Snapshot 62552
Normalized text
Scripts and page chrome removed; this is what change detection compares.
DATA PROCESSING AGREEMENT
This Data Processing Agreement (DPA) is an exhibit to the Terms and Conditions and forms an integral
part of the Agreement entered into by Nextlane and the Customer.
Capitalized terms used but not defined in this Data Processing Agreement shall have the meanings
provided in Nextlane’s Terms and Conditions.
1. Definitions
For the purpose of this DPA, the capitalized terms shall have the meaning set forth below:
1.1 "Data Protection Laws” shall have the meaning set forth in article 1.16 of Nextlane Terms and
Conditions.
1.2 "Data Breach” means any event leading to the accidental or unlawful destruction, loss,
alteration, unauthorized disclosure of or access to the Customer’s Personal Data by any third
party.
1.3 “Data Controller” or “Controller” means the legal person which determines the purposes and
means of the Processing of Personal Data.
1.4 “Data Processor” or “Processor” means the legal person which processes Personal Data on
behalf of the Data Controller and in accordance with its instructions.
1.5 "Data Subject" means an identified or identifiable natural person whose Personal Data is being
processed under this DPA.
1.6 “Personal Data” means any information relating to a Data Subject.
1.7 "Processing” and “Process” means any operation or set of operations which is performed on
Personal Data or on sets of Personal Data, whether by automated means, such as collection,
recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use,
disclosure by transmission, dissemination or otherwise making available, alignment or
combination, restriction, erasure or destruction. The Processing is described in Annex
“Processing description” attached to this DPA.
2. Processing
The Parties acknowledge that for the performance of the Agreement, the Customer acts as Data
Controller and that Nextlane acts as a Data Processor.
3. Obligations of Nextlane as Data Processor
3.1 General obligations
Nextlane undertakes to:
(i) process the Personal Data in accordance with Customer’s documented instructions and
for the sole purposes set forth in Annex “Processing description”.
(ii) notify immediately Customer if Nextlane considers that an instruction constitutes a
violation of the Data Protection Laws.
(iii) not to use the Personal Data for purposes other than those necessary for the performance
of this DPA.
(iv) ensure that the persons authorized to Process Personal Data under this DPA are
committed to confidentiality or are subject to an appropriate legal obligation of
confidentiality and receive the necessary training regarding personal data protection.
(v) take all appropriate measures, including physical security measures, to ensure the
protection of the Personal Data throughout the duration of the Agreement.
(vi) to comply with the retention periods provided in Annex “Processing description”.
3.2 Security and confidentiality
Nextlane undertakes to implement the appropriate technical and organizational measures in order
to ensure a level of security appropriate to the risk, including, among other things:
(i) means to ensure the ongoing confidentiality, integrity, availability and resilience of
processing systems and services.
(ii) means to restore the availability of, and access to, Personal Data within an appropriate
timeframe in the event of a physical or technical incident.
(iii) a procedure for regularly testing, analyzing and evaluating the effectiveness of technical
and organizational measures for ensuring the security of processing.
3.3 Assistance to the Customer
Nextlane undertakes to:
(i) assist the Customer to fulfil its obligation to respond to Data Subjects’ requests. When
Data Subjects send requests to Nextlane to exercise their rights, Nextlane shall forward
these requests to the Customer.
(ii) assist the Customer to perform data privacy impact assessments of the Processing carried
out under the Agreement (if such assessment is required by Data Protection Laws).
(iii) make available to the Customer the necessary documentation to demonstrate compliance
with its obligations under the Data Protection Laws and to contribute to audits under the
conditions set forth in article 3.8 “Audit”.
3.4 Data Breach
Nextlane shall notify the Customer of any Data Breach as quickly as possible after being made
aware of it. This notification shall include all useful documentation in order to enable the
Customer, if necessary, to notify the competent authority and / or the Data Subjects of this
violation and in particular:
(i) a description of the nature of the Data Breach including, if possible, the categories and
approximate number of Data Subjects and Personal Data records concerned.
(ii) a description of the likely consequences of the Data Breach.
(iii) a description of the measures taken or proposed to be taken by the Customer to address
the Data Breach, including, where appropriate, measures to mitigate any adverse
consequences.
3.5 Subcontracting
The Customer authorizes Nextlane to engage subcontractors ("the Subsequent Data Processor")
for carrying out specific processing activities on behalf of the Customer.
The List of authorized Subsequent Data Processor is provided in Annex “Processing description”.
Where applicable, Nextlane is required to inform the Customer in advance of any planned
modifications concerning the addition or replacement of other Subsequent Data Processor, giving
the Customer the possibility of objecting to such modifications for a legitimate reason.
In the absence of written objection from the Customer within 10 (ten) Business Days following
the notification sent by Nextlane, the Customer shall be deemed to have accepted the addition or
replacement of the Subsequent Data Processor.
In the event of a legitimate objection by the Customer regarding the addition or replacement of a
Subsequent Data Processor, the Parties shall meet as soon as possible to find an alternative
solution that is commercially reasonable for Nextlane. If no amicable solution can be found within
a reasonable time, the Agreement may be terminated by either Party.
The Subsequent Data Processor shall be committed to comply with the Customer’s instructions.
Nextlane shall ensure that the Subsequent Data Processor offers the same sufficient guarantees
regarding the implementation of appropriate technical and organizational measures. Nextlane
remains liable to the Customer for the performance by the Subsequent Data Processor of its
obligations.
3.6 Territory and hosting
Nextlane does not transfer any Personal Data from Switzerland and/or from the EEA to a third
country that does not provide an adequate level of protection (as defined by article 16.1 of the
nFADP and articles 44 et seq of GDPR) without taking appropriate safeguards required by
Applicable Laws.
3.7 Disclosure of Personal Data
Nextlane will not disclose or provide access to any Personal Data to law enforcement unless
required by Applicable Law. If law enforcement contacts Nextlane with a demand for Personal
Data, Nextlane will redirect the law enforcement agency to request these Personal Data directly
from the Customer. If compelled to disclose or provide access to any Personal Data to law
enforcement, Nextlane will promptly notify the Customer and provide a copy of the demand
unless legally prohibited from doing so.
3.8 Audit
To the extent Customer’s audit requirements cannot reasonably be satisfied through audit reports
and documentation Nextlane makes generally available to Customer, Nextlane will promptly
respond to Customer’s additional audit instructions.
Before the commencement of an audit, Nextlane and the Customer will mutually agree upon the
scope, timing, and duration of the audit. To the extent needed to perform the audit, Nextlane will
make the systems and supporting documentation relevant to the processing of Customer’s
Personal Data available.
Such an audit will be conducted by the Customer or by an independent, accredited third-party
audit firm, during regular business hours, with advance notice of at least 15 (fifteen) Business
Days and subject to confidentiality obligation. Neither the Customer nor the auditor shall have
access to any data from Nextlane’s other customers or to Nextlane systems or facilities not
involved in the Services.
Customer shall bear all costs and fees related to the audit, including reasonable costs for the time
Nextlane expends for such audit. The audit report generated as a result of the audit shall be shared
with Nextlane. If the audit report includes any finding of a material non-compliance, Nextlane
shall promptly cure such non-compliance.
3.9 Termination
Upon termination of the Agreement, Nextlane undertakes to destroy all manual or computerized
files storing the Personal Data and any existing copies thereof, unless Applicable Law requires
their retention.
4. Obligations of the Customer as Data Controller
The Customer acting as Data Controller, shall comply with Data Protection Laws and in particular
undertakes to:
(i) ensure that Data Subjects’ rights are respected. In particular, the Customer is solely
responsible for providing the Data Subjects with accurate and complete information
regarding the Processing of their Personal Data.
(ii) document in writing any instructions given to Nextlane regarding the Processing of
Personal Data carried out by Nextlane or its Subsequent Data Processor under the
Agreement.
(iii) comply with the purposes of the Processing.
(iv) refrain from providing Nextlane with instructions that may contravene the Data
Protection Laws.
(v) carry out all procedures, assessments and authorizations that may be required by Data
Protection Laws to Process the Personal Data.
In this context, the Customer shall hold harmless and indemnify Nextlane against the financial
and legal consequences of any action, claims, or dispute that may be brought against Nextlane
based on the failure of the Customer to comply with its legal obligations as Data Controller.
5. Contact persons in charge of data privacy
- For Nextlane: dpo@nextlane.com
- For the Customer: [name and email address]
ANNEX to the Data Processing Agreement
Description of ERIS MOTORS
Controller
The Data Controller is the Customer of Nextlane.
