legal.

These Technical Organisational Measures cover all CitNOW Group Corporate office locations, in addition to its research and development facilities.

About CitNOW Group

Created to leverage innovation and help retailers and manufacturers deliver an outstanding customer experience, CitNOW Group is driven by the vision to transform the way the automotive world communicates.

The CitNOW Group offers multiple services for the various stages of the customer journey. Find out about each service through our Brands & Solutions page.

CitNOW Group comprises AutoSLM, CitNOW, Dealerdesk, Dealerweb, Quik, Reef, REALtime Communications (RTC), Tootle and Web1on1. Our span is global with a presence in 64 countries with over 15,000 users and a number of partnerships with complimentary automotive suppliers.

Purpose and Scope

CitNOW Group processes customer and consumer data on behalf of our customers in the Automotive Industry. As such, CitNOW Group respects the privacy and value of this data, as well as the trust our customers place in us.

The following are the technical and organisational measures to ensure data protection and data security. The aim is to guarantee the confidentiality, integrity and availability of the information processed. For more detailed information on data centre facilities, click on the links at the bottom of the document.

Approach

We will:

• Use all reasonable, appropriate, practical, and effective security measures to protect our important processes and assets to achieve our security objectives. · Comply with all ISO 27001:2013 requirements within our Information Security Management System.
• Utilise ISO 27002 as a framework for guiding our approach to managing security.
• Continually review our use of security measures so that we can improve the way in which we protect our business.
• Protect and manage our information assets to enable us to meet our contractual, legislative and privacy responsibilities.
• Use all reasonable, appropriate, practical, and effective measures to transfer information to Third Parties who require access to said information.
• Ensure compliance with General Data Protection Regulations through our GDPR representatives within the business as well as our independent outsourced DPO (Data Protection Officer).
• Utilise TISAX framework and guidelines to meet consumer and regulatory information security requirements within CitNOW policies.

About CitNOW Group

Created to leverage innovation and help retailers and manufacturers deliver an outstanding customer experience, CitNOW Group is driven by the vision to transform the way the automotive world communicates.

The CitNOW Group offers multiple services for the various stages of the customer journey. Find out about each service through our Brands & Solutions page.

CitNOW Group comprises AutoSLM, CitNOW, dealerdesk, Dealerweb, Quik, Reef, REALtime Communications (RTC), Tootle and Web1on1. Our span is global with a presence in 64 countries with over 15,000 users and a number of partnerships with complimentary automotive suppliers.

1. Policies for information security
   1. The CitNOW Group has defined a set of Information Security Policies which have been approved by the Management Board and which sets out the organisation’s approach to managing its information security objectives.
   2. The Information security policies are in place to address requirements created by business strategy, regulations, legislation, contracts and the current and projected information security threat environment. These policies are also a requirement of our ISO 27001, Cyber Essentials and TISAX accreditations (where applicable, by entity). The following policies are in place for all staff:
      • Access Control Policy
      • Acceptable Use Policy
      • Change Management Policy
      • Information Classification Policy
      • Information Security Incident Management Policy
      • Information Transfer Policy
      • Mobile Device & Teleworking Policy
      • Physical Security Policy
      • Clear desk and clear screen policy
      • Password management system
      • Cryptography Policy
   3. There may also be additional mandatory polices in addition to the above, based on an employee’s job role.
   4. A review of all The CitNOW Group information security policies is carried out at least annually or whenever significant changes are made that would impact a policy, regardless of the nature of the change (e.g. business change; legislation change; technology change).
2. Risk Management
   1. CitNOW Group have a comprehensive yet pragmatic approach to risk identification, analysis and treatment as well as ongoing monitoring and review. This is set out within our Risk Assessment & Treatment Methodology document. It addresses risks arising from internal and external issues, whether threat or opportunity based and outlines the approach to risks arising from applicable legislation.
      
      There is also a living Risk Register in place, which is used to map and treat risks identified from the analysis. It is also used to evidence activity and demonstrate links back to the controls and policies selected by the organisation to address the risk threats and opportunities.
3. Organisation of information Security
   1. Roles and responsibilities: The CitNOW Group have identified the key roles and responsibilities within Information Security and Data Protection. These specific roles are assigned and communicated so that information security is not only managed effectively, but the performance of the security management system is reported through to top management.
      1. Information Security Manager: Leading and managing the ISO committee to ensure the upkeep of the ISMS and ISO accreditation.
      2. ISO Committee: Day to day running and upkeep of the ISMS. Implementation of Policies and Procedures and ensuring staff compliance. Management of Corrective Actions & Improvements and Risks & Treatments.
      3. Internal Auditors: Individuals have attended the recommended ISO 27001 Internal Auditor course and as such are responsible for carrying out all Internal audits, in line with the Audit Programme.
      4. Management Board responsible for ISMS and GDPR: Point of contact for the ISO committee and the CitNOW Group Management Board. Responsible for signing of new policies and procedures within ISO and ensuring we are working towards our KPI’s. Also responsible for sign off Risk Acceptance as per our Risk Methodology.
      5. Data Protection Officer: Responsible for ensuring that the CitNOW Group is compliant with all aspects of the GDPR Legislations, both UK and EU.
      6. EU Representative: Our appointed EU Representative in regard to EU GDPR. Responsible for liaising with the EU supervisory authorities in relation to EU GDPR and liaising with Data Subjects based in the EU.
      7. GDPR Champions: Day to day contact for GDPR within the business. Ensures the upkeep of living Policies such as the Article 30 Records of Processing doc, breach register etc. Also responsible for upkeep of the Privacy Notice and ensuring our day-to-day compliance with regards to our responsibilities towards our Data Subjects and customers. There is a monthly meeting between the GDPR Champion and the DPO scheduled for the 1st Thursday of every month.
   2. Segregation of duties: The segregation of duties is used to ensure conflicting responsibilities are not allocated to the same individual and to prevent a single individual being able to access, modify or use assets without authorisation or detection.
   3. Information security in project management: The Product Departments of the group follow a product workflow which includes the need to involve Compliance at the early stages of the project, along with the completion of risk assessments. In the event any Project will impact the Privacy of our customers, staff or consumers, our Data Protection Impact Assessment procedures shall be followed. If a project involves a third party, the Supplier Security Procedure will also be followed.
4. Human Resources Security
   1. Screening: The CitNOW Group Global Recruitment and Selection Policy incorporates the screening activities that are to be undertaken for all new hires. These include but are not limited to evidence of their eligibility to work and two satisfactory employment references.
   2. Employee Terms and Conditions All new employees within CitNOW Group are provided with a Contract specific to the entity of which they are engaging with at time of Employment Offer. These contracts impose strict obligations of non-disclosure and confidentiality on to the employee and describes the obligations for compliance with information security policies.
   3. Information security awareness, education and training Upon joining the company staff must join our ‘DNA’ training sessions which fully onboard them into the business, including sessions from members of our Organisation Security Team. Continuous training and awareness is provided and undertaken by all current staff in the forms of e-learning and Phishing campaigns. Staff are also encouraged to source and apply for training they feel would be beneficial based on their skill set.
   4. Disciplinary Policy Information security is important and in turn repeat non-conformance of the CitNOW Group policies or deliberate cause of a major data breach could result in disciplinary action being taken, where necessary and applicable, the CitNOW Groups HR department will act in line with the disciplinary policy for UK market employees. The disciplinary policy is specific to all employees within the UK market, due to differing legislations in other markets, the HR team will handle disciplinary within other markets in conjunction with local market laws.
   5. Termination or change of employment: In the event of termination of employment, issues such as non-disclosure and behaviour around confidential information after leaving the organisation are addressed in accordance with the Terms and conditions of employment and are reminded to the staff members upon exit interview with the HR Team. Retrieval of the leavers assets is carried out in line with Return of Assets and removal from all systems is carried out in line with the Access Control Policy.
5. Asset Management
   1. Responsibility of assets: We operate an Information Asset inventory Tracker and Physical Asset Tracker, which track our assets throughout the lifecycle of the assets. The asset owner is responsible for the proper management of an asset over the whole asset lifecycle and for protecting the asset in accordance with Classification of information. All CitNOW Group information assets must be returned to the CitNOW Group upon termination of employment or third-party agreement.
   2. Acceptable use of assets: CitNOW Group have an Acceptable use policy; the purpose of this document is to define clear rules for the use of the information system and other information assets within CitNOW Group.
   3. Classification & Labelling of information: CitNOW Group have three confidentiality levels defined with the ‘Information Classification Matrix’ (Confidential, Public, and Internal). All documentation must be clearly labelled with the appropriate confidentiality label and information classified as "Confidential" must be accompanied by a List of Authorised Persons.
   4. Handling of assets: Wherever possible the CitNOW Group avoids the creation of paper-based information assets itself and attempts to produce only digital information. Digital information is protected against unauthorised access through measures including Access Controls.
   5. Management of removable media: CitNOW Group employees may only use CitNOW Group removable media in their work computers, which is provided by the IT department. CitNOW Group removable media may not be connected to or used in computers that are not owned or leased by CitNOW Group without explicit permission of the IT Department
   6. Disposal of media: Any business or personal data and information stored on the asset should be erased safely by using approved technology and means acceptable to the level of sensitivity of the data and information. CitNOW Group will only use appropriate WEEE approved authorised treatment company for the uplift of assets.
6. Access Control
   1. Access Control Policy: This policy outlines the rules for access to various systems, equipment, facilities and information, based on business and security requirements for access. Access to systems and networks must be in accordance with the principles of “deny-by-default” and “need-to-know”. Role Based Access Control (RBAC) is designed according to the principle of “least privilege” and access rights are monitored and regularly reviewed, at least annually.
   2. User access management: The technical implementation of the allocation or removal of CitNOW Group Employee Basic Access Rights is carried out by the IT Department and HR Department. The technical implementation of the allocation or removal of access rights is carried out by the System Owners. Segregation of duties and segregation of privileged accounts from non-privileged accounts is implemented wherever possible and practical. Access rights are monitored and regularly reviewed, at least annually.
   3. User responsibilities and Password management: All users of any CitNOW Group systems must have a unique user ID and shall require authentication by a password. Passwords should be kept confidential and must not be distributed through any channel (by oral, written or electronic distribution, etc.) or saved within the information system unless within an approved password safe (or Vault). Users must apply good security practices when selecting and using passwords and will follow obligations outlined within the password policy.
7. Cryptography
   1. Cryptographic Policy: CitNOW Group have a cryptographic policy in place that outlines our approach towards the use of cryptographic controls across and ensures that the organisation maintains the highest practicable standard of encryption. All individuals within the CitNOW are responsible for ensuring that Internal/Confidential data is encrypted before leaving the organisation’s premises.
   2. Key management: The policy includes the requirements for managing cryptographic keys though their whole lifecycle including generating, storing, archiving, retrieving, distributing, retiring and destroying keys. Cryptographic algorithms, key lengths and usage practices should be selected according to best practice.
8. Physical and Enviromental Security
   1. Physical entry controls: Physical security measures within all CitNOW Group offices include:
      • All employees require a key pass or fob to enter the offices unless the office has a manned reception.
      • All visitors are required to sign in at reception and always wear a visitors' badge.
      • Employees are vigilant of tailgating and are required to challenge unknown people within the office.
      • Main office doors must always be closed.
      • All windows are main access doors are locked at the end of every day.
      • CCTV monitoring is in place to cover access points to all offices, which is provided by the landlords.
   2. Secure areas: All CitNOW Group offices are secured by the following controls:
      • Telecommunications, servers, and networking equipment is securely stored in locked comms rooms, with only a few employees having access to these areas.
      • Post is delivered to a single locked mailbox, only accessible to our staff wherever possible.
      • Secure filing cabinets, lockers, or lockable desk drawers are available to all staff
      • If a shared meeting room is required over multiple days, then, if appropriate, materials can be left overnight so long as the room is locked, and any confidential material is obscured from the view of any passers-by.
      • All meetings of a “Confidential” nature are held in dedicated meeting rooms to avoid risk of information leakage into the main open plan office where it is not required to be shared.
      • Employees and others using offices and meeting rooms are reminded of the need to avoid leaving “Confidential” materials where others might see them, this include leaving information white boards etc.
   3. Equipment: All CitNOW Group have the following controls in place to ensure the safety of equipment.
      • The CitNOW Group predominantly uses cloud-based services from large, well-established providers, who are responsible for provision of assured utilities within their respective datacentres.
      • Power and telecommunications cabling carrying data or supporting information services within all CitNOW Group offices are protected from interception, interference, or damage.
      • Cabling to servers and networking equipment are securely stored in locked comms rooms, with only a few employees having access to these areas and all cabling is well maintained.
      • Specialist equipment such as Fire Protection equipment is maintained according to the service intervals and specifications
   4. Clear desk and clear screen policy:

      Confidential or sensitive information, whether held electronically or on paper records must be secured appropriately and in accordance with the Information Classification Policy when you are absent from your workplace for an extended period and at the end of each working day. To facilitate this, the following guiding principles have been produced which cover both non-electronic (e.g., manual/paper files) as well as electronic forms of information.

