CarTwin Data Processing Agreement

Version 1.0 — 27 August 2026

Parties

The data controller

hereinafter: the customer

The data processor

ORshoots, trading as CarTwin Schildersplein 211, 5172 BD Kaatsheuvel CoC 77785142

hereinafter: CarTwin

Recitals

1. CarTwin creates a three-dimensional model from a video recording of a vehicle and makes it available to the customer.

2. The customer determines which recordings it supplies, for what purpose, and whether it shares a model with third parties. The customer is therefore the data controller.

3. CarTwin processes these recordings solely on the instruction of the customer and is therefore the data processor.

4. In this agreement, the parties set out how this processing takes place, as prescribed by the General Data Protection Regulation.

5. This agreement forms part of the agreement between the parties and of CarTwin's general terms and conditions. In the event of a conflict, this data processing agreement shall prevail insofar as it concerns the processing of personal data.

Article 1 — Definitions

The terms personal data, processing, data controller, data processor, data subject, sub-processor and personal data breach have the meaning given to them by the General Data Protection Regulation.

Recording — the video file of a vehicle supplied by the customer.

Model — the three-dimensional file that CarTwin creates from a recording.

Availability Period — the period during which a model can be viewed and downloaded via CarTwin, as determined by the purchased package.

Article 2 — Subject matter, nature and duration

2.1 CarTwin shall process personal data solely to provide the agreed service: the creation of a model from a recording and making it available.

2.2 The nature of the processing, the types of personal data and the categories of data subjects are set out in Appendix 1.

2.3 This agreement shall apply for as long as CarTwin processes personal data for the customer, and shall not terminate until the moment all data has been deleted or returned in accordance with Article 13.

Article 3 — Instructions

3.1 CarTwin shall process personal data solely on the basis of written instructions from the customer. This agreement, the general terms and conditions, and the customer's use of the service shall constitute those instructions.

3.2 If the customer makes a model shareable, this shall be considered an explicit instruction to CarTwin to make that model accessible without authentication to anyone who has the sharing link. The customer is aware that a model displays readable registration plates. The customer shall assess for itself whether it has a legal basis for this.

3.3 CarTwin shall not process the data for its own purposes nor provide it to third parties, except where required by law. If such an obligation exists, CarTwin shall inform the customer of this in advance, unless the law prohibits it from doing so.

3.4 CarTwin shall immediately inform the customer if, in its opinion, an instruction infringes data protection legislation. CarTwin may suspend the execution of that instruction until the customer has confirmed or amended it.

3.5 CarTwin shall not use the recordings and models to train systems, nor shall it create any derivative products from them.

Article 4 — Obligations of the customer

4.1 The customer warrants that it is entitled to make, supply and have the recordings processed, and that it has a valid legal basis for doing so.

4.2 The customer is responsible for the content of the recordings, including explicitly registration plates, persons, bystanders, buildings and third-party property that appear in the frame.

4.3 The customer shall inform data subjects to the extent required by law.

4.4 The customer shall not supply any special categories of personal data or data relating to criminal convictions and offences.

4.5 The customer shall indemnify CarTwin against claims from third parties and for fines from supervisory authorities arising from a failure to comply with this article.

Article 5 — Confidentiality

5.1 CarTwin shall oblige everyone who has access to the personal data under its authority to maintain confidentiality.

5.2 Access shall be granted only to the extent necessary to provide, maintain or support the service.

5.3 This obligation shall remain in force after the termination of this agreement.

Article 6 — Security

6.1 CarTwin shall implement appropriate technical and organisational measures as referred to in Article 32 of the Regulation. The measures are described in Appendix 2.

6.2 CarTwin may adapt these measures, provided that the level of protection is not diminished.

6.3 The customer shall assess for itself whether the measures are appropriate for the data it supplies.

6.4 The customer is responsible for managing its own accounts and login credentials, and for the distribution of any sharing links it creates.

Article 7 — Sub-processors

7.1 The customer gives CarTwin a general authorisation to engage sub-processors. The sub-processors currently engaged are listed in Appendix 3.

7.2 CarTwin shall impose on each sub-processor obligations that are at least equivalent to those in this agreement.

7.3 CarTwin shall inform the customer prior to adding or replacing a sub-processor. The customer may object to this within fourteen days in writing, stating its reasons.

7.4 If the parties cannot reach an agreement following an objection, the customer may terminate the agreement as of the date on which the change takes effect. This shall be its sole remedy in that case.

7.5 CarTwin remains liable to the customer for the acts and omissions of its sub-processors.

Article 8 — Transfer outside the European Economic Area

8.1 The storage of recordings and models takes place within the European Union.

8.2 The web application, the server routes and the associated network layer are served via a globally distributed infrastructure. As a result, the processing of requests may take place outside the European Economic Area, even though storage remains within the Union.

8.3 Appropriate safeguards have been put in place for these processing activities, in the form of the European Commission's standard contractual clauses or another recognised transfer mechanism. CarTwin shall provide insight into these safeguards upon request.

Article 9 — Rights of data subjects

9.1 If CarTwin receives a request directly from a data subject regarding data it processes for the customer, CarTwin shall not handle the request itself and shall refer the data subject to the customer. CarTwin shall inform the customer without delay.

9.2 CarTwin shall provide the customer with reasonable assistance in responding to requests for access, rectification, erasure, restriction, portability and objection.

9.3 For activities that go beyond what the service provides as standard, CarTwin may charge reasonable costs. CarTwin shall notify the customer of this in advance.

Article 10 — Personal data breaches

10.1 CarTwin shall inform the customer without undue delay, and no later than forty-eight hours after becoming aware of a breach affecting the customer's data.