Nature and purpose of Processing
• Nature of the Processing:
Collection of Data Controller’s customers and/or prospects and/or employee’s personal data by
the Data Controller that are integrated in the DMS of the Data Processor, with the objective of
enhancing the services that the Data Controller can provide to its own customers.
The processing can relate to the sales of vehicles, after-sales activities, spare parts management,
and accounting management depending on the type of subscription selected by the Data
Controller. The Processing also covers the connection with relevant car manufacturers to provide
multiple services and manage customers’ interaction.
• Purposes of Processing are the following:
depending on the services subscribed by the Data Controller:
- Support for the Data Controller in managing its relationship with its Prospects:
o Organisation of vehicle test
- Support for the Data Controller in managing its relationship with its Customers:
o Management of vehicle purchase
o Management of vehicle trade-in
o Organization of vehicle maintenance and test
o Management of parts orders and warranty with the OEM
o Management of courtesy vehicle
o Management of registration process of the vehicle
- Support for the Data Controller in managing its internal organizational
o Workshop organization
o Courtesy vehicle management.
Retention period
The Data Controller shall provide to the Data Processor the retention policy of personal data, which
is aligned with the principles provided by Applicable Law.
Nextlane – DPA – Eris Motors DMS – September 2024
Categories of Data Subjects
The Personal Data processed by the Data Processor are related to the following categories of Data
Subjects:
Management of Management of Data
Management of
Data Subject categories Prospects Controller’s internal
Customers
organization
Data Controller’s Prospects X X
Data Controller’s
X X X
Employees
Data Controller’s
X X
Customers
Data Controller’s Suppliers X X
Car driver X X X
Categories of Personal Data
Personal Data processed relate to the following categories:
For the purpose of management of Data Controller’s Prospects
Category of Personal Data Details
Gender, name, surname, address, phone number,
Civil Status, ID, identification data
e-mail address
Economic and financial information Bank account number, workplace and title
For the purpose of management of Data Controller’s Customers
Category of Personal Data Details
Gender, name, surname, address, phone number,
Civil Status, ID, identification data
e-mail address
Economic and financial information Bank account number
Information related to the vehicle Vehicle Identification Number, license plate
Other type of Personal Data Language
Nextlane – DPA – Eris Motors DMS – September 2024
For the purpose of management of Data Controller’s internal organization
Category of Personal Data Details
Civil Status, ID, identification data Name, surname
• Contact in charge of Data Protection matter
Data Controller Data Processor
Name: [•] Email address: dpo@nextlane.com
Email address: [•] Postal address: 190 avenue Thiers, 69006
Lyon, France
Postal address: [•]
Location(s) of Processing operations
- The Data Processor operates in the European Union and Switzerland.
- The Data Controller operates in __________________
Data transfer outside of the EEA and/or of Switzerland or to a country without an adequacy
decision
Non applicable
List of Subsequent Data Processors
The Subsequent Data Processors used by the Data Processor depends on the one hand on the add-
ons subscribed by the Data Controller, and on the other hand, on the contracts that the Data
Controller has with the vehicle manufacturers. In addition, some of the subsequent processings
mentioned below might be available on specific countries.
Therefore, the DPA will be updated based on the information provided by the Data Controller.
As an illustration purpose, only the main Subsequent Data Processors are:
Name Location Processing activity
TMS France MiSIV is a Solution dealing with the registration of
the vehicle (TMS is a Data Processor’s Group
company)
Esker France Digital invoice solution
Nextlane – DPA – Eris Motors DMS – September 2024
ANNEX to the Data Processing Agreement
Description of I’CAR DMS
Controller
The Data Controller is the Customer of Nextlane.
Nature and purpose of Processing
• Nature of the Processing:
Collection of Data Controller’s customers and/or prospects and/or employee’s personal data
by the Data Controller that are integrated in the DMS of the Data Processor, with the objective
of enhancing the services that the Data Controller can provide to its own customers.
The processing can relate to the sales of vehicles, after-sales activities, spare parts
management, and accounting management depending on the type of subscription selected by
the Data Controller. The Processing also covers the connection with relevant car
manufacturers to provide multiple services and manage customers’ interaction.
• Purposes of Processing are the following:
depending on the services subscribed by the Data Controller:
- Support for the Data Controller in managing its relationship with its Prospects:
o Management of leads
o Management of vehicle offers
o Organisation of vehicle test
o Management of marketing campaigns.
- Support for the Data Controller in managing its relationship with its Customers:
o Management of vehicle purchase
o Management of vehicle trade-in
o Organization of vehicle maintenance and test
o Management of parts orders and warranty with the OEM
o Management of courtesy vehicle
o Management of registration process of the vehicle
o Storage of administrative documents
o Management of marketing campaigns
o Publishing of Used Car pictures and information on Web sites
o Evaluation of vehicle value
- Support for the Data Controller in managing its internal organizational
o Workshop organization
o Courtesy vehicle management
o Time recording of its Employees
o Sales related commission and/or incentives of its Employees.
Nextlane – DPA – I’CAR DMS – September 2024
Retention Period
The Data Controller shall provide to the Data Processor the retention policy of personal data,
which is aligned with the principles provided by Applicable Law.
Categories of Data Subjects
The Personal Data processed by the Data Processor are related to the following categories of Data
Subjects:
Management of Data
Management of Management of
Data Subject categories Controller’s internal
Prospects Customers
organization
Data Controller’s Prospects X X
Data Controller’s
X X X
Employees
Data Controller’s
X X
Customers
Data Controller’s Suppliers X X
Car driver X X X
Categories of Personal Data
Personal Data processed related to the following categories:
For the purpose of management of Data Controller’s Prospects
Category of Personal Data Details
Gender, name, surname, address, phone number,
Civil Status, ID, identification data e-mail address, ID number, driving license
number, date of birth, place of birth
Economic and financial information Bank account number, workplace and title
Vehicle Identification Number, license plate,
Information related to the vehicle
insurance number
Personal information Interest, hobbies,
Other type of Personal Data Language
Nextlane – DPA – I’CAR DMS – September 2024
For the purpose of management of Data Controller’s Customers
Category of Personal Data Details
Gender, name, surname, address, phone number,
Civil Status, ID, identification data e-mail address, ID number, driving license
number, date of birth, place of birth
Economic and financial information Bank account number
Vehicle Identification Number, license plate,
Information related to the vehicle
insurance number
Other type of Personal Data Language, consent form
For the purpose of management of Data Controller’s internal organization
Category of Personal Data Details
Name, Surname, Address, ID number, Phone
Civil Status, ID, identification data
number, e-mail address
Internal employee ID, working date and absence
Information related to employment
time, date of sales, commissions and incentives
Contact in charge of Data Protection matter
Data Controller Data Processor
Name: [•] Email address: dpo@nextlane.com
Email address: [•] Postal address: 190 avenue Thiers, 69006 Lyon,
Postal address: [•] France
Location(s) of Processing operations
- The Data Processor operates in the European Union and Switzerland.
- The Data Controller operates in __________________
Data transfer outside of the EEA and/or of Switzerland or to a country without an adequacy
decision
Non applicable
Nextlane – DPA – I’CAR DMS – September 2024
List of Subsequent Data Processors
The Subsequent Data Processors used by the Data Processor depends on the one hand on the add-
ons subscribed by the Data Controller, and on the other hand, on the contracts that the Data
Controller has with the vehicle manufacturers. In addition, some of the subsequent processing
mentioned below might be available in specific countries.
Therefore, the DPA will be updated based on the information provided by the Data Controller.
As an illustration purpose, only the main Subsequent Data Processors are:
Name Location Processing activity
MiSIV is a Solution dealing with the registration of
TMS France the vehicle (TMS is a company of the Data Processor
Group)
LPN is a Solution dealing with the management of
TMS France
official document related to sales of vehicle
Esker France Digital invoice solution interfaced
SAGE France Solution for accounting purpose
AMS Germany Integration Partner
3DSoft France Mecaplanning – organisation of the workshop
Management of vehicle (creation of file on new
Autovista France
vehicle, vehicle specifications)
Nextlane – DPA – I’CAR DMS – September 2024
ANNEX to the Data Processing Agreement
Description of KOBRA II DMS
Controller
The Data Controller is the Customer of Nextlane.
Nature and purpose of Processing
• Nature of the Processing:
Collection of Data Controller’s customers personal data by the Data Controller that are
integrated in the DMS of the Data Processor, with the objective of enhancing the services that
the Data Controller can provide to its own customers, in Sweden automotive market.