9. Operation Security
   1. Operating procedures: CitNOW Group have operational procedures in place and allows Directors and Heads of Department to decide where to store operational procedures which best suit them and their staff, as well as the creation of such documentation.
   2. Change management: Significant changes to the organisation, business processes, information processing facilities and systems with CitNOW Group are subject to formal review and agreement by the Management Board
   3. Separation of environmental: To reduce the risk of malicious activities, unauthorised or accidental changes from internal uses, all products within the CitNOW Group have a separate test/development and production environments, following industry best practices, we predominantly use the following environments within each entity:
      • Development – for development
      • Staging/Testing - for internal testing
      • Production environment – live operational environment
   4. Malware: The use of anti-virus software on employee devices detects and eliminates the vast majority of common malware that is in existence. We use well-known and widely trusted products to minimise the risk that a user will encounter malware. In all cases where anti-malware software is installed
      • The software must be regularly updated using the auto-update feature of the software;
      • Malware scanning must occur when files are accessed.
   5. Back-ups: Backup of all business-critical systems within the CitNOW Group are done regularly, both cloud and local back-ups are used. Backup policies have been established to define the requirements for backup of information, software and systems within each entity.
   6. Logging and monitoring: CitNOW Group perform event logging for all entities products via various monitoring software, logs are accessed as and when required and contain information such as, user logging attempts and errors in the applications. All logging information is only accessible to users with the appropriate privileges, users are required to have an account within the specified system with suitable permissions.
   7. Controls of software: There are several measures in place within the CitNOW Group to control changes of software on operational systems. All changes to operational software are managed in accordance with Change management and consider the business requirements for the change and the security aspect of the change.
   8. Vulnerability management: CitNOW Group periodically run vulnerability scans and carries out annual penetration tests to look for any vulnerabilities not previously identified. Where a vulnerability comes to light, regardless of the source, it is considered by the Compliance team, CIO, CTO and any other key stakeholders. Where action is required to remediate a vulnerability, depending on the nature, action is taken immediately or scheduled for action to be taken by a specified target date.
10. Communication Security
    1. Network controls: Internal networks are managed by the IT department. The IT department are responsible for maintaining and updating all network activities. As we primarily used cloud-based services, the Security of network services is primarily the responsibility of the cloud service providers. All internet and cloud-based services have a strict SLA agreement between CitNOW Group and the supplier. Any access to the CitNOW Group servers or systems are managed by authentication. Guest networks without access to core systems are available for guests.
    2. Information transfer: CitNOW Group have an information transfer policy to ensure that information/data, which is being transferred, internally, externally or to third parties is done in a method as to meet the minimum-security requirements. This will include information in a variety of formats (example – Paper and Electronic). This policy applies to all employees of CitNOW Group and any Third-party that processes the organisation information.
    3. Confidentiality & non-disclosure agreements: Confidentiality and non-disclosure agreements addressing the requirements to protect confidential information using legally enforceable terms. Confidentiality or non-disclosure agreements are applicable and required for all external parties or employees of the CitNOW Group, with either a signed NDA in place or full NDA provision forming part of an agreement.
11. System Acquisition, Development and Maintenance
    1. Security requirements of information systems: CitNOW Group follows the security controls which include the assessment and documentation of security requirements, especially (Development Teams are per entity within the CitNOW Group, with an overarching CTO located at Group Level and Management Board.):
       • Information security in project management
       • System changes control procedures
       • Information security policy for supplier relationships
       • Monitoring and review of supplier services
       • Secure coding practices
    2. Secure development policy: The policy reflects our approach to secure development of our services, products and websites and applies to all development teams. Secure coding standards are considered and followed.
    3. Change control: Our change control procedures in development are within our Change Control Policy change management. All changes to the system are run through a peer code review and testing process of which are in line with our documented procedures.
    4. Outsourced development: All outsourced developers are assessed to ensure they are qualified and competent. Individual Contractors are treated in the same manner as CitNOW Group developers with same development policies and controls applying to all for outsourced development as internal development.
    5. Acceptance testing: Testing is carried out on all changes to ensure the security, robustness, correctness and performance of the application. Acceptance testing is standard practice for our developers as part of our deployment cycle, all new features are tested individually before deployment. We have segregation of duties, with testers appointed at each entity to be part of each development team.
    6. Protection of test data: No personal data is used for development or testing in ordinary circumstances in any of the CitNOW Group products.
12. Supplier Relationships
    1. Information security policy for suppliers: The CitNOW Group has a Supplier Security Policy. The purpose of this policy is to ensure that information exchange with third parties happens in such a way that the maximum value can be gained from these relationships whilst protecting CitNOW Group information assets from abuse. All third parties with access to data or information have a current and up to date Non-Disclosure and Confidentiality Agreement in place. This is either contained within the contract or service agreement depending upon the type of supplier. There is also an internal third-party procedure in place that ensures all employees follow the correct steps when considering a new supplier and that the Compliance team are involved in the process, who will ensure all checks have been undertaken.
    2. Supplier addressing security with suppliers: Where possible we work with suppliers that already meet the majority of our Information Security needs for the services that they provide to us and have a good track record of addressing information security concerns responsibly. We select leading and well-trusted services that are known for their robustness, reliability and security and wherever possible look to suppliers that have already achieved ISO 27001 or its equivalent.
    3. Monitoring supplier services: All CitNOW Group suppliers are subject to a security review before engaging services and are subject to ongoing review. All critical suppliers are reviewed on an annual basis and non-critical suppliers are reviewed at the end of contract or prior to contract renewal
    4. Managing changes to suppliers: Changes to suppliers’ services consider the following and as best practice we also aim to research and consider 3 suppliers prior to final selection of a new supplier.
       • The nature of the change;
       • The supplier type affected and the criticality of business information, systems and processes and re-assessment of risks;
       • The intimacy of relationship; and
       • Our ability to influence or control change in the supplier
13. Information Security Incident Management
    1. Responsibilities and procedures: The procedures for incident response planning are defined in advance of an incident occurring. This helps to guide an incident through the key stages we have defined to ensure that all incidents receive the same structured approach.
    2. Reporting information security events & weaknesses: Each employee, supplier or other third party who is in contact with information and/or systems of the CitNOW Group, or those of its customers, must report any system weakness, incident or event which could lead to a possible security incident. Information on how to report such events or weaknesses forms part of our ongoing information security training for all CitNOW Group employees and as part of onboarding process for suppliers and other third parties.
    3. Assessment of information security event: As part of the assessment, it will also determine the impact and likelihood of event. Once assessed, an assigned nominated person will commutate with relevant parties required to resolve that event. During the assessment of a security event the first task is to assess the event and then determine a course of action that;
       • Minimises any compromise of the Availability, Integrity or Confidentially (CIA) of information
       • Prevents against further incidents
       • Has the minimum disruption to other users of that service
       • Considers who needs to be informed; internally, customers, suppliers, regulators e.g., within GDPR and Data Protection Act 2018 requirements.
    4. Response to information security event: The response time to an incident shall be dictated by the classification and severity. Should any incident occur that affects our customers, we will notify the customer in accordance with our legal and contractual obligations. It should be noted that immediate notification is not always possible because of the time it takes to properly investigate, however notification will take place within any legally enforceable limits.
14. Information Security Aspects of Business Continuity Management
    1. Planning information security continuity: CitNOW Group have identified various scenarios which could potentially impact the business and have documented the steps to mitigate such events as part of Business Continuity Plan. This plan is designed to assist in timely resumption of operations in the event of a disruptive incident.
    2. Verify, review and evaluate information security continuity: Testing and maintaining of the CitNOW Group the business continuity plan is conducted to ensure it is consistent with our information security objectives is done based on the following:
       • Testing of specific parts of the plan and their impact on information security is conducted in frequencies that are related the risk probability and impact per the risk assessment.
       • BCP Audits are planned regularly in line with the audit programme.
       • Reviews of the plan itself for ensuring relevance is conducted by Compliance and IT teams, with any identified beneficial changes being presented to the Management Board.
       • Full Business Continuity tabletop exercise carried out at least once a year to ensure it remains part of an integrated approach to the business and its ability to meet its objectives.
    3. Availability of information processing facilities: The CitNOW Group predominately use cloud-based services for the delivery of our work. These systems have inherent redundancy built into their high-availability, resilient architectures.
15. Compliance
    1. Application legislation: The applicable legislation, regulation and contractual requirements affecting the CitNOW Group are identified and documented and monitored and reviewed as part of the normal course of business and as part of the management reviews.
    2. Intellectual property rights: Any agreements entered that require any form of compliance with legislative, regulatory and contractual requirements related to intellectual property rights and use of proprietary software products will need approval from the CitNOW Group Management Board or where necessary via our outsourced lawyer.
    3. Protection of records: CitNOW Group records are kept protected from loss, destruction, falsification, unauthorised access and unauthorised release, in accordance with legislative, regulatory, contractual and business requirements. Specific records are kept in line with the Data Retention. Schedule and are managed by the relevant information / asset owner
    4. Information security review: The CitNOW Group information security policies are procedures are subject to independent review at regular intervals and when changes are made, as part of our commitment to continual service improvement. Internal Audits are also planned through the Audit Programme, on an annual basis, with the appropriate personnel allocated to undertake the audit.
    5. Technical review: Vulnerability & penetration tests are conducted on each product on an annual basis by a qualified pen test specialist company, results are reviewed, and any vulnerabilities remediated.
16. Additional Supporting Policies

    The CitNOW Group also have a host of other policies within the business that help to support our information security practices, these included, but not limited to;

    • Group Global Anti-Bribery Policy
    • Disciplinary Policy
    • Group Global Whistleblowing Policy
    • Global Health and Safety Policy
    • Modern Slavery Policy
    • Breach Notification Procedure
17. Certifications

    For Zype TV Ltd (t/a CitNOW) and CitNOW Video GMBH confidentiality, availability and integrity of information have great value. We have taken extensive measures on protection of sensitive and confidential information. Therefore, we follow the question catalogue of information security of the German Association of the Automotive Industry (VDA ISA). The Assessment was conducted by an audit provider, in this case the TISAX audit provider TUV SUD GmbH. The result is exclusively retrievable over the ENX portal.

    1. ISO 27001: CitNOW Group Limited is ISO 27001 certified by the BSI (cert number – IS 785456).
    2. Cyber Essentials: CitNOW Group Limited is Cyber Essentials certified by Comtact (cert number - 6facac97-1c10-4d49-8360-0d36b6824fc7
    3. TISAX: The ENX Association supports with TISAX (Trusted Information Security Assessment Exchange) on behalf of VDA the common acceptance of Information Security Assessments in the automotive industry. The TISAX Assessments are conducted by audit providers that demonstrate their qualification at regular intervals. TISAX and TISAX results are not intended for general public.
18. Subprocessors

    These subprocessors are subject to change over time as new features and system updates are released. Measures are taken when selecting new subcontractors to ensure appropriate security and privacy due diligence is applied. We will let you know with a minimum 30 days' notice of our intent to onboard or change a subprocessor in writing (email preferred). The sub processors that each entity within the CitNOW Group uses can be found via the following links:

    • AutoSLM
    • Auto Imaging
    • CitNOW: - Zype TV - European Entity
    • Dealerdesk
    • Eight Technology
    • Quik
    • RTC
    • Web1on1
19. CitNOW Group Head Office

    All CitNOW Group Head office locations can be found within the CitNOW Group website.

