Last updated: July 8, 2026.

This Data Processing Agreement ("DPA") forms part of the agreement between you ("Customer", the controller) and 18092516 Canada Inc. o/a CarcoCRM ("CarcoCRM", "we", "us", the processor) for your use of the CarcoCRM product and services (the "Service"). It describes how we process personal information on your behalf and reflects the principles of Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

1. Roles

For personal information about your dealership's customers and other individuals that you submit to or generate through the Service ("Customer Personal Information"), you are the controller and we are your processor acting on your instructions. Each party is responsible for complying with the privacy laws that apply to it.

2. Scope and details of processing

Subject matter and duration: processing of Customer Personal Information for the term of your subscription and any wind-down period described below.
Nature and purpose: to provide, secure, support, and improve the Service as instructed by you and as described in our Terms of Service.
Categories of individuals: your customers and prospects, and your staff and other people whose information you record in the Service.
Categories of personal information: contact details, vehicle and transaction records, communications, and other information you choose to record.

3. Our obligations

We process Customer Personal Information only on your documented instructions, including as set out in the Terms of Service and this DPA, unless law requires otherwise.
We ensure that people authorized to process Customer Personal Information are bound by confidentiality.
We maintain appropriate technical and organizational security measures, including encryption in transit, access controls, and least-privilege practices, taking into account the nature of the information and the risks.

4. Subprocessors

You authorize us to engage the service providers listed on our Subprocessors page to help provide the Service. We remain responsible for their performance, and we bind them to data protection obligations consistent with this DPA. We will provide a reasonable way to learn of changes to the list, and where you have a legitimate objection to a new subprocessor we will work with you in good faith.

Artificial intelligence features are provided by Carco Technologies on our own private infrastructure. Customer Personal Information is not sent to any third-party artificial intelligence provider.

5. Assisting you

Taking into account the nature of the processing, we will provide reasonable assistance to help you respond to requests from individuals to access, correct, or delete their information, and to meet your own privacy obligations. If we receive a request directly from an individual about your data, we will refer them to you.

6. Security incidents

We will notify you without undue delay after becoming aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Customer Personal Information, and we will provide information reasonably available to help you meet your notification obligations.

7. Where information is processed

We host Customer Personal Information primarily in Canada. Certain subprocessors may process limited information in other countries as described on our Subprocessors page, under contractual protections.

8. Return and deletion

On termination of the Service, we will make Customer Personal Information available for export for a limited period and then delete or de-identify it, unless retention is required by law.

9. Records and audit

We will make available information reasonably necessary to demonstrate compliance with this DPA and, on reasonable prior notice and subject to confidentiality, respond to your reasonable audit inquiries.

10. Liability and term

This DPA is subject to the limitations of liability in the Terms of Service. It remains in effect for as long as we process Customer Personal Information on your behalf.

11. Governing law

This DPA is governed by the laws of the Province of Ontario and the federal laws of Canada that apply there.

12. Contact us

Questions about this DPA can be sent to hello@carcocrm.com.

Our registered office is at 3-1124 Stellar Dr, Newmarket, ON L3Y 7B7, Canada.