The Processing can relate to the sales of vehicles, after-sales activities, spare parts and repair
management, depending on the type of subscription selected by the Data Controller. The
Processing also covers the connection with relevant car manufacturers to provide multiple
services and manage customers’ interaction.
• Purposes of Processing are the following:
Depending on the services subscribed by the Data Controller:
- Support for the Data Controller in managing its relationship with its Customers:
o Management of vehicle purchase
o Management of vehicle trade-in
o Organization of vehicle maintenance and test
o Management of parts orders and warranty with the OEM
o Management of courtesy vehicle
o Management of registration process of the vehicle
o Storage of administrative documents.
- Support for the Data Controller in managing its internal organization:
o Workshop organization
o Courtesy vehicle management.
Retention period
The Data Controller shall provide to the Data Processor the retention policy of Personal Data,
which is aligned with the principles provided for by Applicable Law.
Nextlane – DPA – KOBRA II DMS – September 2024
Categories of Data Subjects
The Personal Data processed by the Data Processor are related to the following categories of Data
Subjects:
Management of Data
Management of
Data Subject categories Controller’s internal
Customers
organization
Data Controller’s
X X
Employees
Data Controller’s
X X
Customers
Data Controller’s Suppliers X X
Car driver X X
Categories of Personal Data
Personal Data processed relates to the following categories:
For the purpose of management of Data Controller’s Customers
Category of Personal Data Details
Gender, name, surname, address, phone number,
Civil Status, ID, identification data related e-mail address, ID number, driving license
to Customers/drivers
number, date of birth.
Vehicle Identification Number, license plate,
Information related to the vehicle
insurance number
Other type of Personal Data Language, consent form
For the purpose of management of Data Controller’s internal organization
Category of Personal Data Details
Gender, name, surname, address, phone number,
Civil Status, ID, identification data
e-mail address
Vehicle Identification Number, license plate,
Information related to the vehicle
insurance number
Nextlane – DPA – KOBRA II DMS – September 2024
Contact in charge of Data Protection matter
Data Controller Data Processor
Name: [•] Email address: dpo@nextlane.com
Email address: [•] Postal address: 190 avenue Thiers, 69006
Lyon, France
Postal address: [•]
Location(s) of Processing operations
- The Data Processor operates in the European Union and Switzerland.
- The Data Controller operates in __________________
Data transfer outside of the EEA and/or of Switzerland or to a country without an adequacy
decision
Transfer occurs through the Subsequent Data Processor mentioned below to Philippines for
digitization of documents by CGI Philippines Inc. Such transfer from C.G.I Sverige AV to C.G.I.
Philippines Inc. is covered by BCR.
List of Subsequent Data Processors
The Subsequent Data Processors used by the Data Processor depends on the one hand on the add-
ons subscribed by the Data Controller, and on the other hand, on the contracts that the Data
Controller has with the vehicle manufacturers. In addition, some of the subsequent processings
mentioned below might be available in specific countries.
Therefore, the DPA will be updated based on the information provided by the Data Controller.
As an illustration purpose, only the main Subsequent Data Processors are:
Name Location Processing activity
Digitization of documents with sub-processors in EU
C.G.I. Sverige AB Sweden
and Philippines
Agda Payroll system : time stamp function and
Visma AB Sweden
payroll costs
Gordion AB Sweden self-service kiosk for repair
Quadratura Nordic
Sweden self-service kiosk for repair
AB
Autoinnovation ApS
Sweden self-service kiosk for repair
(tjekvik)
Nextlane – DPA – KOBRA II DMS – September 2024
Name Location Processing activity
Digital solutions for the automotive industry, focusing
Bilvision AB Sweden
on vehicle data and systems.
Offers software and services related to automotive
Clifford Thames UK
data and supply chain management.
Atoy Automotive Distributes automotive spare parts and provides
Sweden
Sweden AB related services across Scandinavia.
Resurs Bank A Nordic bank offering consumer finance, payment
Sweden
Aktiebolag solutions, and savings products.
EXDE Systems AB Provides software and IT solutions, specializing in
Sweden
(BUMS) management systems for businesses.
Develops software for the insurance and automotive
CAB Group AB Sweden industries, particularly around repair and claims
management.
Offers digital solutions and consultancy for business
Wisentic AB Sweden
process optimization.
Provides enterprise-level software, data, and solutions
Snap-on Business that help manage parts, service, and sales operations
UK
Solutions Inc for manufacturers and dealerships in the automotive,
construction, and powersports industries
Focuses on customer interaction solutions, including
NG Dialogue AB Sweden
telemarketing and customer service outsourcing.
Autoexperten I A Swedish chain of automotive repair shops and spare
Sweden
Sverige AB parts distributors.
A leading European company in the automotive
Meko AB Sweden aftermarket sector, providing services and products
for vehicle maintenance.
Global provider of software solutions that help
automotive dealerships and manufacturers manage
Infomedia Ltd UK parts, service, and customer relations, specializing in
electronic parts catalogues, service quoting, and data
analytics
Develops software solutions, particularly focused on
Sweet Systems AB Sweden
vehicle fleet management and logistics.
Transdev Sverige An international company offering public transport
Sweden
AB services, including bus, tram, and train operations.
Nextlane – DPA – KOBRA II DMS – September 2024
Name Location Processing activity
One of Norway's largest financial institutions,
DNB Bank Norway
offering banking, investment, and insurance services.
Automotive software company providing digital
Keyloop UK
solutions for car dealerships and manufacturers.
Specializes in customer loyalty solutions, including
Loyalty Logistix UK software for customer engagement and retention
programs.
Biluthyrarna Sverige A Swedish association representing car rental
Sweden
AB companies and related services.
A leading global manufacturer of lubricants and fluids
Castrol UK
for automotive, industrial, and marine applications.
An online platform for automotive spare parts,
Bildelsbasen AB Sweden serving consumers and businesses in the Nordic
region.
InMoment (Vital Customer experience management and feedback
Canada
Insights) solutions, particularly in the automotive sector.
A division of ETL Solutions specializing in data
ETL Solutions
UK integration for automotive companies, particularly
(Mobis)
Hyundai Mobis.
Mercur Solutions A Swedish company providing performance
Sweden
AB management and business intelligence software.
A Swedish branch of the global advisory, broking, and
solutions company, providing services in risk
Willis Towers
Sweden management, insurance brokerage, human capital
Watson Sweden AB
consulting, and benefits management to businesses
across various industries.
Care of CRM AB Provides customer relationship management (CRM)
Sweden
(Cirrus) solutions and consulting services.
A Swedish company specializing in the sale of used
Recopart AB Sweden
automotive spare parts.
A Swedish payment service company providing
Bankgirocentralen
Sweden clearing and settlement of transactions between
BGC Aktiebolag
banks.
Offers accounts payable automation solutions for
Rillion AB Sweden
businesses, helping to streamline invoice processing.
Nextlane – DPA – KOBRA II DMS – September 2024
ANNEX to the Data Processing Agreement
Description of MaxSat
Controller
The Data Controller is the Customer of Nextlane.
Nature and purpose of Processing
• Nature of the Processing:
The Processing consists of the use of personal data from the Data Controller’s customers to
launch customer satisfaction surveys and to publish their comments and rating on a specific
webpage of the Data Processor.
• Purposes of Processing are the following:
- Operation relating to the collection of satisfaction following invoicing (score, comment,
dissatisfaction criteria, if necessary, type of intervention carried out).
- Operations relating to the restitution, to the Data Controller, of the opinion of its
customers in tools with specific access by the Data Controller and elaboration of
anonymous statistical reports on responses.
- Identification of a purchase project.
- Option to share said review on third review platforms: collection of consent from Data
Controller’s Customers.
Retention period
The Data Controller shall provide to the Data Processor the retention policy of personal data, which
is aligned with the principles provided by Applicable Law.
Categories of Data Subjects
The Personal Data processed by the Data Processor are those of the Data Controller’s invoiced
Customers.
Nextlane – DPA – MaxSat – September 2024
Categories of Personal Data
- For the purpose of collecting satisfaction following invoicing
Category of Personal Data Details
Name, surname, address, phone number, e-mail
Civil Status, ID, identification data
address
Economic and financial information Invoice number
Date of the intervention or delivery of the
Information related to the vehicle
vehicle, brand and model of the vehicle
Connection data IP address, logs
- For the purpose of restitution of the opinion of the Customer
Category of Personal Data Details
Civil Status, identification data Name, surname, or alias
brand and model of the vehicle, new or used
Information related to the vehicle
vehicle category
Others Space available for free comments
Connection data IP address, logs
- For the purpose of identification of a purchase project
Category of Personal Data Details
Civil Status, identification data Name, surname, or alias
New or used vehicle brand and model of the
Information related to the vehicle
vehicle,
Connection data IP address, logs
- For the purpose of sharing said review on third platforms:
Category of Personal Data Details
Civil Status, identification data Name, surname, e-mail address
various Rating score
Nextlane – DPA – MaxSat – September 2024
Location(s) of Processing operations
- The Data Processor operates in the European Union, and Switzerland.