CitNOW Group - Standard (December 2024 Edition)

Between Parties:

This Agreement is made between:

1. The entity identified as “Supplier” on the Order Form(s) (“Supplier”).
2. The entity identified as the “Customer” on the Order Form(s) (“Customer”).

Introduction

The Supplier is part of and operates within the CitNOW Group. CitNOW Group is a group of companies offering Products and Services to the automotive industry.

As part of the supply of Products and Services, the Supplier will act as the Customer’s data processor. The terms of clauses 1 (Data Protection) and 2 (Consumer Data and Employee Data) within the CitNOW Group Terms and Conditions apply in respect of the parties’ data protection obligations. This addendum is for Customers benefit if they should wish to have a signed Data processing Addendum in place.

The provisions contained within this addendum are very important and require the Customer to put processes in place to ensure the requirements of this Data processing Addendum are satisfied. Please read these provisions carefully. In particular the Customer must ensure, and procure that all Users ensure, prior to transferring any Consumer’s personal data to Supplier through the Products that either:

1. consent is obtained from all Consumers for their Consumer Data to be uploaded into the Product(s) or otherwise transferred to Supplier; or
2. that the Customer has clearly identified one or more other lawful basis (as set out in the Data Protection Legislation) which allow for the Consumer Data to be uploaded into the Product(s) or otherwise transferred to Supplier.

Definitions

Terms defined in the Terms and Conditions, Licensing Agreement and/or the Order Form(s) shall, unless otherwise defined herein, have the same meaning in this Data processing Addendum.

• Agreement: the contract made between Supplier and the Customer comprising the Order Form(s)(s), the Terms and Conditions and the Licensing Agreement(s).
• CitNOW Group: the members of the CitNOW Group of companies, being any entity controlling, controlled by or under common control of Supplier and “control” shall have the meaning given to it in section 1124 of the Corporation Tax Act 2010. All entities shall be listed on the CitNOW Group website the CitNOW Group website at all times.
• Consumer: any consumer who is a customer of the Customer in respect of whom personal data is uploaded by a User into the Products.
• Consumer Data: means all information, including personal data, relating to a Consumer that is uploaded to the Products or transferred to Supplier by the Customer, including by any User.
• Content: the video, still images, audio, graphics, text, messages and other information created by You and uploaded via the Product;
• Controller: processor, data subject, personal data, personal data breach, processing and appropriate technical and organisational measures; as defined in the Data Protection Legislation.
• Customer: the customer named as such in the Order Form(s) (s)which may be an OEM, a National Sales Company, a Dealer Group or a Retailer.
• Data: any data, including personal data, which is uploaded to the Products or transferred to Supplier by the Customer, including any Consumer Data and/or Employee Data.
• Data Protection Legislation: means:
  1. to the extent that the UK GDPR applies, the law of the United Kingdom or of a part of the United Kingdom which relates to the protection of personal data; or
  2. to the extent that the EU GDPR applies, the law of the European Union or any member state of the European Union to which Supplier or the Customer are subject which relates to the protection of personal data.
• Dealer Group: a company operating multiple Retailers.
• Employee Data: any data, including personal data, which is uploaded to the Products or transferred to Supplier by the Customer, including by any User.
• EU GDPR: the General Data Protection Regulation ((EU) 2016/679), as it has effect in EU law. 
• OEM: an original equipment manufacturer.
• Order Form(s): the Order Form(s) Supplier and signed by the Customer incorporating these Terms and Conditions and the Licensing Agreement(s) by reference.
• Products: The products described within the Order Form(s), which are supplied to the Customer by the Supplier (either directly or as an authorised reseller) on a subscription basis, and which may be available in tiers known as standard, pro and plus (where applicable). The Product(s) purchased by the Customer, including the product tier, shall be as detailed in the Order Form(s)of the subscription, the supply of the Product(s) includes provision of Technical Support;
• Retailer: the franchised dealer(s) identified on the Order Form(s).
• Services: The services supplied to the Customer by Supplier (either directly or as an authorised reseller), as more fully detailed in the Order Form(s), which may include training, data import, data export, data cleansing, bespoke development and/or webinars, but excluding the Set-Up Service;
• Third Party Software: any third-party software applications or services which Supplier supply or make available to the Customer as part of the Products (including any Additional Features) and/or Services (including any Set-Up Services), subject always to the Customer agreeing to be bound by any terms applicable to such third-party software;
• Users: employees of the Customer at the Customer sites (including Head Office employees, where applicable) detailed on the Order Form(s) who are permitted to use the Products;
• UK GDPR: has the meaning given to it in Section 3(1) (as supplemented by Section 205(4)) of the Data Protection Act 2018.

1. Data Protection
   1. Supplier shall process Data on behalf of the Customer. The scope and duration, categories and purpose of the personal data processed by Supplier pursuant to this Agreement are set out in Annex A within the License Agreement(s).
   2. The Customer shall own all right, title and interest in and to all of the Data and shall have sole responsibility for the legality, reliability, integrity, accuracy and quality of all such Data. Supplier acknowledges and agrees that the Customer shall be the data controller of any personal data comprised in the Data. Where the Customer is an OEM or Dealer Group the parties agree that Data may be shared with Supplier either by the OEM or the Dealer Group, or by Retailers within the Customer’s group. Where this is the case, Supplier understands and acknowledges that the Retailer and an OEM / Dealer Group shall be joint data controllers of the personal data disclosed to Supplier, subject to the terms of a separate written agreement between the Retailer and the OEM/Dealer Group, as applicable.
   3. The Customer’s instructions in relation to the processing of personal data comprised in the Data shall be as set out in Annex A of the Licensing Agreements. The Customer shall be entitled, in writing or in a machine-readable format (in text form*), to update, modify, amend or replace such individual instructions by notifying Supplier’s designated contact for data protection matters. The Customer shall, without undue delay, confirm in writing or in text form any instruction issued orally.
   4. Both parties will comply with all applicable requirements of the Data Protection Legislation. This clause 1 is in addition to, and does not relieve, remove or replace, a party’s obligations or rights under the Data Protection Legislation.
   5. Subject always to clause 1.7.2, personal data comprised in the Data may be transferred or stored outside the UK and EEA or the country where the Customer is located in order to provide the Products and/or Services (including, where applicable, any Additional Features) under the Agreement.
   6. Without prejudice to the generality of clause 1.4, the Customer will ensure that it has all necessary appropriate lawful basis and notices in place to enable lawful transfer of the personal data to Supplier for the duration and purposes of the Agreement.
   7. Without prejudice to the generality of clause 1.4, Supplier shall, in relation to any personal data processed by it when performing its obligations under the Agreement:
      1. Process that personal data only on the Customer’s documented written instructions unless Supplier is required by the laws of any member of the European Union and/or domestic UK Law to process such personal data (Applicable Laws). If Applicable Laws require Supplier to process such personal data, it shall tell the Customer before such processing unless those Applicable Laws prohibit it from doing so;
      2. Not transfer any personal data outside of the European Economic Area and the United Kingdom unless the following conditions are fulfilled:
         1. Supplier have provided appropriate safeguards in relation to the transfer;
         2. the data subject has enforceable rights and effective legal remedies;
         3. Supplier complies with its obligations under the Data Protection Legislation by providing an adequate level of protection to any personal data that is transferred; and
         4. Supplier complies with the Customer’s reasonable advance instructions when processing the Customer’s personal data;
      3. assist the Customer, at the Customer’s cost, in responding to any request from a data subject to enable the Customer to comply with its Data Protection Legislation obligations with respect to security, breach notifications, impact assessments and consultations with supervisory authorities or regulators;
      4. promptly notify the Customer on becoming aware of a personal data breach affecting the Customer’s personal data; 
      5. at the Customer’s written request and on termination of the Agreement, delete or return the Customer’s personal data in accordance with clause 1.11 unless required by Applicable Law to store the personal data; and
      6. maintain records and information to demonstrate its compliance with this clause 1 and clause 2. Supplier shall permit the Customer, and its authorised representatives to audit and inspect its compliance with Data Protection Legislation provided always such audit and/or inspection is carried out on reasonable notice at a mutually convenient time. Any information disclosed as part of the audit / inspection shall be treated as confidential information in accordance with clause 9 of the CitNOW Group Terms and Conditions. Audits and inspections shall not be carried out more than annually unless the Customer, acting reasonably, believes Supplier has breached the Data Protection Legislation; and
      7. promptly tell the Customer if, in Supplier’s opinion, the Customer’s instructions infringe Data Protection Legislation. In such instances, Supplier shall be permitted to suspend performance on such instruction until the Customer confirmed or modifies such instruction so that it complies with Data Protection Legislation.
   8. Each party shall ensure that it has in place appropriate technical and organisational measures, to protect against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data, appropriate to the harm that might result from the unauthorised or unlawful processing or accidental loss, destruction or damage, having regard to the state of technological development and the cost of implementing any such measures. 
   9. The Customer consents to Supplier appointing subprocessors of personal data under the Agreement. A list of the subprocessors used by Supplier is available on each company website . Supplier confirms that it has or will enter into (either directly or through a member of the CitNOW Group) a written agreement with subprocessors incorporating terms which are substantially similar to those set out in this clause 1. Supplier shall remain fully liable for all acts or omissions of any sub processor appointed by or on behalf of Supplier pursuant to this clause 1. Where Supplier uses any subprocessors which are based outside of the UK and EEA, in a territory where an adequacy decision is not in place, it shall comply with the requirements of clause 1.7.2 before any personal data is transferred to such subprocessor. A list of any subprocessors to which this clause applies is available on Suppliers Website at all times. Supplier may appoint new subprocessors from time to time, and the Customer is advised to regularly check the websites for a list of the current subprocessors used by Supplier.
   10. Third Party Claim. The Customer shall indemnify and defend Supplier at its own expense against all costs, claims damages or expenses incurred by Supplier and/or other members of the CitNOW Group or for which Supplier and/or other members of the CitNOW Group may become liable due to any failure by the Customer, the Users, the Retailers (where applicable), and/or the Customer’s employees, subcontractors or agents failure to comply with its obligations under clauses 1 and/or 2, and/or the Data Protection Legislation, as applicable.
   11. Retention upon Termination. Should this Agreement be terminated for any reason, Supplier will hold the Data for a period of 60 days (or such other period as may be specified in the applicable Licensing Agreement) after termination. Supplier holds the Data for this period for the following reasons:
       1. To allow the Customer to change their mind and resume their subscription for the Product with all details, preferences and configurations still in place, if applicable; and
       2. To allow the Customer to request an export of its Data.
   12. Data Sharing Within CitNOW Group.. The Customer acknowledges and agrees that Supplier may share the Customer’s personal data with other entities within the CitNOW Group for the purposes of: (i) providing its Products and/or Services to the Customer; (ii) improving its Products and/or Services; and (iii) to facilitate the creation of new Products, features and/or Services. Supplier confirms that appropriate safeguards are in place between it and other members of the CitNOW Group to protect the security of such personal data, as required by Data Protection Legislation. These safeguards include data sharing agreements incorporating standard contractual clauses (where applicable) and/or ensuring that other legally compliant transfer mechanisms are in place when transferring personal data within CitNOW Group. Supplier shall remain responsible for the protection of personal data shared within the CitNOW Group and will ensure that such personal data is processed only as necessary for the aforementioned purposes.
2. Consumer Data and Employee Data
   1. The parties acknowledge and agree that as Consumer Data is to be processed by Supplier on behalf of the Customer it is the Customer’s responsibility to identify and record the lawful basis for capturing and sharing the Consumer Data with Supplier. Supplier has no control of the data entered into the Product(s) by the Customers and its Users. Accordingly, the Customer shall ensure, and shall procure that all Users ensure that either:
      1. consent is obtained from all Consumers for their Consumer Data to be uploaded into the Product(s) or otherwise transferred to Supplier; or
      2. where consent is not obtained, that the Customer has clearly identified one or more other lawful basis (as set out in the Data Protection Legislation) which allow for the Consumer Data to be uploaded into the Product(s) or otherwise transferred to Supplier.
   2. The Customer shall keep a written record of such lawful basis and provide evidence of such lawful basis for processing to Supplier on request.
   3. It is the Customer’s responsibility, irrespective of whether the Customer is an OEM, a Dealer Group or a Retailer, to ensure compliance with clauses 2.1 and 2.2. Supplier accepts no responsibility or liability to the Customer and/or any Consumer for the Customer failing to obtain the necessary authority and permission to share Consumer Data with Supplier. Where a Dealer Group or an OEM have entered into this Agreement in order to purchase subscriptions to use the Products on behalf of its Retailers, it is the Dealer Group / OEM’s responsibility to procure each Retailer in its group has obtained the necessary authorisation and permission before any Consumer Data is uploaded to the Product or otherwise transferred to Supplier.
   4. The Customer shall indemnify Supplier for any losses, costs, claims, damages or expenses incurred by Supplier and/or other members of the CitNOW Group caused by disclosure of Consumer Data by the Customer without the necessary authorisation and permission being obtained in advance of disclosure.
   5. Except as provided in Data Protection Legislation, Supplier shall not use or allow use of the Consumer Data other than to fulfil its obligations under the Agreement and/or in accordance with the Customer’s written instructions.
   6. Supplier confirms that all employees involved in the processing of the Consumer Data shall be prohibited from processing the Consumer Data outside the scope of the instructions detailed in clause 2.5 above. Supplier confirms that any person entitled to process Consumer Data is bound by a contractual commitment to confidentiality or is subject to an appropriate statutory obligation to confidentiality.
   7. If either party becomes aware of any unauthorised or unlawful processing of the Consumer Data or if the Consumer Data is lost or destroyed, or if either party learns or suspects of a personal data breach affecting the Consumer Data has occurred, that party shall promptly notify the other party and fully cooperate with the other party to take the necessary remedial action as soon as practicable.
   8. Where Employee Data is uploaded by the Customer (as controller) into the Product it shall be accessible by Supplier and, in this circumstance only, Supplier shall act as a joint controller of the Employee Data. Both the Customer and Supplier shall process the Employee Data to the extent necessary to enable fulfilment of their contractual obligations under the Agreement.
3. General
   1. Survival of Clauses. If any provision of this Data processing Addendum is found to be unenforceable, the remaining provisions shall remain valid.
   2. Governing Law. The Agreement is governed by the law applicable to the entity as named on the Order Form(s) and this Data processing Addendum and shall be subject to the exclusive jurisdiction to the courts of which said entity is registered.
   3. Changes. Notwithstanding anything else to the contrary in this Data processing Agreement and without prejudice to the clauses held within, CitNOW Group and Supplier reserve the right to make any updates and changes to this Data Processing Addendum and at all times shall the latest version be in effect between Customer and the Supplier. No changes shall be introduced which materially reduce the obligations as set on Supplier as a Processor to the Customer under the applicable Privacy Laws.

