.1 section 12.
  17. Liability. As in the agreement. [Entity name pending]'s indemnity for breach of clauses 3 to 5 is not subject to the general cap, or is subject to a higher data cap.
  18. State riders. California (the CCPA terms above, with a certification that [Entity name pending] understands and will comply); Colorado, Virginia, Connecticut and Texas (processor terms are materially identical); Illinois (no biometric processing representation).

Questions about this addendum: hello@washattest.com.