- The Data Controller operates in __________________
Data transfer outside of the EEA and/or of Switzerland or to a country without an adequacy
decision
Non applicable
List of Subsequent Data Processors
The Subsequent Data Processors used by the Data Processor depends on the one hand on the add-
ons subscribed by the Data Controller, and on the other hand, on the contracts that the Data
Controller has with the vehicle manufacturers. In addition, some of the subsequent processing
mentioned below might be available on specific countries.
Therefore, the DPA will be updated based on the information provided by the Data Controller.
As an illustration purpose, only the main Subsequent Data Processors are:
Name Location Processing activity
AWS European Storage – cloud solution
Union
Mailgun European Launch of e-mail campaigns
Union
SMS Factors FRANCE Launch of text campaigns
Nextlane – DPA – MaxSat – September 2024
ANNEX to the Data Processing Agreement
Description of BI360
Controller
The Data Controller is the Customer of Nextlane.
Nature and purpose of Processing
• Nature of the Processing:
BI360 is integrated solutions with the Data Processor’s DMS (Dealer Management Systems)
and CRM (Customer Relationship Management). It enables the Data Controller to create its
own performance indicators related to the sale and servicing of used and new cars.
• Purposes of Processing are the following:
- Create reports and KPI
- Improvement of the Data Controller’s performance by using the data issued from the DMS
and/or CRM
Retention period
The Data Controller shall provide to the Data Processor the retention policy of personal data, which
is aligned with the principles provided by Applicable Law.
Categories of Data Subjects
The Personal Data processed by the Data Processor are related to the following categories of Data
Subjects:
Data Subject categories
Data Controller’s Prospects X
Data Controller’s Customers X
Categories of Personal Data
Personal Data processed relate to the following categories:
Category of Personal Data Details
Name, surname, address, phone number,
Civil Status, ID, identification data
Customer ID
Vehicle Identification Number, license plate
Data linked to a vehicle
number
Nextlane – DPA – BI360 – September 2024
Contact in charge of Data Protection matter
Data Controller Data Processor
Name: [•] Email address: dpo@nextlane.com
Email address: [•] Postal address: 190 avenue Thiers, 69006 Lyon,
France
Postal address: [•]
Location(s) of Processing operations
- The Data Processor operates in the European Union, and Switzerland.
- The Data Controller operates in __________________
Data transfer outside of the EEA and/or of Switzerland or to a country without an adequacy
decision
None
List of Subsequent Data Processors
None
Nextlane – DPA – BI360 – September 2024
ANNEX to the Data Processing Agreement
Description of DataCar
Controller
The Data Controller is the Customer.
Nature and purpose of Processing
• Nature of the Processing:
Collection of Data Controller’s customers and/or prospects and/or employee’s Personal
Data by the Data Controller that are integrated in the DMS of the Data Processor, with
the objective of enhancing the services and sales that the Data Controller can provide to
its own Customers.
The Processing can relate to the sales of vehicles, after-sales activities, spare parts
management, and accounting management depending on the type of subscription selected
by the Data Controller.
• Purposes of Processing are the following:
Depending on the services subscribed by the Data Controller:
- Support for the Data Controller in managing its relationship with its customers:
o Management of vehicle purchase
o Management of vehicle trade-in
o Organization of vehicle maintenance and test
o Management of courtesy vehicle
o Management of registration process of the vehicle
o Storage of administrative documents
- Support for the Data Controller in managing its internal organizational
o Workshop organization
o Courtesy vehicle management
Retention period
The Data Controller shall provide to the Data Processor the retention policy of personal data,
which is aligned with the principles provided by Applicable Law.
Nextlane – DPA – DATACAR DMS – September 2024
Categories of Data Subjects
The Personal Data processed by the Data Processor are related to the following categories of
Data Subjects:
Management of Data
Management of Customer
Controller’s Employees
Data Controller’s Employees X X
Data Controller’s Customers X
Data Controller’s Suppliers X
Car driver X
Categories of Personal Data
Personal Data processed relate to the following categories:
For the purpose of management of Data Controller’s Customers
Category of Personal Data Details
Gender, name, surname, address, phone number,
Civil Status, ID, identification e-mail address, ID number, driving license
data
number, date of birth, place of birth
Economic and financial Bank account number
information
Information related to the Vehicle Identification Number, license plate,
vehicle insurance number
Other type of Personal Data language
For the purpose of management of Data Controller’s internal organization
Category of Personal Data Details
Civil Status, ID, identification Name, Surname, Address, ID number, date of
data birth, place of birth of Employees
Nextlane – DPA – DATACAR DMS – September 2024
Contact in charge of Data Protection matter
Data Controller Data Processor
Name: [•] Email address: dpo@nextlane.com
Email address: [•] Postal address: 190 avenue Thiers, 69006
Lyon, France
Postal address: [•]
Location(s) of Processing operations
- The Data Processor operates in the European Union and Switzerland.
- The Data Controller operates in __________________
Data transfer outside of the EEA and/or of Switzerland or to a country without an
adequacy decision
Non applicable
List of Subsequent Data Processors
The Subsequent Data Processors used by the Data Processor depends on the one hand on the
add-ons subscribed by the Data Controller, and on the other hand, on the contracts that the Data
Controller has with the vehicle manufacturers. In addition, some of the subsequent processing
mentioned below might be available on specific countries.
Therefore, the DPA will be updated based on the information provided by the Data Controller.
As an illustration purpose, only the main Subsequent Data Processors are:
Name Location Processing activity
TMS France MiSIV is a Solution dealing with the registration of the
vehicle (TMS is a subsid
CGI Italy Integration partner
Esker France Digital invoice solution interfaced with DataCar if
subscribed by the Data Controller
Motorsoft Portugal Integration partner
Wizrom Romania Integration partner
Nextlane – DPA – DATACAR DMS – September 2024
ANNEX to the Data Processing Agreement
Description of Digital Invoice
Controller
The Data Controller is the Customer of Nextlane.
Nature and purpose of Processing
• Nature of the Processing:
Digital Invoice is integrated solutions with the Data Processor’s DMS (Dealer Management
Systems). It enables the Data Controller to digitize, distribute and archive all its customers’
invoices.
• Purposes of Processing are the following:
- Invoicing of transactions related to the sales, trade-in, maintenance and repair of vehicle
- Archiving of such invoices
- Automatic distribution of invoice
Retention period
The Data Controller shall provide to the Data Processor the retention policy of personal data, which
is aligned with the principles provided by Applicable Law.
Categories of Data Subjects
The Personal Data processed by the Data Processor are related to the following categories of Data
Subjects:
Data Subject categories
Data Controller’s Employees X
Data Controller’s Customers X
Data Controller’s Suppliers (auditors, X
agents…)
Categories of Personal Data
Personal Data processed relate to the following categories:
Category of Personal Data Details
Name, surname, address, phone/fax number, e-
Civil Status, ID, identification data
mail address, job title
Nextlane – DPA – Digital Invoice – September 2024
Contact in charge of Data Protection matter
Data Controller Data Processor
Name: [•] Email address: dpo@nextlane.com
Email address: [•] Postal address: 190 avenue Thiers, 69006 Lyon,
France
Postal address: [•]
Location(s) of Processing operations
- The Data Processor operates in the European Union, and Switzerland.
- The Data Controller operates in __________________
Data transfer outside of the EEA and/or of Switzerland, or to a country without an adequacy
decision
Non applicable
List of Subsequent Data Processors
The Subsequent Dara Processors used by the Data Processor depends on the add-ons or DMS
subscribed by the Data Controller.
Therefore, the DPA will be updated based on the information provided by the Data Controller.
Name Location Processing activity
ESKER France Supplier of the digital invoice solution which the Data
Processor is reselling to the Data Controller
Nextlane – DPA – Digital Invoice – September 2024
ANNEX to the Data Processing Agreement
Description of Digital Signature
Controller
The Data Controller is the Customer of Nextlane.
Nature and purpose of Processing
• Nature of the Processing:
Digital Signature is integrated solutions with the Data Processor’s DMS and CRM (Dealer
Management Systems). It enables the Data Controller to digitize, distribute and archive all
signatures linked to contractual documents related to the sale and servicing of a vehicle.