CitNOW Product (December 2024 Edition)

Zype TV Ltd (t/a CitNOW) (“CitNOW”) provides CitNOW Product solutions on a subscription basis (“CitNOW Product”). There are 4 main product subscriptions which are available on iOS, Android, and Desktop platforms: Workshop, Sales, Web and Bodyshop. Supplementary parts of the platform include, but are not limited to, the Dashboard and Reporting.  Where the Supplier is not CitNOW, the Supplier shall act as an authorised reseller of CitNOW and the Supplier shall procure that CitNOW fulfils supply of the CitNOW Products to the Customer on behalf of the Supplier.

This Licensing Agreement is supplemental to the CitNOW Terms and Conditions (“Terms and Conditions”) and applies specifically to the CitNOW Product subscriptions referenced above. If there is any conflict between the Order Form, these Terms and Conditions and the Licensing Agreement(s), the following order of priority shall apply:

1. the Order Form;
2. the Terms and Conditions; and
3. the Licensing Agreement(s)

Defined terms contained in this Licensing Agreement shall have the meaning given to them in the Terms and Conditions. The following additional definitions apply in this Licensing Agreement.

Additional Definitions

Kit any equipment We provide to You if ordered within the Order Form or as an Add On as provided for part of the Subscription. The inclusions of the Kit will be listed in Section 3 of the Order Form.

1. Term and Termination
   1. Cancellation. Pursuant to clause 5.3 of the Terms and Conditions, the Customer may cancel this Licensing Agreement by giving no less than 90 days’ notice in writing prior to the end of the Initial Minimum Term or any Renewal Term, as applicable. Notice to terminate should be sent in writing to customer@citnowgroup.com
   2. Continuance of the Terms and Conditions and other Licensing Agreements. To avoid doubt, unless the Agreement is terminated in whole pursuant to clause 5 of the Terms and Conditions, if the Customer has purchased other Products/Services which are the subject of a separate Licensing Agreement, the Licensing Agreement and Terms and Conditions in respect of such other Products/Services shall remain in full force and effect, notwithstanding termination of this Licensing Agreement.
   3. Access Rights to Content upon Termination. On termination the Customer will no longer be able to access the CitNOW Product. Further, if the Customer is a Dealer Group or an OEM, the Retailers in the Customer’s group will no longer be able to access the CitNOW Product. Personal data may be retrieved as outlined in the CitNOW Privacy Notice.
2. Technical Support and Availability
   1. Technical Support. During Customers subscription to the CitNOW Product, CitNOW shall make available to Customer technical support. 
   2. Contact. You may contact CitNOW for support using the methods advertised on the CitNOW Website. Customer agrees that CitNOW may use the contact details of Customer, or Customers employer, provided to CitNOW to assist Customer with the use of the CitNOW Product and provide ongoing support.
   3. Tiers and Retention. In accordance with clause 1.5 of the CitNOW Group Terms and Conditions (Product Tiers) the CitNOW Products are available in tiered offerings, Standard, Plus and Pro. Features shall be available within each Product Tier Offering. Maximum retention of Consumer Data and Content shall be determined by the Tier Customer subscribes to of the CitNOW Product, in line with our retention policies.
3. Kit Terms
   1. Kit. If contracted to, as set out in the Order Form, CitNOW can make available to Customer suitable Kit, which may include but is not limited to windjammers, trip-pods and mobile devices. Fees for kit shall be paid in accordance with Section 4 of the Order Form, and Clause 4 of the Terms and Conditions.
   2. Customer acknowledges and accepts that:
      • the mobile device contained within the Kit will remain the property of CitNOW;
      • Upon termination of the contract, Customer must return mobile device(s) to CitNOW office as detailed on the heading of the Order Form within fourteen (14) days. Customer is liable for delivery of the mobile device until such time as CitNOW receives delivery safely.
      • attempts to modify or jailbreak the mobile device shall constitute a breach of Clause 9 and clause 10.3 of the Terms and Conditions.
   3. Any inclusions within the Kit which is supplied may not be brand new, however CitNOW shall procure that it shall be in good condition and fit for purpose. In all cases, Kit not fit for purpose shall be replaced in line with clause 3.5.
   4. Should any provided CitNOW mobile device contained within the Kit be lost or damaged by the Customer or Users, Customer shall be charged a replacement cost at the cost price of the specific model. If devices are upgraded/obsolete in the future the replacement cost could differ.
   5. Mobile devices shall be replaced by CitNOW without undue delay following a customer request, though there may be charges in line with clause 3.4. Failure to fulfil a replacement due to a delay caused by the third-party provider shall not constitute a breach of the Agreement. Customer shall ensure that all faulty or broken phones shall be returned to CitNOW Office without undue delay and, in any event, within 14 day(s) after receiving replacement. Failure to do so shall constitute a breach of the Agreement.

Annex A - Data Processing Annex

• Scope and duration of processing: To provide the service. Duration is defined as for as long as we have an active contract between CitNOW and Customer. Consumer data retention is set by the Product Tier Customer has subscribed to.
• Categories of personal data: Dealership staff name, email address and phone numbers. Consumers names, email addresses, phone numbers, Vehicle data including, but not limited to Registration, VIN and vehicle health data.
• Purpose of processing: To provide the video solution to Customer
• Subprocessors: CitNOW - Zype TV Subprocessors

CitNOW Conversations (December 2024 Edition)

Zype TV Ltd (Company number 06630126) t/a CitNOW and Web1on1 BV (“Web1on1”) are both companies operating within the CitNOW Group. Zype TV Ltd (and certain of its affiliates operating in the European Union) are authorised resellers of the Product as described. Both entities provide software solutions to their customers on a subscription basis.

Web 1on1 is a provider of automotive messaging Product solutions which are made available to Customers on a subscription basis. The Product is CitNOW Conversations (the Web1on1 Product, offered in tiers, sold by CitNOW). Web1on1 is the owner and developer of the Web1on1 SDK and API’s which power the CitNOW Conversations Product and Product.

CitNOW Conversations is offered on a Standard or Plus tiered offering as a Messaging Product. Details of the tier are provided to Customer and the tier of which Customer has subscribed to shall be detailed within the Order Form.

This Licensing Agreement is supplemental to the CitNOW Group Terms and Conditions (“Terms and Conditions”) and applies specifically to CitNOW Conversations. If there is any conflict between the Order Form, these Terms and Conditions and the Licensing Agreement(s), the following order of priority shall apply:

1. the Order Form;
2. the Terms and Conditions; and
3. the Licensing Agreement(s)

Defined terms contained in this Licensing Agreement shall have the meaning given to them in the Terms and Conditions. The following additional definitions apply in this Licensing Agreement.

Additional Definitions

• CitNOW Conversations Product Partner: a corporate entity that acts as an authorised CitNOW Conversations partner providing Services to Customers on behalf of CitNOW.
• Communications: the communications (Messaging, WhatsApp, voice note or other) which are passed through the CitNOW Conversations Product from the Customer to their end customer (Consumer).
• De-identified Data: all Customer Data that is not personal data, excluding any data that is Consumer Data.
• Project Plan; the statement of work outlining the plan for delivery and implementation of the Products including details of the Set Up Services to be provided by CitNOW to the Customer.
• Third Party Messaging Products: any third party Product used by the Customer to transmit and receive messages with participants of an online chat through the CitNOW Conversations Product, which may include Facebook, Google, Telegram, WhatsApp and other Products.
• CitNOW Conversations Product: means the software, hardware, Products and systems, as developed and used by Web1on1 to host and make the Product and Services available for Customer’s use, sold and supported by CitNOW. For the avoidance of doubt, the SDK and APIs within the Product and Product are developed and made available by Web1on1.