10.2 This notification shall contain at least: the nature of the breach, the categories and numbers involved insofar as is known, the likely consequences, the measures taken and proposed, and a contact point.

10.3 If not all information is yet available, CarTwin shall report what is known and supplement it as soon as possible.

10.4 The customer shall assess for itself whether a notification to the Data Protection Authority or to data subjects is necessary, and shall make that notification itself. CarTwin shall not do so on behalf of the customer.

10.5 CarTwin shall provide reasonable assistance in this regard.

Article 11 — Data protection impact assessment

CarTwin shall provide the customer with reasonable assistance with a data protection impact assessment and with a prior consultation of the supervisory authority, insofar as it relates to the processing operations under this agreement and insofar as the information required for this is reasonably available only from CarTwin.

Article 12 — Audit

12.1 Upon request, CarTwin shall make available to the customer the information necessary to demonstrate compliance with this agreement.

12.2 The customer may have an audit carried out by an independent expert bound by confidentiality, no more than once per calendar year, following at least thirty days' notice.

12.3 The audit shall not unnecessarily disrupt CarTwin's business operations and shall never affect the data of other customers.

12.4 The costs of an audit shall be borne by the customer, unless it reveals a material failure on the part of CarTwin.

12.5 If CarTwin or a sub-processor holds a recent independent certification or audit report, CarTwin may provide this in lieu of an audit.

Article 13 — Retention, return and deletion

13.1 CarTwin shall delete a recording and its corresponding model after the expiry of the availability period of the purchased package. The customer instructs CarTwin to do so upon entering into the agreement.

13.2 The customer is responsible for downloading a model within that period. CarTwin is not an archiving or back-up service.

13.3 Upon termination of the agreement, CarTwin shall delete all personal data it processes for the customer within thirty days, unless the customer requests its return within that period or a statutory retention obligation prevents deletion.

13.4 Data in back-ups will be deleted in accordance with the regular retention period for those copies.

13.5 CarTwin shall confirm the deletion in writing upon request.

13.6 Once the customer has downloaded a model, CarTwin no longer has any control over it. From that moment on, the customer itself is the data controller for that copy.

Article 14 — Liability

14.1 The liability provisions from CarTwin's general terms and conditions apply in full to this agreement.

14.2 If a fine is imposed on or damages are awarded against either party, then each party shall bear the portion attributable to its own acts or omissions.

Article 15 — Term and termination

15.1 This agreement shall enter into force upon digital acceptance, or at the moment the customer starts using the service, and shall run for the duration of the underlying agreement.

15.2 The articles which by their nature are intended to survive termination, including confidentiality, deletion and liability, shall remain in force thereafter.

Article 16 — Final provisions

16.1 Amendments shall only be valid if both parties agree to them in writing. CarTwin may unilaterally amend this agreement if required by changes in legislation or updated guidelines from supervisory authorities; it shall inform the customer of this thirty days in advance.

16.2 If a provision is void or voidable, the remaining provisions shall remain in full force and effect.

16.3 This agreement is governed by Dutch law. Disputes shall be submitted to the competent court of the District Court of Rotterdam.

Acceptance

Appendix 1 — The processing

Subject matter The creation of a three-dimensional model from a video recording of a vehicle supplied by the customer, and making it available.

Nature of the processing Receiving, storing, automated processing, making available and deleting after expiry.

Purpose Solely to provide the agreed service.

Categories of data subjects

• Persons who can be identified in the recording or the model, including the keeper

of a vehicle insofar as they are identifiable via the registration plate

• Persons who incidentally appear in the frame, such as bystanders, passers-by and

employees

• Users of the customer's account

Types of personal data

• Image material of vehicles, including registration plates, which are displayed

legibly in the model

• Image material in which persons, buildings or third-party property may be

visible

• Data of account users: name, email address, encrypted

password

• Usage data: titles of scans, timestamps, status, technical

metrics of the processing

• Technical data: IP address, browser type, timestamps

Special categories of personal data Not applicable. The customer does not supply these.

Duration of the processing For recordings and models: until the end of the availability period of the purchased package. For account data: for as long as the account exists, subject to statutory retention periods.

Appendix 2 — Security measures

Access to data

• Recordings and models are kept in protected storage that is not publicly

accessible.

• Access is provided exclusively via temporary, signed links with a

limited validity period.

• Each customer has access only to their own data. This is

enforced at the database level and not just in the application.

• Write permissions are restricted on a per-column basis: a user can only change their

own name and the title of their scans. All other data is set exclusively by the server.

• No permissions are granted to non-logged-in visitors.

Authentication

• Passwords are only stored in encrypted form.
• Chosen passwords are checked against known leaked passwords.
• A minimum password length is enforced.

Keys and secrets

• Keys for the underlying services are stored exclusively in the

server environment and never reach the browser.

• Background processes are secured with a shared secret; requests without

a valid secret are rejected.

Transport

• All traffic is encrypted.
• Access tokens in temporary links are not recorded in logs.

Sharing links

• Sharing is disabled by default and is only enabled by the customer.
• A sharing link uses a randomly generated token that is separate from

internal identifiers.

• Disabling the link immediately invalidates it.
• Shared pages are excluded from indexing by search engines.

Monitoring

• The execution of background processes is logged, so that failures

are visible and do not go unnoticed.

Deletion

• Recordings and models are deleted after the expiry of the availability period.
• A recording is temporarily stored on the computing environment during processing and

is deleted from there afterwards.

Appendix 3 — Sub-processors

The current list is available on request via service@cartwin.nl.