• Purposes of Processing are the following:
- Signature of transactions related to the sales, trade-in, maintenance and repair of vehicle
- Archiving of such signatures
- Electronic distribution of signed documents
Retention period
The Data Controller shall provide to the Data Processor the retention policy of personal data, which
is aligned with the principles provided for by Applicable Law.
Categories of Data Subjects
The Personal Data processed by the Data Processor are related to the following categories of Data
Subjects:
Data Subject categories
Data Controller’s Employees X
Data Controller’s Customers X
Data Controller’s Suppliers (auditors, X
agents…)
Categories of Personal Data
Personal Data processed relate to the following categories:
Category of Personal Data Details
Name, surname, address, phone number, e-mail
Civil Status, ID, identification data
address, job title
Nextlane – DPA – Digital Signature – September 2024
Contact in charge of Data Protection matter
Data Controller Data Processor
Name: [•] Email address: dpo@nextlane.com
Email address: [•] Postal address: 190 avenue Thiers, 69006 Lyon,
France
Postal address: [•]
Location(s) of Processing operations
- The Data Processor operates in the European Union and Switzerland.
- The Data Controller operates in __________________
Data transfer outside of the EEA and/or of Switzerland or to a country without an adequacy
decision
Non applicable
List of Subsequent Data Processors
The Subsequent Data Processors used by the Data Processor depend on the add-ons or DMS/CRM
subscribed by the Data Controller.
Therefore, the DPA will be updated based on the information provided by the Data Controller.
The Data Processor uses the following Subsequent Data Processors:
Name Location Processing activity
Uanataca Spain Electronic signature provider
Labsmobile Spain SMS provider
Nextlane – DPA – Digital Signature – September 2024
ANNEX to the Data Processing Agreement
Description of DRIVE DMS
Controller
The Data Controller is the Customer of Nextlane.
Nature and purpose of Processing
• Nature of the Processing:
Collection of Data Controller’s customers and/or prospects and/or employee’s personal data by
the Data Controller that are integrated in the DMS of the Data Processor, with the objective of
enhancing the services that the Data Controller can provide to its own customers.
The Processing can relate to the sales of vehicles, after-sales activities, spare parts management,
and accounting management depending on the type of subscription selected by the Data
Controller. The Processing also covers the connection with relevant car manufacturers to
provide multiple services and manage customers’ interaction.
• Purposes of Processing are the following:
depending on the services subscribed by the Data Controller:
- Support for the Data Controller in managing its relationship with its Prospects:
o Management of leads
o Management of vehicle offers
o Management of marketing campaigns.
- Support for the Data Controller in managing its relationship with its Customers:
o Management of vehicle purchase
o Management of vehicle trade-in
o Organization of vehicle maintenance and test
o Management of parts orders and warranty with the OEM
o Management of courtesy vehicle
o Storage of administrative documents
o Management of marketing campaigns
o Publishing of Used Car pictures and information on Web sites
o Evaluation of vehicle value
- Support for the Data Controller in managing its internal organizational
o Workshop organization
o Courtesy vehicle management
o Management of leads
o Management of marketing campaigns
o Evaluation of a vehicle value
o Management of Employees (timing)
Nextlane – DPA – Drive DMS– September 2024
Retention period
The Data Controller shall provide to the Data Processor the retention policy of personal data, which
is aligned with the principles provided by Applicable Law.
Categories of Data Subjects
The Personal Data processed by the Data Processor are related to the following categories of Data
Subjects:
Management of Management of Data
Management of
Data Subject categories Prospects Controller’s internal
Customers
organization
Data Controller’s Prospects X X
Data Controller’s Employees X X X
Data Controller’s Customers X X
Data Controller’s Suppliers X X
Car driver X X X
Categories of Personal Data
Personal Data processed relates to the following categories:
For the purpose of management of Data Controller’s Prospects
Category of Personal Data Details
Gender, name, surname, address, phone number,
Civil Status, ID, identification data e-mail address, driving license number, date of
birth
Economic and financial information Bank account number, workplace and title
Vehicle Identification Number, license plate,
Information related to the vehicle
insurance number
Personal information Interest, hobbies,
Other type of Personal Data Language, workplace, title, consent
Nextlane – DPA – Drive DMS– September 2024
For the purpose of management of Data Controller’s Customers
Category of Personal Data Details
Gender, name, surname, address, phone number,
Civil Status, ID, identification data
e-mail address, date of birth, place of birth
Economic and financial information Bank account number
Vehicle Identification Number, license plate,
Information related to the vehicle
insurance number
Other type of Personal Data Language, consent form, workplace, title
For the purpose of management of Data Controller’s internal organization
Category of Personal Data Details
Gender, name, surname, address, phone number,
Civil Status, ID, identification data
e-mail address, date of birth, place of birth
Financial information Bank account number
Date of hire, internal employee ID, working date
Information related to employment
and absence time
• Contact in charge of Data Protection matter
Data Controller Data Processor
Name: [•] Email address: dpo@nextlane.com
Email address: [•] Postal address: 190 avenue Thiers, 69006
Lyon, France
Postal address: [•]
Location(s) of Processing operations
- The Data Processor operates in the European Union and Switzerland.
- The Data Controller operates in __________________
Data transfer outside of Switzerland or to a country without an adequacy decision
Personal Data might be transferred from Switzerland to other countries within the EEA.
Nextlane – DPA – Drive DMS– September 2024
List of Subsequent Data Processors
The Subsequent Data Processors used by the Data Processor depends on the one hand on the add-
ons subscribed by the Data Controller, and on the other hand, on the contracts that the Data
Controller has with the vehicle manufacturers. In addition, some of the subsequent processings
mentioned below might be available in specific countries.
Therefore, the DPA will be updated based on the information provided by the Data Controller.
As an illustration purpose, only the main Subsequent Data Processors are:
Name Location Processing activity
Apmatic GmbH Switzerland Workshop appointment on-line solution
Solera Switzerland Repair estimation and price negotiation with the
insurance
Solera Switzerland Automobile technical information, maintenance,
repair
Autovista Switzerland Repair estimation and price negotiation with the
insurance
Auto-I Switzerland Various solutions such as vehicle valuation, sales
workplace, vehicle data
Canon Switzerland Electronic Document Management system
Nextlane – DPA – Drive DMS– September 2024
ANNEX to the Data Processing Agreement
Description of ECAROS
Controller
The Data Controller is the Customer of Nextlane.
Nature and purpose of Processing
• Nature of the Processing:
Collection of Data Controller’s customers and/or prospects and/or employee’s personal data
by the Data Controller that are integrated in the DMS of the Data Processor, with the objective
of enhancing the services that the Data Controller can provide to its own customers and/or
prospects.
The Processing can relate to the sales of vehicles, after-sales activities, spare parts
management, and accounting management depending on the type of subscription selected by
the Data Controller. The Processing also covers the connection with relevant car
manufacturers to provide multiple services and manage customers’ interaction.
• Purposes of Processing are the following:
Depending on the services subscribed by the Data Controller:
- Support for the Data Controller in managing its relationship with its Prospects:
o Management of leads
o Management of vehicle offers
o Management of marketing campaigns.
- Support for the Data Controller in managing its relationship with its Customers:
o Management of vehicle purchase
o Management of vehicle trade-in
o Organization of vehicle maintenance and test
o Management of parts orders and warranty with the OEM
o Management of courtesy vehicle
o Storage of administrative documents
o Management of marketing campaigns
o Publishing of Used Car pictures and information on Web sites
o Evaluation of vehicle value
- Support for the Data Controller in managing its internal organizational
o Workshop organization including Human resources aspects
o Courtesy vehicle management
o Management of leads
o Marketing campaigns
o Evaluation of a vehicle value.
o Management of Employees (timing)
Nextlane – DPA – ECAROS DMS – September 2024
Retention period
The Data Controller shall provide to the Data Processor the retention policy of personal data, which
is aligned with the principles provided by Applicable Law.