1. CitNOW Conversations
   1. “CitNOW Conversations Standard” which is the provision of an Automotive Messaging Product (chat facility) which is fulfilled by the Customer meaning it is personnel managed and controlled by the Customer who write the chat responses which appear on the CitNOW Product through Facebook Messenger, WhatsApp, Google Business Chat, Email, OEM Apps, Website and Live Chat all in a single box with unlimited user access. SMS is only provided through Customers own Twilio Account. Live Chat and WhatsApp is available on any of Customer’s websites. The following provisions apply only where the Customer has opted to purchase the “Standard” Tier;
      1. Where the Customer choses the “Standard” Tier, CitNOW will facilitate provision of the CitNOW Conversation Product, and the Customer shall be entirely responsible for managing (meaning addressing and responding to) all live online chats and conversations which flow through the CitNOW Conversations Product. CitNOW shall have no liability to the Customer for any content flowing through the CitNOW Conversation Product, other than to ensure the CitNOW Conversations Product operates efficiently in order to ensure the flow of conversation through it.
      2. Upon Customer’s request, CitNOW will issue one or more administrator accounts (each an “Administrator Account”) to the Customer which enables the Customer create user accounts (each, a “User Account”) for use by Users (which for the purposes of this Licensing Agreement includes individuals who are employees of or contractors engaged by the Customer) who Customer wishes to have access to the CitNOW Conversation Product. Customer will ensure that Users use the CitNOW Conversation Product only through their designated User Account.
      3. Customer will not share details of the Administrator Accounts with any other person and will not allow Users to share their User Account details with any other person. Customer will promptly notify CitNOW of any actual or suspected unauthorized use of the CitNOW Conversations Product by Users. CitNOW reserves the right to suspend, deactivate, or replace any Customer User Account or Administrator Accounts if it determines that the User Account or Administrator Account, as applicable, may have been used for an unauthorized purpose or accessed by an unauthorised user.
   2. The Customer is responsible for ensuring Users comply with the Usage Rules detailed in clause 3.
   3. Depending on the Customer’s requirements and objectives, CitNOW may work with customer to create a Project Plan for delivery of the Set Up Services. A Project Plan may not always be required.
   4. The Services are delivered using the CitNOW Conversations Product and those Third-Party Messaging Products which have been selected by Customer and for which the Customer holds a subscription. The selection and use of Third-Party Messaging Products is entirely at the risk of Customer. CitNOW will provide the Customer with the credentials of the established account, subject to clause 3.2 of the Terms and Conditions. In order to deliver the CitNOW Conversations Product it is necessary for the Customer to have a WhatsApp Business account, and it is the Customer’s responsibility to arrange such account. However, to avoid doubt, WhatsApp is not classed as a subprocessor for the purposes of the Agreement.
   5. Subject to payment of the relevant Fees, the Customer will be granted a non-exclusive, non-transferrable, revocable right and licence during the term of the Product subscription to:
      1. use the CitNOW Conversations Product of which the Customer purchases a licence to use the tiered Product provided the Customer (1) complies with the terms of the Agreement, including this Licensing Agreement; (2) complies with all terms of use applicable to the Third Party Messaging Product(s) and any third party business applications which the Customer wishes to integrate, interface and/or operate with the CitNOW Conversations Product;
      2. use the API solely for developing or enabling third party business applications which are not integrated with the CitNOW Conversations Product to interface with the CitNOW Conversations Product. For the purposes of this clause the API means the application programming interface, made available and developed by Web1on1, to assist the Customer in developing its internal business software to interoperate with the CitNOW Conversations Product;
      3. download, install and use the Web1on1 SDK to develop functionality within the software application or website developed by the Customer using Web1on1 SDK (the “Customer Application”) to facilitate communications between the Customer and online chat participants through the CitNOW Conversations Product, and to distribute and otherwise make available the Web1on1 SDK in object code form as embedded within the Customer Application. For the purposes of this clause the Web1on1 SDK means the software development kits made available by Web1on1, through CitNOW for the development of Customer Applications that interoperate with the CitNOW Conversations Product.
   6. The Customer grants to CitNOW and Web1on1, and to the extent necessary shall procure that any Users and chat participants grant to CitNOW and Web1on1:
      1. a non-exclusive, royalty free licence during the term of this Licensing Agreement to reproduce, modify, develop, access, collect, store and use all Data including any data, information or other content forming part thereof, in connection with the Agreement; and
      2. a non-exclusive, royalty free, irrevocable, perpetual, sublicensable, transferable worldwide right and licence to reproduce, modify, develop, access, collect, store, use, sell, exploit, resell, distribute, provide and transfer all De-Identified Data and any data information or other content forming part thereof, for any purposes, including to improve the Web1on1 Product. The licences contained in clause 1.3 do not apply to any Consumer Data or Personal Identifiable Data (as defined by the applicable GDPR) whatsoever.
2. Set up Services
   1. Depending on the Customer’s requirements and objectives, CitNOW may work with the Customer to create a Project Plan for delivery of the Set-Up Services. A Project Plan may not always be required.
   2. CitNOW shall provide the Set-Up Services in a professional and diligent manner, using reasonable skill and care, in accordance with good industry practice and in accordance with (where applicable) the Project Plan.
   3. CitNOW uses reasonable endeavours to meet any timings specified in the Project Plan for delivery of the Set-Up Services, but it does not guarantee that the Set-Up Services shall be supplied in accordance with any such timings.
   4. CitNOW reserves the right to alter the scope of the Services to be supplied if this is necessary to comply with any applicable law or regulatory requirement. However, if such alteration constitutes a material change to the scope of the Services, CitNOW shall notify the Customer of such alteration in advance.
   5. If the Customer requires a change to the Product and/or Services (including the Set Up Services) (a “Change”):
      1. the Customer will notify CitNOW of its requirements in writing. Following consideration by both parties of the Customer’s requirements, a change control note (“Change Control Note”) shall be prepared by CitNOW outlining the nature and details of the Change including details of any impact the Change may have on the Fees, the timescales for delivery of the applicable Products and Service(s) any other relevant information.
      2. the Customer shall promptly consider the Change Control Note and notify CitNOW in writing within 15 business days if it wishes to proceed with the Change based on the details in the Change Control Note. Following any such confirmation CitNOW shall implement the Change on the Customer’s behalf. The Customer acknowledges that if a Change is significant, CitNOW may need to amend the Project Plan or prepare a new Project Plan. Any Change agreed in writing by the parties shall form part of the Agreement.
3. Usage Rules
   
   The following usage requirements apply to the use of the CitNOW Conversations Product by Users. In addition CitNOW may publish from time to time on its website guidelines and policies relating to use of the CitNOW Conversations Product, and the Customer shall take steps to ensure the Users comply with such policies and guidelines. Without limiting the generality of the foregoing, Customer shall procure that Users do not use the CitNOW Conversations Product to send, upload, collect, transmit, store, use, disclose or process:
   • Data that contains any computer viruses, worms, malicious code, or any software intended to damage or alter a computer system or data;
   • Data that they do not have the lawful right to send, upload, collect, transmit, store, use, disclose, process, copy, transmit, distribute and display;
   • Data that is false, intentionally misleading, or impersonates any other person;
   • Data that is bullying, harassing, abusive, threatening, vulgar, obscene, or offensive, or that contains pornography, nudity, or graphic or gratuitous violence, or that promotes violence, racism, discrimination, bigotry, hatred, or physical harm of any kind against any group or individual;
   • Data that is harmful to minors in any way or targeted at persons under the age of 13;
   • Data that violates any applicable laws, or infringes, violates or otherwise misappropriates the intellectual property or other rights of any third party (including any moral right, privacy right or right of publicity); or
   • Data that encourages any conduct that may violate, any applicable laws or would give rise to civil or criminal liability;
     
     In addition to the foregoing Customer will not, and will procure that Users do not:
     
     
   • disable, overly burden, impair, or otherwise interfere with servers or networks connected to the CitNOW Conversations Product (e.g., a denial of service attack);
   • attempt to gain unauthorised access to the CitNOW Conversations Product;
   • use any data mining, robots, or similar data gathering or extraction methods, or copy, modify, reverse engineer, reverse assemble, disassemble, or decompile the CitNOW Conversations Product or any part thereof or otherwise attempt to discover any source code, except as expressly provided for in this Agreement;
   • use the CitNOW Conversation Product for the purpose of building a similar or competitive product or service; or
   • use the CitNOW Conversation Product other than as permitted by this Agreement.
   • Customer shall always remain liable for the misuse of the CitNOW Conversation Product by it or User. The Customer remains fully liable for and responsible for the actions of Users at all times.
4. Support
   1. CitNOW shall provide Customer with First Line Support. This may be passed to Web1on1 in the event second or third line support is required.
5. Term and Termination.
   1. Cancellation. Pursuant to clause 5.3 of the Terms and Conditions, the Customer may cancel this Licensing Agreement by giving no less than 90 days’ notice in writing prior to the end of the Initial Minimum Term or any Renewal Term, as applicable. Notice to terminate should be sent in writing to customer@citnowgroup.com.
   2. Consequences of termination. On termination of this Licensing Agreement and the subscription to use the Product, the Users will be archived, Third Party Product integrations will be disabled and any active chatbots will be deactivated. The Administrative Account owners will still have access to Customer Data for 30 days after termination. All Customer Data will be permanently deleted 30 days after the last invoice date.
   3. Continuance of the Terms and Conditions and other Licensing Agreements. To avoid doubt, unless the Agreement is terminated in whole pursuant to clause 5 of the Terms and Conditions, if the Customer has purchased other Products/Services which are the subject of a separate Licensing Agreement, the Licensing Agreement and Terms and Conditions in respect of such other Products/Services shall remain in full force and effect, notwithstanding termination of this Licensing Agreement.
   4. Access Rights to Content upon Termination. On termination the Customer will no longer be able to access the CitNOW Conversations Product. Further, if the Customer is a Dealer Group or an OEM, the Retailers in the Customer’s group will no longer be able to access the CitNOW Conversations Product. Personal data may be retrieved as outlined in the Web 1on1 Web1on1 Privacy Notice.
6. Disclaimer and indemnity
   1. It is understood by the Customer that for the CitNOW Conversations Product to function and operate properly, it will be necessary for the CitNOW Conversations Product to integrate, interface and/or operate with various third party business applications owned or licensed by the Customer (“Third Party Business Applications”). The Customer shall take all steps needed to ensure any Third Party Business Applications the Customer requires the CitNOW Conversation Product to integrate, interface and/or operate with, and shall ensure that all licences, permissions and approvals are in place to facilitate such integration, interfacing and/or operation. The Customer understands that CitNOW has no control over or responsibility for such Third Party Business Applications, including any data stored or maintained thereon. CitNOW accept no liability for any interference with the Customer’s use of or access to the CitNOW Conversations Product or any security of privacy breaches which are attributable to Third Party Business Applications, and Customer waives any and all claims against CitNOW in connection therewith.

Annex A - Data Processing Annex

• Scope and duration of processing: Controller receives through, transmits to or enters into the CitNOW Conversation Product, data, information, content, records, and files that Controller or any of its Chat Participants loads, or otherwise provides to CitNOW, and any data, information, content, records and files that the CitNOW Conversations Product obtains from Controller’s servers or systems or from third parties on Controller’s behalf. By default, conversation messages, results, reports and associated metadata older than 18 months are automatically and permanently deleted. Personal information contained in contact forms is also deleted unless the visitor has re-engaged in a conversation in the meantime, although their older messages will be deleted.
• Categories of personal data: Name and contact information of Customer Employees. Name and contact information of Dealership Customers. Communication and Chat data. Vehicle health data (including, but not limited to, vehicle history, registration plate, VIN, MOT & Service history)
• Purpose of processing: Processor provides and operates a web-based messaging Product (AMP) for processing enquiries from prospective customers (Chat Participants) on the websites and content operated by the Controller. The inquiries generally relate to the offers of the Controller and to general information about the Controller, whereby Chat Participants are likely to provide their own data.
• Subprocessors: Web1on1 - Sub-processors

CitNOW Imaging (December 2024 Edition)

CitNOW Imaging is a software based product made available by Zype TV Limited (t/a CitNOW Imaging) (“CitNOW Imaging”).

The below sets out the License Agreement applicable to the CitNOW Imaging Products and Service(s) as described within the Order Form.

This Licensing Agreement is supplemental to the CitNOW Group Terms and Conditions (“Terms and Conditions”) and applies specifically to CitNOW Imaging. If there is any conflict between the Order Form, these Terms and Conditions and the Licensing Agreement(s), the following order of priority shall apply:

1. the Order Form;
2. the Terms and Conditions; and
3. the Licensing Agreement(s)

Defined terms contained in this Licensing Agreement shall have the meaning given to them in the Terms and Conditions.

The following additional definitions apply in this Licensing Agreement.

Definitions

• Content: includes, but not limited to, images, videos, audio, and graphics of which is captured and uploaded by Customer through the CitNOW Imaging Product.
• Managed Devices: the iPhones and mobile data as available from CitNOW Imaging to provide to the Customer on a subscription basis, pursuant to adherence to the Terms and Conditions and this Licensing Agreement.
• Quality Assurance (“QA”); Quality Assurance
• CitNOW Imaging Product; the software based product for stock imagery capture.

