Data Processing Addendum

The dealership is the controller of the personal data it connects. Zumbay is the processor and processes that data only to provide the service and only on the dealership’s documented instructions.

Vehicle catalog data; website and referral activity, including tagged clicks and vehicle-page views; account contacts for dealership staff. Zumbay does not connect to CRM or DMS systems and does not request or store customer names, email addresses or phone numbers.

Hosting and edge delivery; managed database and authentication; payment processing. Dealership inventory and website providers act under the dealership’s own agreements. Zumbay notifies administrative contacts before adding a sub-processor that processes personal data.

Encryption in transit and at rest; encrypted provider credentials that are never displayed back; least-privilege, read-only access to upstream reporting data through a dedicated database role restricted to a defined set of reporting views; server-side authorization plus row-level security; audit logging of privileged actions.

On termination, operational data is retained in a read-only state for 30 days so the dealership can export it, then deleted within 90 days unless a longer period is required by law. Billing records are retained as required for tax and audit purposes.

Zumbay assists with data-subject requests and notifies the dealership without undue delay after becoming aware of a personal-data breach affecting its data.