Categories of Data Subjects
The Personal Data processed by the Data Processor are related to the following categories of Data
Subjects:
Management of Management of Data
Management of
Data Subject categories Prospects Controller’s internal
Customers
organization
Data Controller’s Prospects X X
Data Controller’s
X X X
Employees
Data Controller’s
X X
Customers
Data Controller’s Suppliers X X
Car driver X X X
Categories of Personal Data
Personal Data processed relate to the following categories:
For the purpose of management of Data Controller’s Prospects
Category of Personal Data Details
Gender, name, surname, address, phone number,
Civil Status, ID, identification data e-mail address, ID number, driving license
number, date of birth, place of birth,
Economic and financial information Bank account number
Vehicle Identification Number, license plate,
Information related to the vehicle
insurance number
Nextlane – DPA – ECAROS DMS – September 2024
For the purpose of management of Data Controller’s Customers
Category of Personal Data Details
Gender, name, surname, address, phone number,
Civil Status, ID, identification data e-mail address, ID number, driving license
number, date of birth, place of birth
Economic and financial information Bank account number
Vehicle Identification Number, license plate,
Information related to the vehicle
insurance number
Other type of Personal Data Language, consent form
For the purpose of management of Data Controller’s internal organization
Category of Personal Data Details
Gender, name, surname, address, ID number,
phone number, e-mail address, driving license
Civil Status, ID, identification data
number, date of birth, place of birth, social
security number
Date of hire, internal employee ID, working date
Information related to employment
and absence time
Economic and financial information Bank account number
Contact in charge of Data Protection matter
Data Controller Data Processor
Name: [•] Email address: dpo@nextlane.com
Email address: [•] Postal address: 190 avenue Thiers, 69006
Lyon, France
Postal address: [•]
Location(s) of Processing operations
- The Data Processor operates in the European Union and Switzerland.
- The Data Controller operates in __________________
Data transfer outside of the EEA and/or of Switzerland or to a country without an adequacy
decision
Non applicable
Nextlane – DPA – ECAROS DMS – September 2024
List of Subsequent Data Processors
The Subsequent Data Processors used by the Data Processor depends on the one hand on the add-
ons subscribed by the Data Controller, and on the other hand, on the contracts that the Data
Controller has with the vehicle manufacturers. In addition, some of the subsequent processing
mentioned below might be available on specific countries.
Therefore, the DPA will be updated based on the information provided by the Data Controller.
As an illustration purpose, only the main Subsequent Data Processors are:
Name Location Processing activity
DAT Germany Repair estimation, price negotiation with insurer
Autovista Germany Repair estimation, price negotiation with insurer
Datev Germany Management of accounting and payroll
Aufinity Group Germany Bezahl / management of digital payment
Autoeile Germany Pilot to publish used vehicle and auction
Autohauskenner Germany Customer satisfaction rating
ELO Digital Office Germany Recording, printing, and saving documents
VEACT Germany Customer satisfaction rating
Motorbike-Shop Germany Used vehicle management
Autoscout24 Germany Used vehicle management
Nextlane – DPA – ECAROS DMS – September 2024
ANNEX to the Data Processing Agreement
Description of SERAUTO
Controller
The Data Controller is the Customer of Nextlane.
Nature and purpose of Processing
• Nature of the Processing:
Collection of Data Controller’s customers and/or prospects and/or employee’s personal data
by the Data Controller that are integrated in the DMS of the Data Processor, with the
objective of enhancing the services that the Data Controller can provide to its own customers
and/or prospects.
The Processing can relate to the sales of vehicles, after-sales activities, spare parts
management, and accounting management depending on the type of subscription selected
by the Data Controller. The Processing also covers the connection with relevant car
manufacturers to provide multiple services and manage customers’ interaction.
• Purposes of Processing are the following:
Depending on the services subscribed by the Data Controller:
- Support for the Data Controller in managing its relationship with its Prospects:
o Management of leads
o Organization of vehicle test
o Management of marketing campaigns.
- Support for the Data Controller in managing its relationship with its Customers:
o Management of vehicle purchase
o Management of vehicle trade-in
o Organization of vehicle maintenance and test
o Management of parts orders and warranty with the OEM
o Management of courtesy vehicle
o Management of vehicle registration process
o Storage of administrative documents
o Management of marketing campaigns
- Support for the Data Controller in managing its internal organizational
o Workshop organization including Human resources aspects
o Courtesy vehicle management
o Management of leads
o Marketing campaigns
o Evaluation of a vehicle value.
Nextlane – DPA – SERAUTO DMS – September 2024
Retention period
The Data Controller shall provide to the Data Processor the retention policy of personal data,
which is aligned with the principles provided by Applicable Law.
Categories of Data Subjects
The Personal Data processed by the Data Processor are related to the following categories of Data
Subjects:
Management of Management of Data
Management of
Data Subject categories Prospects Controller’s internal
Customers
organization
Data Controller’s Prospects X X
Data Controller’s
X X X
Employees
Data Controller’s
X X
Customers
Data Controller’s Suppliers X X
Car driver X X X
Categories of Personal Data
Personal Data processed relate to the following categories:
For the purpose of management of Data Controller’s Prospects
Category of Personal Data Details
Gender, name, surname, address, phone number,
Civil Status, ID, identification data e-mail address, ID number, driving license
number, date of birth, place of birth,
Economic and financial information Bank account number
Workplace and title, interest, hobbies, consent
Other information
form
Nextlane – DPA – SERAUTO DMS – September 2024
For the purpose of management of Data Controller’s Customers
Category of Personal Data Details
Gender, name, surname, address, phone number,
Civil Status, ID, identification data e-mail address, ID number, driving license
number, date of birth
Economic and financial information Bank account number, financial accounting data
Vehicle Identification Number, license plate,
Information related to the vehicle
insurance number
Other type of Personal Data Language, consent form
For the purpose of management of Data Controller’s internal organization
Category of Personal Data Details
Gender, name, surname, address, ID number,
Civil Status, ID, identification data phone number, e-mail address, driving license
number, date of birth, social security number
Date of hire, internal employee ID, data on sales,
Information related to employment
commission and bonus
Economic and financial information Bank account number
Contact in charge of Data Protection matter
Data Controller Data Processor
Name: [•] Email address: dpo@nextlane.com
Email address: [•] Postal address: 190 avenue Thiers, 69006 Lyon,
France
Postal address: [•]
Location(s) of Processing operations
- The Data Processor operates in the European Union, and Switzerland.
- The Data Controller operates in __________________
Data transfer outside of the EEA and/or of Switzerland or to a country without an adequacy
decision
Non applicable
Nextlane – DPA – SERAUTO DMS – September 2024
List of Subsequent Data Processors
The Subsequent Data Processors used by the Data Processor depends on the one hand on the add-
ons subscribed by the Data Controller, and on the other hand, on the contracts that the Data
Controller has with the vehicle manufacturers. In addition, some of the subsequent processing
mentioned below might be available on specific countries.
Therefore, the DPA will be updated based on the information provided by the Data Controller.
As an illustration purpose, only the main Subsequent Data Processors are:
Name Location Processing activity
GT-Motiv Spain Repair estimation, price negotiation with insurer
Solera Spain Repair estimation, price negotiation with insurer
Autovista Spain Car quotation
Nextlane – DPA – SERAUTO DMS – September 2024
ANNEX to the Data Processing Agreement
Description of UNICAR
Controller
The Data Controller is the Customer of Nextlane.
Nature and purpose of Processing
• Nature of the Processing:
Collection of Data Controller’s customers and/or prospects and/or employee’s personal data
by the Data Controller that are integrated in the DMS of the Data Processor, with the objective
of enhancing the services that the Data Controller can provide to its own customers and/or
prospects.
The Processing can relate to the sales of vehicles, after-sales activities, spare parts
management, and accounting management depending on the type of subscription selected by
the Data Controller. The Processing also covers the connection with relevant car
manufacturers to provide multiple services and manage customers’ interaction.
• Purposes of Processing are the following:
Depending on the services subscribed by the Data Controller:
- Support for the Data Controller in managing its relationship with its Prospects:
o Management of leads
o Management of vehicle offers
o Organization of vehicle test
o Management of marketing campaigns.
- Support for the Data Controller in managing its relationship with its Customers:
o Management of vehicle purchase
o Management of vehicle trade-in
o Organization of vehicle maintenance and test
o Management of parts orders and warranty with the OEM
o Management of courtesy vehicle
o Management of vehicle registration process
o Storage of administrative documents
o Management of marketing campaigns
o Publishing of used car pictures and information on web sites
o Evaluation of a vehicle value
- Support for the Data Controller in managing its internal organizational
o Workshop organization including Human resources aspects
o Courtesy vehicle management
o Time recording
o Sales related commissions and incentives
o Control of IT access and IT usage monitoring.
Nextlane – DPA – UNICAR DMS – September 2024
Retention period
The Data Controller shall provide to the Data Processor the retention policy of personal data, which
is aligned with the principles provided for by Applicable Law.