1. Term and Termination
   1. Cancellation. Pursuant to clause 5.3 of the Terms and Conditions, the Customer may cancel this Licensing Agreement by giving no less than 90 days’ notice in writing prior to the end of the Initial Minimum Term or any Renewal Term, as applicable. Notice to terminate should be sent in writing to customer@citnowgroup.com.
   2. Continuance of the Terms and Conditions and other Licensing Agreements. To avoid doubt, unless the Agreement is terminated in whole pursuant to clause 5 of the Terms and Conditions, if the Customer has purchased other Products/Services which are the subject of a separate Licensing Agreement, the Licensing Agreement and Terms and Conditions in respect of such other Products/Services shall remain in full force and effect, notwithstanding termination of this Licensing Agreement.
   3. Access Rights to Content upon Termination. On termination the Customer will no longer be able to access the CitNOW Imaging Product. Further, if the Customer is a Dealer Group or an OEM, the Retailers in the Customer’s group will no longer be able to access the CitNOW Imaging Product. Personal data may be retrieved as outlined in the CitNOW Privacy Notice
2. CitNOW Imaging Platform
   1. QA Process. QA process is live and real time feedback on rejections is provided by CitNOW Imaging in the CitNOW Imaging app during the capture process – Live Quality control and ‘In App Feedback’ is provided in no less than 30 seconds. QA process is performed by employees of CitNOW Imaging, subcontractors of CitNOW Imaging and/or AI technology.
   2. Image Uploading. Image uploading as part of the CitNOW Imaging Product is carried out by a combination of data feeds and APIs. CitNOW Imaging uses these also to know whether images have successfully been uploaded. It can therefore store images and subsequently automatically send images as and when vehicles appear on the Customer’s Dealer Management System - should vehicles not be live at the time of capture.
   3. Ownership of Content. Customer is responsible for the Content created and distributed through the CitNOW Imaging Product, and for seeking consent (or other lawful basis) from any individuals who may appear or whose property may appear within that Content. Customer agrees to defend and hold Supplier harmless against any claim by any third party alleging that Content uploaded by Customer breaks regulations or is illegal, defamatory or infringes any third party’s rights. This clause shall not apply to any Content which is adapted pursuant to clause 2.6 below (Licence to use Limited Content).
   4. Recipients. In accordance with clause 2.3 (Ownership of Content), Customer agrees that Supplier has no liability to the recipients to which Customer sends any Content to and has no liability in respect of possible further distribution by the recipient of any Content. Customer agrees to indemnify Supplier for any losses incurred pursuant to any claims made by any recipients to whom Customer sends Content, or for any claims against Supplier from third parties to whom Content is further distributed to.
   5. Fair Usage. The Monthly Fee as detailed within the Order Form is subject to this Fair Usage Clause. The Monthly Fee as detailed within the Order Form is for the usage of the CitNOW Imaging Product for up to, and including, 100 vehicles per calendar month. In the event that Customer goes over this figure, in line with this Fair Usage Clause, Supplier reserves the right to charge customer for any usage above 100 vehicles within the next Monthly Invoice. Should Customer consistently, for 3 executive calendar months within the Term, go over this figure, Supplier reserves the right to increase the Monthly Fee in line with the Customers usage. For the avoidance of doubt, this Clause is in addition to 1.4 Adjustment of Fees.
   6. Bandwidth Pricing. If the Customer is subscribed to a bandwidth subscription to CitNOW Imaging which dictates tiered pricing based on number of vehicles captured within a calendar month ("Bandwidth") this clause 2.6 shall replace clause 2.5 "Fair Usage" above. The Monthly Fee as detailed in the Order Form is for the usage of CitNOW Imaging up to, and including, the total vehicles per calendar month within the Bandwidth. In the event that Customer goes over this figure, in line with this Bandwidth Pricing Clause, Supplier reserves the right to charge customer for any usage above the maximum number of vehicles within the next Monthly Invoice, subject to a 10% leeway per calendar month. Should Customer consistently, for 6 consecutive calendar months within the Term, go over this figure, Supplier reserves the right to move Customer to the next Bandwidth Pricing tier in line with the Customers usage. For the avoidance of doubt, this Clause is in addition to 1.4 Adjustment of Fees.
   7. Licence to use Limited Content. Notwithstanding the foregoing, the Customer grants to CitNOW a non-exclusive, royalty free, perpetual licence to use vehicle images which are supplied as part of the Content for the purpose of creating a vehicle image database provided always that such images of vehicles shall be adapted within the database so all identifying features of a vehicle are removed (such as registration number, mileage/odometer, backdrop and surroundings inside and outside of the vehicle and through any windows), meaning it is not possible to identify a vehicle belonging to any specific individual. To avoid doubt, the licence granted in this clause does not extend to the use of any personal data or any other part of the Content. To avoid doubt, this clause shall take priority over any conflicting provision in the Terms and Conditions.
3. Support
   1. Support is provided via Email and Phone Monday to Friday, within Business Hours (as defined Mon-Fri 9am - 5pm UK Time, excluding bank holidays of England & Wales). Contact methods are available via the CitNOW Get in touch page.
   2. Support is limited to Managed Devices and software provided under the Agreement. Managed Devices are clearly marked with support IDs and controlled by CitNOW Imaging through the use of apple business profiling and Mirador MDM (mobile device management). Mobile Broadband Data SIM is provided with the hardware allowing full software and hardware troubleshooting.
4. Managed Device Terms
   1. If contracted to, as set out in the Order Form, CitNOW Imaging can make available suitable iPhones and mobile data contracts for services to be carried out. Fees shall be paid in accordance with Section 4 of the Order Form, and clause 4 of the Terms and Conditions.
   2. Customer acknowledges and accepts that:
      • the phone will be changed at CitNOW Imaging’s discretion as it deems necessary over the duration of the relevant Managed Device contract;
      • the phone will remain the property of CitNOW Imaging together with the SIM card required to provide the Service(s);
      • All iPhones have the CitNOW Imaging profile on them meaning they cannot have other Apple IDs entered and 3rd party apps installed without the prior approval of CitNOW Imaging. The Parties may agree to a mutually allowable App list.
      • attempts to modify the CitNOW Imaging Profile or jailbreak the iPhone shall constitute a breach of Clause 9 and clause 10.3 of the Terms and Conditions.
   3. Any phone which is supplied as a Managed Device may not be brand new, however CitNOW Imaging shall procure that it shall be in good condition and fit for purpose. In all cases, Managed Devices not fit for purpose shall be replaced in line with clause 4.5.
   4. Should any provided CitNOW Imaging iPhone hardware be lost or damaged by the Customer or Users, Customer shall be charged a replacement cost at the cost price of the specific model. If devices are upgraded/obsolete in the future the replacement cost could differ.
   5. Any faulty iPhone will be replaced by CitNOW Imaging, without undue delay. If a phone is broken, CitNOW Imaging shall endeavour to have a replacement sent out the day of notification by next day delivery with tracking. Failure to fulfil a replacement due to a delay caused by the phone provider shall not constitute a breach of the Agreement. Customer shall ensure that all faulty or broken phones shall be returned to CitNOW Imaging Headquarters without undue delay and, in any event, within 14 day(s) after receiving replacement. Failure to do so shall constitute a breach of the Agreement.
   6. Cancellation of a Managed Device shall be in line with clause 5.3 of the Terms and Conditions, and shall not have the benefit of clause 1.1 (Cancellation) within this Licensing Agreement.

Annex A - Data Processing Annex

• Scope and duration of processing: To provide the product and Services to the customer. Dealership staff data shall be held for as long as an active Agreement is in place. Consumer data shall be held in line with retention principles, but no longer than 2 years.
• Categories of personal data: Dealership Staff names, email addresses and phone numbers. Consumer names, email addresses, phone numbers, and vehicle data.
• Purpose of processing: to provide the Product and Services.
• Subprocessors: Auto Imaging

CitNOW Triage and Appraise Product (December 2024 Edition)

Zype TV Ltd (company number 06630126) t/a CitNOW and Vehicle Vision International Limited (“Vehicle Vision”) are both companies operating within the CitNOW Group. Zype TV Ltd (and certain of its affiliates operating the European Union) are authorised resellers of the Vehicle Vision Triage and Appraise Product applications on a subscription basis (“Product”). Both entities provide software solutions to their customers on a subscription basis. The Supplier shall be CitNOW and CitNOW are acting as an authorised reseller of Vehicle Vision and CitNOW shall procure that Vehicle Vision fulfils supply of the Product to the Customer on behalf of CitNOW (“Supplier”).

There are 2 Product subscriptions covered within the Licensing Agreement which are available on iOS, Android, and Desktop platforms: Triage and Appraise.

This Licensing Agreement is supplemental to the CitNOW Group Terms and Conditions (“Terms and Conditions”) and applies specifically to the Product subscriptions referenced above. If there is any conflict between the Order Form, the Terms and Conditions and the Licensing Agreement(s), the following order of priority shall apply:

1. the Order Form;
2. the Terms and Conditions; and
3. the Licensing Agreement(s)

Defined terms contained in this Licensing Agreement shall have the meaning given to them in the Terms and Conditions.

1. Term and Termination
   1. Cancellation. Pursuant to clause 5.3 of the Terms and Conditions, the Customer may cancel this Licensing Agreement by giving no less than 90 days’ notice in writing prior to the end of the Initial Minimum Term or any Renewal Term, as applicable. Notice to terminate should be sent in writing to customer@citnowgroup.com.
   2. Continuance of the Terms and Conditions and other Licensing Agreements. To avoid doubt, unless the Agreement is terminated in whole pursuant to clause 5 of the Terms and Conditions, if the Customer has purchased other Products/Services which are the subject of a separate Licensing Agreement, the Licensing Agreement and Terms and Conditions in respect of such other Products/Services shall remain in full force and effect, notwithstanding termination of this Licensing Agreement.
   3. Access Rights to Content upon Termination. On termination the Customer will no longer be able to access the Product. Further, if the Customer is a Dealer Group or an OEM, the Retailers in the Customer’s group will no longer be able to access the Product. Personal data may be retrieved upon request to Supplier, subject to retention periods.
   4. Assignment. CitNOW may at any time sub-license, assign, novate, charge or deal in any other manner with any or all of its rights and obligations under this licence, provided it gives written notice to the Customer.
2. Use of Product
   1. CitNOW Products. Customer can present either Product as a widget directly on Their website or share Their URL to Consumers directly. The Consumer shall input Their Personal and Vehicle Information directly into the Product, which shall be shared with the Customer via e-mail or integration with another Customer product. Customer acknowledges that the primary use of the Product is to facilitate an open communication tool for appraising or pre-diagnosing vehicles between the Customer and the Consumer for ease of both the Customer and the Consumer in the activities of buying, selling, part-exchanging or the booking or pre-diagnostic inspections of a vehicle. No further use cases shall be permitted unless agreed in writing by CitNOW. Misuse shall incur a material breach of this Agreement.
      
      The Product being provided by CitNOW to Customer is for the benefit of;
      1. CitNOW Appraise. Appraising Consumer vehicles for purchasing or part exchange by the Customer;
      2. CitNOW Triage. Remotely pre-diagnosing issues with Consumer vehicles.
   2. Fair Usage. Supplier reserves the right to impose a Fair Usage cap (“Fair Usage”) for the amount of look ups Customer may process per calendar month. This shall be reflected on the Order Form.
   3. Transactions. Customer acknowledges that CitNOW are not a party to any transaction between Customer and Consumer and shall not be responsible for any manner whatsoever for any representations made by either Customer or Consumer. Customer further acknowledges that CitNOW is in no manner acting as an agent for either the Customer or Consumer and that Customer and Consumer shall be separately responsible and liable to one another for any transactions between the Partys.
   4. Consumer Data. Consumers shall provide their Data, including Personal Data, directly into the Product, and CitNOW shall send this Data to Customer via email or integration with another Customer product. In line with clauses 6 and 7 of the CitNOW Group Terms and Conditions, Supplier acts as a Processor, and Customer remains the Controller. Customer warrants that data obtained solely through the Product shall only be utilised for the purpose of the Product.
3. Technical Support and Availability
   1. Technical Support. During Customers subscription to the CitNOW Triage and/or Appraise, CitNOW shall make available to Customer technical support.
   2. Contact. Customer agrees that CitNOW may use the contact details of Customer, or Customers employer, provided to CitNOW to assist Customer with the use of the Product and provide ongoing support.
      
