Data Processing Addendum
Last updated June 2026
This Data Processing Addendum (“DPA”) forms part of the agreement between the dealership identified in the Vinconex account (“Dealer”, the controller) and CraveBeast LLC (“Vinconex”, the processor) and applies whenever Vinconex processes personal data of the Dealer's shoppers or staff.
- 01
Scope and roles
Dealer determines the purposes and means of processing shopper personal data collected through its Vinconex pages; Vinconex processes it only on Dealer's documented instructions, which are: hosting the pages, capturing leads, delivering them to Dealer's CRM, showing unlocked content to the shopper, matching specialists when requested, summarising comments and providing the dashboard.
- 02
Categories of data and subjects
Shoppers: name, phone, email, comments and voice-note transcripts, quiz answers, vehicle of interest, IP address, scan time. Dealer staff: name, work email, role, sign-in metadata (IP, device, time).
- 03
Confidentiality and personnel
Vinconex limits access to personal data to personnel who need it to operate the service, binds them to confidentiality, and logs every staff action inside a Dealer's dashboard in the audit log, which Dealer can review.
- 04
Security measures
Vinconex maintains the technical and organisational measures described on the Security page (vinconex.com/security), including encryption in transit, hashed and breach-screened passwords, MFA for platform accounts, server-side session controls, tenant isolation, a tamper-evident audit log, nightly backups with restore drills, weekly dependency scanning and monitoring alerts.
- 05
Sub-processors
Vinconex uses the following categories of sub-processors: cloud hosting and managed database, object storage, transactional email (IONOS), and an AI provider for comment summaries and voice transcription. Vinconex will notify Dealer of any new sub-processor at least 14 days before it is used, by email to the Dealer's admin accounts, and Dealer may object on reasonable grounds.
- 06
Data subject requests
Dealer can fulfil access and deletion requests directly: leads are visible in the dashboard and the “Delete shopper data” action scrubs every lead from that shopper at the dealership and records the action in the audit log. Vinconex will forward any request it receives directly to Dealer within five business days and assist as reasonably needed.
- 07
Retention and deletion
Shopper contact details are scrubbed after the retention period Dealer configures (default 24 months). On termination Vinconex deletes Dealer's data from live systems within 30 days of the Dealer's request and from backups within a further 30 days, unless the law requires retention.
- 08
Security incidents
Vinconex will notify Dealer's admin accounts without undue delay, and in any case within 72 hours, after becoming aware of a personal-data breach affecting Dealer's data, with the information reasonably available to help Dealer meet its own notification duties.
- 09
Audit and evidence
On written request no more than once a year (or after an incident), Vinconex will provide the evidence it maintains — audit-log exports, backup and restore-drill records, dependency-scan results and the security review log — and answer reasonable security questionnaires.
- 10
Transfers and law
Data is hosted in the United States. Where Dealer is subject to laws requiring specific transfer mechanisms, the parties will put them in place. This DPA is governed by the same law as the Terms of Service. Contact: contact@vinconex.com.