Categories of Data Subjects
The Personal Data processed by the Data Processor are related to the following categories of Data
Subjects:
Management of Management of Data
Management of
Data Subject categories Prospects Controller’s internal
Customers
organization
Data Controller’s Prospects X X
Data Controller’s
X X X
Employees
Data Controller’s
X X
Customers
Data Controller’s Suppliers X X
Car driver X X X
Categories of Personal Data
Personal Data processed relate to the following categories:
For the purpose of management of Data Controller’s Prospects
Category of Personal Data Details
Gender, name, surname, address, phone number,
Civil Status, ID, identification data e-mail address, ID number, driving license
number, date of birth
Economic and financial information Bank account number
Other information Workplace and title, interest, hobbies
Nextlane – DPA – UNICAR DMS – September 2024
For the purpose of management of Data Controller’s Customers
Category of Personal Data Details
Gender, name, surname, address, phone number,
Civil Status, ID, identification data e-mail address, ID number, driving license
number, date of birth
Economic and financial information Bank account number, financial accounting data
Vehicle Identification Number, license plate,
Information related to the vehicle
insurance number
For the purpose of management of Data Controller’s internal organization
Category of Personal Data Details
Gender, name, surname, address, ID number,
Civil Status, ID, identification data phone number, e-mail address, driving license
number, date of birth
Date of hire, internal employee ID, working and
Information related to employment absence data, data on sales, commission and
bonus, data on IT access control and IT usage
Economic and financial information Bank account number
Contact in charge of Data Protection matter
Data Controller Data Processor
Name: [•] Email address: dpo@nextlane.com
Email address: [•] Postal address: 190 avenue Thiers, 69006 Lyon,
France
Postal address: [•]
Location(s) of Processing operations
- The Data Processor operates in the European Union and Switzerland.
- The Data Controller operates in __________________
Data transfer outside of the EEA and/or of Switzerland or to a country without an adequacy
decision
Non applicable
Nextlane – DPA – UNICAR DMS – September 2024
List of Subsequent Data Processors
The Subsequent Data Processors used by the Data Processor depends on the one hand on the add-
ons subscribed by the Data Controller, and on the other hand, on the contracts that the Data
Controller has with the vehicle manufacturers. In addition, some of the Subsequent processing
mentioned below might be available on specific countries.
Therefore, the DPA will be updated based on the information provided by the Data Controller.
As an illustration purpose, only the main Subsequent Data Processors are:
Name Location Processing activity
DAT Germany Repair estimation, price negotiation with insurer
Autovista Germany Repair estimation, price negotiation with insurer
Datev Germany Management of accounting and payroll
ELO Digital Office Germany Recording, printing, and saving documents
VEACT Germany Customer satisfaction rating
Motorbike-Shop Germany Used vehicle management
Autoscout24 Germany Used vehicle management
Nextlane – DPA – UNICAR DMS – September 2024
ANNEX to the Data Processing Agreement
Description of Europlus
Controller
The Data Controller is the Customer of Nextlane.
Nature and purpose of Processing
• Nature of the Processing:
Collection of Data Controller’s customers personal data by the Data Controller that are
integrated in the Solution of the Data Processor, with the objective of enhancing the services
that the Data Controller can provide to its own customers.
The processing can relate to the sales of vehicles, after-sales activities, spare parts and repair
management, depending on the type of subscription selected by the Data Controller. The
Processing also covers the connection with relevant car manufacturers to provide multiple
services and manage customers’ interaction.
• Purposes of Processing are the following:
Depending on the services subscribed by the Data Controller:
- Support for the Data Controller in managing its relationship with its customers:
o Management of vehicle purchase
o Management of vehicle trade-in
o Organization of vehicle maintenance and test
o Organization of marketing campaigns
o Management of parts orders and warranty with the OEM
o Management of courtesy vehicle
o Storage of administrative documents.
- Support for the Data Controller in managing its internal organization:
o Workshop organization
o Courtesy vehicle management
o Time recording
Retention period
The Data Controller shall provide to the Data Processor the retention policy of Personal Data, which
is aligned with the principles provided by Applicable Law.
Nextlane – DPA – EUROPLUS DMS – September 2024
Categories of Data Subjects
The Personal Data processed by the Data Processor are related to the following categories of Data
Subjects:
Management of Data
Management of
Data Subject categories Controller’s internal
Customers
organization
Data Controller’s employees X X
Data Controller’s customers X X
Data Controller’s suppliers X X
Car driver X X
Categories of Personal Data
Personal Data processed relates to the following categories:
For the purpose of management of Data Controller’s customers
Category of Personal Data Details
Civil Status, ID, identification data related Gender, name, surname, address, phone number,
to Customers/drivers e-mail address, date of birth.
Vehicle Identification Number, license plate,
Information related to the vehicle
insurance number
Language, consent form, financial accounting
Other type of Personal Data
data
For the purpose of management of Data Controller’s internal organization
Category of Personal Data Details
Gender, name, surname, address, phone number,
Civil Status, ID, identification data e-mail address, date of birth, place of birth, place
of birth
Date of hire, internal employee ID, working date
Information related to employment
and absence time
Economic and financial information Bank account number
Nextlane – DPA – EUROPLUS DMS – September 2024
Contact in charge of Data Protection matter
Data Controller Data Processor
Name: [•] Email address: dpo@nextlane.com
Email address: [•] Postal address: 190 avenue Thiers, 69006
Lyon, France
Postal address: [•]
Location(s) of Processing operations
- The Data Processor operates in the European Union and Switzerland.
- The Data Controller operates in __________________
Data transfer outside of the EEA and/or of Switzerland or to a country without an adequacy
decision
Non applicable
List of Subsequent Data Processors
The Subsequent Data Processors used by the Data Processor depends on the one hand on the add-
ons subscribed by the Data Controller, and on the other hand, on the contracts that the Data
Controller has with the vehicle manufacturers. In addition, some of the subsequent processing
mentioned below might be available on specific countries.
Therefore, the DPA will be updated based on the information provided by the Data Controller.
As an illustration purpose, only the main Subsequent Data Processors are:
Name Location Processing activity
Apmatic GmbH Switzerland Workshop appointment on-line solution
Auto-I Switzerland For various solutions they provide like vehicle
valuation, sales workplace, vehicle data
Nextlane Switzerland Connection with Drive – for internal organization
Switzerland processing
Nextlane Switzerland Premium Finance as accounting module
Switzerland
Nextlane – DPA – EUROPLUS DMS – September 2024
ANNEX to the Data Processing Agreement
Description of CRMAuto After Sales
Controller
The Data Controller is the Customer of Nextlane.
Nature and purpose of Processing
• Nature of the Processing:
The Processing covers the relationship between an OEM (the Data Controller) and its dealer
network.
The Processing can relate to the workshop network’s activities, like import of vehicle data,
multimedia damage report, band management tools vehicle conditions video check, and online
appointments management.
• Purposes of Processing are the following:
Depending on the services subscribed by the Data Controller:
- Support for the Data Controller in managing its relationship with its Customers/Network
dealers:
o Organization of vehicle maintenance
o Organization of vehicle test
o Management of courtesy vehicle
o Storage of administrative documents
o Publication of used car pictures and information on Web Site.
- Support for the Data Controller in managing its internal organizational
o Workshop organization
o Courtesy vehicle management
Retention period
The Data Controller shall provide to the Data Processor the retention policy of personal data, which
is aligned with the principles provided by Applicable Law.
Nextlane – DPA – CRMAuto After Sales – September 2024
Categories of Data Subjects
The Personal Data processed by the Data Processor are related to the following categories of Data
Subjects:
Management of Data
Management of Management of
Data Subject categories Controller’s internal
prospects customers
organization
Data Controller’s Prospects X X
Data Controller’s
X X
Customers
Data Controller’s
X X X
Employees
Others: car driver X X
Categories of Personal Data
Personal Data processed relate to the following categories:
For the purpose of management of Data Controller’s Prospects
Category of Personal Data Details
Gender, name, surname, address, phone number,
Civil Status, ID, identification data e-mail address, ID number, driving license
number, date of birth
For the purpose of management of Data Controller’s Customers
Category of Personal Data Details
Gender, name, surname, address, phone number,
Civil Status, ID, identification data e-mail address, ID number, driving license
number, date of birth
Information related to the vehicle Vehicle Identification Number, license plate
Others Insurance number, language
Nextlane – DPA – CRMAuto After Sales – September 2024
For the purpose of management of Data Controller’s internal organization
Category of Personal Data Details
Gender, name, surname, address, phone number,
Civil Status, ID, identification data e-mail address, ID number, driving license
number, date of birth, place of birth
Information related to employment Date of profile creation in the Processing
Contact in charge of Data Protection matter
Data Controller Data Processor
Name: [•] Email address: dpo@nextlane.com
Email address: [•] Postal address: 190 avenue Thiers, 69006 Lyon,
France
Postal address: [•]
Location(s) of Processing operations
- The Data Processor operates in the European Union and Switzerland.