      You may contact CitNOW for support using the following methods;
      • Email: support@vehicle-vision.com
      • Phone: +44 (0)116 216 8555

Annex A - Data Processing Annex

• Scope and duration of processing: To provide the service. Duration is defined as for as long as we have an active contract between CitNOWand Customer. Consumer data retention is set by the tier of which Customer subscribes to.
• Categories of personal data: Customer information – name, email address, job title, phone number. Consumer Information – name, email address, phone number, vehicle registration, VIN, vehicle health data.
• Purpose of processing: to supply the Product to the Customer and Consumer for the facilitation of the Agreement.
• Subprocessors: Subprocessor Policy

CitNOW Insights (December 2024 Edition)

Zype TV Ltd Company number 06630126) t/a CitNOW and Real Time Communications Limited (t/a RTC) (“RTC”) are both companies operating within the CitNOW Group. Zype TV Ltd (and certain of its affiliates operating in the European Union) are authorised by RTC to resell the product known as “CitNOW Insights”. CitNOW Insights is a business intelligence and analytics solution made available by RTC on a subscription basis. CitNOW is an authorised reseller of RTC and CitNOW shall procure that RTC fulfils supply of CitNOW Insights to the Customer on behalf of CitNOW References to RTC in this Licensing Agreement shall mean RTC acting on behalf of the Supplier.

This Licensing Agreement is supplemental to the CitNOW Group Terms and Conditions (“Terms and Conditions”) and applies specifically to subscriptions purchased by the Customer to use CitNOW Insights. If there is any conflict between the Order Form, these Terms and Conditions and the Licensing Agreement(s), the following order of priority shall apply:

1. the Order Form;
2. the Terms and Conditions; and
3. the Licensing Agreement(s)

Defined terms contained in this Licensing Agreement shall have the meaning given to them in the Terms and Conditions. The following additional definitions apply in this Licensing Agreement.

Additional Definitions

CitNOW Insights; the Product supplied by RTC pursuant to this Licensing Agreement being a software-based business intelligence solution that aggregates and analyses data in order to forecast and predict results and facilitate quick decision making based on a single uniform view of a Customer’s data.
Project Plan; the statement of work outlining the plan for delivery of the Set Up Services, which includes a specification containing the details of the Set Up Services to be provided by RTC to the Customer.

1. Services
   1. Depending on the Customer’s requirements and objectives, CitNOW may work with customer to create a Project Plan for delivery of the Set Up Services. A Project Plan may not always be required.
   2. RTC shall provide the Set Up Services in a professional and diligent manner, using reasonable skill and care, in accordance with good industry practice and (where applicable) in accordance with the Project Plan.
   3. RTC uses reasonable endeavours to meet any timings specified in the Project Plan for delivery of the Set Up Services, but it does not guarantee that the Set Up Services shall be supplied in accordance with any such timings.
   4. RTC reserves the right to alter the scope of CitNOW Insights and/or the Services if this is necessary to comply with any applicable law or regulatory requirement. However, if such alteration constitutes a material change to the scope of the Services or functionality of CitNOW Insights, RTC shall notify the Customer of such alteration in advance.
   5. Where requested by the Customer, and subject to payment of the relevant Fees by the Customer, RTC shall provide training in the use of CitNOW Insights.
2. Verification
   1. Following completion of the consultation process, RTC and the Customer shall work together to verify that the Set Up Services have been supplied by RTC and have met the objectives detailed in the Project Plan. If during such verification process, any issues are identified by RTC and/or the Customer, RTC will address such issues as part of the verification process. Any further scope of specification requirements out with the Project Plan during this verification process may incur further costs which RTC and Customer shall agree upon, in writing or within an additional Project Plan in line with clause 3 “Changes to Services”.
      1. The Product being provided by CitNOW to Customer is for the benefit of;
         1. CitNOW Appraise. Appraising Consumer vehicles for purchasing or part exchange by the Customer.
         2. CitNOW Triage. Remotely pre-diagnosing issues with Consumer vehicles.
   2. Upon completion of the verification process and subsequent Set Up Services, the Customer shall confirm to RTC in writing in the form of an “Implementation Sign Off” document, that the Set Up Services are complete and CitNOW Insights is ready for use in the Customer’s operational environment. Notwithstanding this, the Customer will be deemed to have accepted CitNOW Insights if:
      1. the Customer uses CitNOW Insights in its operational environment; or
      2. the Customer fails to engage with the verification process within 7 business days of RTC confirming that it is ready to perform the verification process with the Customer.
3. Changes to Services
   1. If the Customer requires a change to the Services (including the Set Up Services) (a “Change”), the Customer will notify RTC of its requirements in writing. Following consideration by both parties of the Customer’s requirements, a change control note (“Change Control Note”) shall be prepared by RTC outlining the nature and details of the Change including details of any impact the Change may have on the Fees, the timescales for delivery of the applicable Service(s) any other relevant information.
   2. The Customer shall promptly consider the Change Control Note and notify RTC in writing within 15 business days if it wishes to proceed with the Change based on the details in the Change Control Note. Following any such confirmation RTC shall implement the Change on the Customer’s behalf. The Customer acknowledges that if a Change is significant, RTC may need to amend the Project Plan or prepare a new Project Plan. Any Change agreed in writing by the parties shall form part of the Agreement.
4. CitNOW Insights
   1. CitNOW Insights facilitates the collation of the Customer’s data from multiple sources and subsequent analysis of such data on an automated basis. The Customer understands and acknowledges that the metrics and reports generated by CitNOW Insights are automatically generated based solely on the data and information to which CitNOW Insights is given access. Accordingly, no liability is accepted by RTC and/or its licensors for any reliance placed by the Customer on the analysis, metrics and reports generated using CitNOW Insights.
   2. In line with clause 4.1, the Customer understands and acknowledges that in the event of aggregating data from Third Party Platforms for the purpose of generating the metrics and reports from CitNOW on the Customer instruction, said metrics and reports shall be based on the accuracy and quality of this data. Accordingly, no liability is accepted by RTC and/or its licensors for any reliance placed by the Customer on the analysis, metrics and reports generated using CitNOW Insights.
   3. The Customer understands that CitNOW Insights collates and analyses the Customer’s data in an aggregated manner in order to show performance and trends data to all customers using CitNOW Insights. Accordingly the Customer acknowledges and agrees that it is necessary for the Customer to grant RTC non-exclusive, limited, royalty free licence during the term of this Licensing Agreement to access, view, collate and analyse the Customer’s data.
5. Usage Limitations
   
   The Customer undertakes that:
   1. the maximum number of Retailers that it authorises to access and use CitNOW Insights shall not exceed the number of subscriptions it has purchased for CitNOW Insights;
   2. it shall permit RTC to audit the number of CitNOW Insights’ subscriptions it has in place to verify that the correct number of subscriptions have been purchased. Such audit may be conducted no more than once per quarter, at RTC’s expense, and this right shall be exercised with reasonable prior notice, in such a manner as not to substantially interfere with the Customer's normal conduct of business;
   3. if any of the audits referred to in clause 5.2 reveal that the Customer has underpaid Fees, then without prejudice to RTC’s other rights, the Customer shall pay an amount equal to such underpayment within 10 business days of the date of the relevant audit.
6. Term and Termination
   1. Cancellation. Pursuant to clause 5.3 of the Terms and Conditions, the Customer may cancel this Licensing Agreement by giving no less than 90 days’ notice in writing prior to the end of the Initial Minimum Term or any Renewal Term, as applicable. Notice to terminate should be sent in writing to customer@citnowgroup.com.
   2. Continuance of the Terms and Conditions and other Licensing Agreements. o avoid doubt, unless the Agreement is terminated in whole pursuant to clause 5 of the Terms and Conditions, if the Customer has purchased other Products/Services which are the subject of a separate Licensing Agreement, the Licensing Agreement and Terms and Conditions in respect of such other Products/Services shall remain in full force and effect, notwithstanding termination of this Licensing Agreement.
   3. Access Rights to Content upon Termination. On termination the Customer will no longer be able to access CitNOW Insights. Further, if the Customer is a Dealer Group or an OEM, the Retailers in the Customer’s group will no longer be able to access CitNOW Insights. Personal data may be retrieved as outlined in the RTC Privacy Notice.

Annex A - Data Processing Annex

• Scope and duration of processing: Data shall be processed in line with the Group Terms and Conditions and this Licensing Agreement, for facilitation of the Product from CitNOW to the Customer. Duration shall be for as long as we have an active Agreement with Customer.
• Categories of personal data: Customer staff names, Consumer names, email addresses, phone numbers and addresses, Consumer vehicle details including , VIN, and vehicle registration health data
• Purpose of processing: To provide the Service to Customer.
• Subprocessors: CitNOW Insights subprocessors

DEALERWEB Showroom and React (December 2024 Edition)

Eight Technology Limited (t/a Dealerweb) (“Dealerweb”) provides software customer relationship management and lead management solutions to their customers on a subscription basis. Where the Supplier is not Dealerweb, the Supplier shall act as an authorised reseller of Dealerweb and the Supplier shall procure that Dealerweb fulfils supply of the Dealerweb Products to the Customer on behalf of the Supplier.

Where Dealerweb is not the Supplier for the purposes of the Agreement, references to Dealerweb in this Licensing Agreement shall mean Dealerweb acting on behalf of the Supplier.

There are two main Dealerweb product subscriptions, Showroom and REACT, which are available on Web, iOS and Android. Each of these are available with different features.

This Licensing Agreement is supplemental to the CitNOW Terms and Conditions (“Terms and Conditions”) and applies specifically to the Dealerweb Product subscriptions referenced above. If there is any conflict between the Order Form, these Terms and Conditions and the Licensing Agreement(s), the following order of priority shall apply:

1. the Order Form;
2. the Terms and Conditions; and
3. the Licensing Agreement(s)

Defined terms contained in this Licensing Agreement shall have the meaning given to them in the Terms and Conditions. The following additional definitions apply in this Licensing Agreement.

Additional Definitions

Project Plan; the statement of work outlining the plan for delivery and implementation of the Products including a specification containing the details of the Set Up Services to be provided by Dealerweb to the Customer.

PAF Data; the Royal Mail postcode address file data service which, where the Customer has opted to take such feature as part of the Product (as detailed in the Order Form / Project Plan), is incorporated into the Product.

1. Dealerweb Products
   1. Depending on the Customer’s requirements and objectives, Dealerweb may work with customer to create a Project Plan for delivery of the Set Up Services. A Project Plan may not always be required.
   2. Dealerweb shall provide the Services in a professional and diligent manner, using reasonable skill and care, in accordance with good industry practice and (where applicable) in accordance with the Project Plan.
   3. Dealerweb uses reasonable endeavours to meet any timings specified in the Project Plan for delivery of the Services, but it does not guarantee that the Services shall be supplied in accordance with any such timings.
   4. Dealerweb reserves the right to alter the scope of the Services to be supplied if this is necessary to comply with any applicable law or regulatory requirement. However, if such alteration constitutes a material change to the scope of the Services, Dealerweb or the Supplier shall notify the Customer of such alteration in advance.
   5. If the Customer requires a change to the Product and/or Services (a “Change”):
      1. he Customer will notify Dealerweb of its requirements in writing. Following consideration by both parties of the Customer’s requirements, a change control note (“Change Control Note”) shall be prepared by Dealerweb outlining the nature and details of the Change including details of any impact the Change may have on the Fees, the timescales for delivery of the applicable Products and Service(s) any other relevant information.
      2. the Customer shall promptly consider the Change Control Note and notify Dealerweb in writing within 15 business days if it wishes to proceed with the Change based on the details in the Change Control Note. Following any such confirmation Dealerweb shall implement the Change on the Customer’s behalf. The Customer acknowledges that if a Change is significant, Dealerweb may need to amend the Project Plan or prepare a new Project Plan. Any Change agreed in writing by the parties shall form part of the Agreement.
   6. Where requested by the Customer, and subject to payment of the relevant Fees by the Customer, Dealerweb shall:
      1. Provide training in the use of the Product; and
      2. Assist in the creation of bespoke reporting to the Customer, however such reporting features (not data) shall be the property of Dealerweb
2. Verification
   1. In line with clause 1.1, subject to a Project Plan being required, Dealerweb and the Customer shall work together to verify that the Set Up Services have been supplied by Dealerweb and have met the objectives detailed in the Project Plan. If during such verification process, any issues are identified by Dealerweb and/or the Customer, Dealerweb will address such issues as part of the verification process.
   2. Upon completion of the verification process and subsequent Set Up Services, the Customer shall confirm to Dealerweb in writing in the form of an “Implementation Sign Off” document, that the Set Up Services are complete and the Product is ready for use in the Customer’s operational environment. Notwithstanding this, the Customer will be deemed to have accepted the Product if:
      1. the Customer uses the Product in its operational environment; or
      2. the Customer fails to engage with the verification process within 15 business days of Dealerweb confirming that it is ready to perform the verification process with the Customer.
3. Support
   1. DDealerweb shall provide Customer with Support as outlined on the Dealerweb Website.
4. Term and Termination
   1. Cancellation. Pursuant to clause 5.3 of the Terms and Conditions, the Customer may cancel this Licensing Agreement by giving no less than 90 days’ notice in writing prior to the end of the Initial Minimum Term or any Renewal Term, as applicable. Notice to terminate should be sent in writing to customer@citnowgroup.com.
   2. Continuance of the Terms and Conditions and other Licensing Agreements. To avoid doubt, unless the Agreement is terminated in whole pursuant to clause 5 of the Terms and Conditions, if the Customer has purchased other Products/Services which are the subject of a separate Licensing Agreement, the Licensing Agreement and Terms and Conditions in respect of such other Products/Services shall remain in full force and effect, notwithstanding termination of this Licensing Agreement.
   3. Access Rights to Content upon Termination. On termination the Customer will no longer be able to access the Dealerweb Product. Further, if the Customer is a Dealer Group or an OEM, the Retailers in the Customer’s group will no longer be able to access the Dealerweb Product. Personal data may be retrieved as outlined in thee Dealerweb Privacy Notice.
5. PAF Data
   1. 5.1 This clause 4 shall only apply where Customers have opted to take the PAF Data service as part of the Product, as detailed in the Order Form.
   2. The Customer’s use of the PAF Data service shall be subject to the Royal Mail’s terms and conditions for use of the PAF Data Where applicable, the Customer warrants that it, and its Users, shall at all times during the term of this Agreement comply with the Royal Mail PAF Database End User Terms. The Customer shall indemnify Dealerweb and any other member of the CITNOW Group in respect of any losses suffered or incurred by RTC as a result of or in connection with a breach of the PAF Data Terms by the Customer.
   3. Dealerweb may terminate this Licensing Agreement and the Customer’s licence to use the PAF Data service if the Customer:
      1. Commits any act or omission which may damage the reputation of the Royal Mail or bring the Royal Mail into disrepute;
      2. Discloses any information relating to the business of Royal Mail which is specified by Royal Mail as being confidential.
   4. The PAF Data Terms shall automatically end if Dealerweb’s licence agreement with the Royal Mail for use of the PAF Data service is terminated.
   5. Dealerweb shall arrange for PAF Data software updates to be incorporated into the Product within three months of such updates being issued to Dealerweb in an acceptable and readable manner.
   6. Royal Mail shall be entitled to directly enforce the PAF Data Terms by virtue of the Contracts (Rights of Third Parties) Act 1999.

Annex A - Data Processing Annex

• Scope and duration of processing: To provide the service. Duration is defined as for as long as we have an active contract between Dealerweb and Customer. Consumer data can be set retention and self managed via the Product and Services.
• Categories of personal data: Dealership staff name, email address and phone numbers. Consumers names, email addresses, phone numbers, FCA answers (where applicable) vehicle health data, vehicle purchase history.
• Purpose of processing: provide software customer relationship management and lead management solutions
• Subprocessors: Dealerweb Subprocessors

Real Time Communications (December 2024 Edition)

Real Time Communications Limited (t/a RTC) (“RTC”) is part of CitNOW Group (Zype TV Ltd) and provides software customer relationship management solutions to their customers on a subscription basis. Where the Supplier is not RTC, the Supplier shall act as an authorised reseller of RTC and the Supplier shall procure that RTC fulfils supply of the RTC Products to the Customer on behalf of the Supplier.

Where RTC is not the Supplier for the purposes of the Agreement, references to RTC in this Licensing Agreement shall mean RTC acting on behalf of the Supplier.

This Licensing Agreement is supplemental to the CitNOW Group Terms and Conditions (“Terms and Conditions”) and applies specifically to subscriptions purchased by the Customer to use the RTC Products. If there is any conflict between the Order Form, these Terms and Conditions and the Licensing Agreement(s), the following order of priority shall apply:

1. the Order Form;
2. the Terms and Conditions; and
3. the Licensing Agreement(s)

Defined terms contained in this Licensing Agreement shall have the meaning given to them in the Terms and Conditions. The following additional definitions apply in this Licensing Agreement.

Additional Definitions

• Licensed Sites; each workshop rooftop of the Customer that is entitled to access and use the Software, as detailed or referenced in the Order Form.
• PAF Data; the Royal Mail postcode address file data service which, where the Customer has opted to take such feature as part of the Product (as detailed in the Order Form / Project Plan), is incorporated into the Product.
• Project Plan; the statement of work outlining the plan for delivery of the Set Up Services, which includes a specification containing the details of the Set Up Services to be provided by RTC to the Customer.
• Sites; any location of the Customer from which it operates and/or trades unless such initial period is extended to align with other Product subscriptions pursuant to clause 5.1 of the Terms and Conditions.

1. Services
   1. Depending on the Customer’s requirements and objectives, RTC may work with customer to create a Project Plan for delivery of the Set Up Services. A Project Plan may not always be required.
   2. RTC shall provide the Set Up Services in a professional and diligent manner, using reasonable skill and care, in accordance with good industry practice and (where applicable) in accordance with the Project Plan.
   3. RTC uses reasonable endeavours to meet any timings specified in the Project Plan for delivery of the Set Up Services, but it does not guarantee that the Set Up Services shall be supplied in accordance with any such timings.
   4. RTC reserves the right to alter the scope of the Products / Services to be supplied if this is necessary to comply with any applicable law or regulatory requirement. However, if such alteration constitutes a material change to the scope of the Services or functionality of the Products, RTC shall notify the Customer of such alteration in advance.
   5. Where requested by the Customer, and subject to payment of the relevant Fees by the Customer, RTC shall:
      1. install the Products on the Customer’s hardware;
      2. Provide training in the use of the Products; and/or
      3. Provide an SMS text service to enable the Customer to contact Consumers and provide them with offers, information and associated services.
2. Verification
   1. Following completion of the consultation process, RTC and the Customer shall work together to verify that the Set Up Services have been supplied by RTC and have met the objectives detailed in the Project Plan. If during such verification process, any issues are identified by RTC and/or the Customer, RTC will address such issues as part of the verification process.
   2. Upon completion of the verification process and subsequent Set Up Services, the Customer shall confirm to RTC in writing in the form of an “Implementation Sign Off” document, that the Set Up Services are complete and the Product is ready for use in the Customer’s operational environment. Notwithstanding this, the Customer will be deemed to have accepted the Product if:
      1. the Customer uses the Product in its operational environment; or
      2. he Customer fails to engage with the verification process within 15 business days of RTC confirming that it is ready to perform the verification process with the Customer.
3. Changes to Services
   1. If the Customer requires a change to the Services (including the Set Up Services) (a “Change”), the Customer will notify RTC of its requirements in writing. Following consideration by both parties of the Customer’s requirements, a change control note (“Change Control Note”) shall be prepared by RTC outlining the nature and details of the Change including details of any impact the Change may have on the Fees, the timescales for delivery of the applicable Service(s) any other relevant information.
   2. The Customer shall promptly consider the Change Control Note and notify RTC in writing within 15 business days if it wishes to proceed with the Change based on the details in the Change Control Note. Following any such confirmation RTC shall implement the Change on the Customer’s behalf. The Customer acknowledges that if a Change is significant, RTC may need to amend the Project Plan or prepare a new Project Plan. Any Change agreed in writing by the parties shall form part of the Agreement.
4. Users
   
   In relation to Users, the Customer undertakes that:
   1. the maximum number of Retailers that it authorises to access and use the Product shall not exceed the number of Licensed Sites in place;
   2. it shall maintain a written, up to date list of Licensed Sites and provide such list to RTC within 5 business days of the written request at any time or times;
   3. it shall permit RTC to audit the number of Product subscriptions the Customer has in place to verify that the correct number of subscriptions have been purchased for the number of Licensed Sites. Such audit may be conducted no more than once per quarter, at RTC’s expense, and this right shall be exercised with reasonable prior notice, in such a manner as not to substantially interfere with the Customer's normal conduct of business;
   4. if any of the audits referred to in clause 4.3 reveal that the Customer has underpaid Fees, then without prejudice to RTC’s other rights, the Customer shall pay an amount equal to such underpayment within 10 business days of the date of the relevant audit.
5. PAF Data
   1. This clause 5 shall only apply where Customers have opted to take the PAF Data service as part of the Product, as detailed in the Order Form.
   2. The Customer’s use of the PAF Data service shall be subject to the Royal Mail’s terms and conditions for use of the PAF Data Where applicable, the Customer warrants that it, and its Users, shall at all times during the term of this Agreement comply with the Royal Mail PAF Database End User Terms. The Customer shall indemnify RTC and any other member of the CITNOW Group in respect of any losses suffered or incurred by RTC as a result of or in connection with a breach of the PAF Data Terms by the Customer.
   3. RTC may terminate this Licensing Agreement and the Customer’s licence to use the PAF Data service if the Customer:
      1. Commits any act or omission which may damage the reputation of the Royal Mail or bring the Royal Mail into disrepute;
      2. Discloses any information relating to the business of Royal Mail which is specified by Royal Mail as being confidential.
   4. The PAF Data Terms shall automatically end if RTC’s licence agreement with the Royal Mail for use of the PAF Data service is terminated.
   5. RTC shall arrange for PAF Data software updates to be incorporated into the Product within three months of such updates being issued to RTC in an acceptable and readable manner.
   6. Royal Mail shall be entitled to directly enforce the PAF Data Terms by virtue of the Contracts (Rights of Third Parties) Act 1999.
6. Term and Termination
   1. Cancellation. Pursuant to clause 5.3 of the Terms and Conditions, the Customer may cancel this Licensing Agreement by giving no less than 90 days’ notice in writing prior to the end of the Initial Minimum Term or any Renewal Term, as applicable. Notice to terminate should be sent in writing to customer@citnowgroup.com.
   2. Continuance of the Terms and Conditions and other Licensing Agreements. To avoid doubt, unless the Agreement is terminated in whole pursuant to clause 5 of the Terms and Conditions, if the Customer has purchased other Products/Services which are the subject of a separate Licensing Agreement, the Licensing Agreement and Terms and Conditions in respect of such other Products/Services shall remain in full force and effect, notwithstanding termination of this Licensing Agreement.
   3. Access Rights to Content upon Termination. On termination the Customer will no longer be able to access the RTC Product. Further, if the Customer is a Dealer Group or an OEM, the Retailers in the Customer’s group will no longer be able to access the RTC Product. Personal data may be retrieved as outlined in the RTC Privacy Notice

Annex A - Data Processing Annex

• Scope and duration of processing: To provide the Product (processing and storage). Duration is defined as for as long as we have an active Contract between RTC and Customer. Data held on Customer’s own server is defined by Customer.
• Categories of personal data: Dealership staff name, email address and phone numbers. Consumers names, email addresses, phone numbers, Vehicle data including, but not limited to Registration, VIN and vehicle health data. The Product then produces reports based on the data held.
• Purpose of processing: To provide the reporting and Product to the Customer. 
• Subprocessors: RTC subprocessors