- The Data Controller operates in __________________
Data transfer outside of the EEA, and/or Switzerland or to a country without an adequacy
decision
Non applicable
List of Subsequent Data Processors
The Subsequent Data Processors used by the Data Processor depend on the add-ons subscribed to
by the Data Controller. In addition, some of the subsequent processing mentioned below might be
available in specific countries.
Therefore, the DPA will be updated based on the information provided by the Data Controller.
As an illustration purpose, only the main Subsequent Data Processors are:
Name Location Subsequent Data Processing
Uanataca Spain Electronic signature provider
Labsmobile Spain SMS provider for Digital signature process
360 Learning France Academy (training)
Nextlane Spain Spain Imabox (uploaded images)
Nextlane – DPA – CRMAuto After Sales – September 2024
ANNEX to the Data Processing Agreement
Description of CRMAuto Sales
Controller
The Data Controller is the Customer of Nextlane.
Nature and purpose of Processing
• Nature of the Processing:
The Processing covers the relationship between an OEM (the Data Controller) and its dealer
network.
The Processing can relate to the customization of new vehicles, an interactive offer,
management of used vehicles, tools of the Data Controller’s brands, the management of fleet
order, and management of leads.
• Purposes of Processing are the following:
depending on the services subscribed by the Data Controller:
- Support for the Data Controller in managing its relationship with its Prospects:
o Management of leads
o Management of vehicle offers
o Organisation of vehicle test
o Management of marketing campaigns.
- Support for the Data Controller in managing its relationship with its Customers/Network
dealers:
o Management of vehicle purchase
o Management of vehicle trade-in
o Organization of vehicle test
o Management of courtesy vehicle
o Management of registration process of the vehicle
o Storage of administrative documents
o Management of marketing campaigns.
- Support for the Data Controller in managing its internal organizational
o Courtesy vehicle management
o Management of leads
o Management of marketing campaigns.
Retention period
The Data Controller shall provide to the Data Processor the retention policy of personal data, which
is aligned with the principles provided by Applicable Law.
Nextlane – DPA – CRMAuto Sales – September 2024
Categories of Data Subjects
The Personal Data processed by the Data Processor are related to the following categories of Data
Subjects:
Management of Management of Data
Management of
Data Subject categories Prospects Controller’s internal
Customers
organization
Data Controller’s prospects X X
Data Controller’s
X X
customers
Data Controller’s X
X
employees
Categories of Personal Data
Personal Data processed relate to the following categories:
For the purpose of management of Data Controller’s Prospects
Category of Personal Data Details
Gender, name, surname, address, phone number, e-
Civil Status, ID, identification data mail address, ID number, driving license number,
date of birth.
For the purpose of management of Data Controller’s Customers
Category of Personal Data Details
Gender, name, surname, address, phone number,
Civil Status, ID, identification data e-mail address, ID number, driving license
number, date of birth.
Information related to the vehicle Vehicle Identification Number, license plate,
Nextlane – DPA – CRMAuto Sales – September 2024
For the purpose of management of Data Controller’s internal organization
Category of Personal Data Details
Gender, name, surname, address, phone number,
Civil Status, ID, identification data e-mail address, ID number, driving license
number, date of birth, place of birth
Information related to employment Date of profile creation in the Processing
Contact in charge of Data Protection matter
Data Controller Data Processor
Name: [•] Email address: dpo@nextlane.com
Email address: [•] Postal address: 190 avenue Thiers, 69006 Lyon,
France
Postal address: [•]
Location(s) of Processing operations
- The Data Processor operates in the European Union and Switzerland.
- The Data Controller operates in __________________
Data transfer outside of the EEA and/or Switzerland or to a country without an adequacy
decision
Non applicable
List of Subsequent Data Processors
The Subsequent Data Processors used by the Data Processor depend on the add-ons subscribed to
by the Data Controller. In addition, some of the subsequent processing mentioned below might be
available in specific countries.
Therefore, the DPA will be updated based on the information provided by the Data Controller.
As an illustration purpose, only the main Subsequent Data Processors are:
Name Location Subsequent Data Processing
Uanataca Spain Electronic signature provider
Labsmobile Spain SMS provider for Digital signature process
360 Learning France Academy (training)
Nextlane Spain Spain Imabox (uploaded images)
Nextlane – DPA – CRMAuto Sales – September 2024
ANNEX to the Data Processing Agreement
Description of KOBRA II CRM
Controller
The Data Controller is the Customer of Nextlane.
Nature and purpose of Processing
• Nature of the Processing:
Collection of Data Controller’s customers and/or employee’s personal data by the Data
Controller that are integrated in the CRM of the Data Processor, with the objective of
enhancing the services that the Data Controller can provide to its own customers, on the
Swedish automotive market.
The Processing can relate to the sales of vehicles depending on the type of subscription
selected by the Data Controller. The Processing covers the connection with relevant car
manufacturers and integrations to other solutions, platforms and to Kobra II DMS, facilitating
comprehensive dealership management, to provide multiple services and manage end-
customers’ interaction.
• Purposes of Processing are the following:
depending on the services subscribed by the Data Controller:
- Support for the Data Controller in managing its relationship with its Prospects:
o Management of vehicle purchase
o Management of vehicle trade-in
o Management of vehicle buy-in
o Management of VDN
o Management of parts orders and warranty with the OEM
o Management of courtesy vehicle
o Storage of administrative documents.
- Support for the Data Controller in managing its relationship with its customers:
o Management of vehicle purchase
o Management of vehicle trade-in
o Management of vehicle buy-in
o Management of VDN
o Management of parts orders and warranty with the OEM
o Management of courtesy vehicle
o Storage of administrative documents.
- Support for the Data Controller in managing its organization:
o Management of logging access rights of employees to the CRM
Nextlane – DPA – KOBRA II CRM – September 2024
Retention period
The Data Controller shall provide to the Data Processor the retention policy of personal data, which
is aligned with the principles provided by Applicable Law.
Categories of Data Subjects
The Personal Data processed by the Data Processor are related to the following categories of Data
Subjects:
Management of
Management of Management of
Data Subject categories internal
Prospects Customers
organisation
Data Controller Prospects X
Data Controller’s Employees X X X
Data Controller’s customers X
Data Controller’s Suppliers X X
Car drives X X
Categories of Personal Data
Personal Data processed relate to the following categories:
For the purpose of management of Data Controller’s Prospects:
Category of Personal Data Details
Civil Status, ID, identification data related Name, surname, address, phone number, e-mail
to Customers/drivers address, ID number, date of birth.
Other type of Personal Data Consent form
For the purpose of management of Data Controller’s Customers
Category of Personal Data Details
Civil Status, ID, identification data related Name, surname, address, phone number, e-mail
to Customers/drivers address, ID number, date of birth.
Other type of Personal Data Consent form
Nextlane – DPA – KOBRA II CRM – September 2024
For the purpose of management of Data Controller’s internal organization
Category of Personal Data Details
identification data (login) Name, surname, phone number, e-mail address
Contact in charge of Data Protection matter
Data Controller Data Processor
Name: [•] Email address: dpo@nextlane.com
Email address: [•] Postal address: 190 avenue Thiers, 69006 Lyon,
France
Postal address: [•]
Location(s) of Processing operations
- The Data Processor operates in the European Union and Switzerland.
- The Data Controller operates in __________________
Data transfer outside of the EEA and/or Switzerland or to a country without an adequacy
decision
Not applicable
List of Subsequent Data Processors
Name Location Processing activity
Nextlane Sweden AB Sweden Integration to Kobra II DMS
Bilvision Sweden Change of ownership, Customer/Vehicle information
Bisnode/Infotorg Sweden "Driving license check (CBR)”
Toyota-finans, DNB, Sweden Financing for credit application
Santander
IF Försäkringar Sweden Insurance
CSig Sweden Digital signature of contracts
SA3 Sweden For BMW's brand : order of car and the selection of
accessories
Toyota VOM Sweden New car orders
Mercedes CAS/CSL Sweden Follow up of transactions containing Leads
Leads Sweden TO LQ MB XS JA LR - Transactions containing Leads
are sent from and to KSS for follow-up
Nextlane – DPA – KOBRA II CRM – September 2024