נספח עיבוד מידע

This annex is part of the terms of service. It applies to the data of the Dealer’s customers, for which the Dealer controls the database and AutoGolan Ltd. (“we”) holds and processes it for the Dealer, under the Protection of Privacy Law, 5741-1981, and the Protection of Privacy (Data Security) Regulations, 5777-2017. For that data, this annex prevails over the terms of service.

1. The data and the purpose

• About whom: people who contact the Dealer or comment to it on WhatsApp, Messenger, Instagram, TikTok or the Dealer’s car website.
• What data: name and profile picture, phone number or platform identifier, messages, photos, videos and voice notes, comments on posts, details from the contact form, the car the customer is looking for and their consent to be contacted, and the Dealer’s notes.
• The purpose: answering customers on the Dealer’s behalf, handing the Dealer the ones ready to move forward, summarising conversations, keeping the cars customers are looking for, and showing all of this to the Dealer in the app.

2. What we may do with the data

• Only what is needed to provide the Service to the Dealer: receive, store, display, send to AI models to write a reply, send the reply, and delete.
• Only under the Dealer’s settings and instructions. If an instruction seems to us to break the law, we will tell the Dealer before acting on it.
• We may not: use the data for our own purposes, sell it, market to the Dealer’s customers, train models on it, or give it to anyone who is not a sub-processor under section 6. We will disclose data to an authority only when the law requires it, and tell the Dealer if the law allows.

3. The systems

The data is stored in Tony’s database and files in Google Cloud’s Tel Aviv region, and shown in Tony’s app to the Dealer and the team the Dealer added. Each business sees only its own data. Our team members access a Dealer’s data only for support or to fix a fault, and the access is recorded in a log the Dealer can ask to see.

4. Security

• All traffic is encrypted (TLS), and stored data is encrypted.
• Access keys to the Dealer’s accounts are encrypted again, with a key managed in Google Cloud KMS.
• Businesses are separated at the database level, so a request made for one business cannot reach another business’s data.
• Sign-in by a password checked against leaked passwords, a one-time code or a passkey. The Dealer manages who is on the team and what they may do.
• A daily backup, and the ability to restore the data.
• A record of deletions, settings changes and actions by our support team.
• A written security procedure, which we review and update at least once a year and on any material change to the system.

5. Confidentiality

Only team members who need access to the data to provide the Service get it, and before that they undertake in writing to keep it confidential and use it only under this annex. The undertaking continues after they leave.

6. Sub-processors

The Dealer agrees that we use these providers to provide the Service. Each is bound by a written agreement to protect the data and use it only to provide its service to us:

• Google Cloud - Servers, database and files (Israel (Tel Aviv region)).
• OpenAI - Writing replies to customers (United States).
• Google (Gemini on Vertex AI) - Writing ads, sorting and answering comments on posts, conversation summaries and reading photos (Outside Israel, in a region Google chooses).
• Meta - Receiving and sending WhatsApp, Messenger and Instagram messages, and publishing on Facebook and Instagram (United States and other countries).
• TikTok - Messages and publishing, for dealers who connected a TikTok account (Outside Israel).
• Vercel - Hosting this site, the app and the dealers' sites. Requests pass through its servers (Germany (Frankfurt)).
• Cloudflare - Routing the domain and the bot check on forms (Cloudflare's global network).
• Apple, Google, Mozilla and Expo - Sending notifications to the dealer's phone. A notification includes the customer's name and the start of the message, unless the user turned previews off (United States).

We will tell Dealers by email 30 days before we start sending data to a new sub-processor. A Dealer who objects can end the Service before that date. Transfers outside Israel are made as described in the privacy policy, section 8.

7. Security incidents

If we discover that the Dealer’s data was exposed, lost, altered or disclosed without authorisation, or a real risk of it, we will tell the Dealer without delay. We will tell it what happened, which data and which customers were affected, what we did to stop and fix it, and everything it needs to report to the Privacy Protection Authority and to its customers. We will cooperate with the Dealer and the Authority until the incident is handled.

8. Requests from customers

If a customer of the Dealer asks us to see, correct or delete their data, we will pass the request to the Dealer within 7 days and help the Dealer answer it. The Dealer can also delete a conversation itself in the app.

9. Reporting and oversight

• Once a year we will send the Dealer a short report on how we meet our duties under this annex and the Data Security Regulations, and answer the Dealer’s reasonable questions about it at any time.
• The Dealer may check our compliance with this annex, by questionnaire or meeting, arranged in advance and without exposing other dealers’ data.

10. Duration, return and deletion

This annex applies for as long as we process data for the Dealer. During the Service, data is kept and deleted as the privacy policy describes: messages move to the archive after 30 days and the archive is deleted after 24 months, and car requests are deleted 12 months after the last request. When the Service ends, the Dealer can ask for a copy of the data, and we will send it within 30 days in a common file format. Then we delete the data and confirm the deletion to the Dealer by email. Copies in backups are deleted within 90 days.

11. The Dealer’s responsibilities

The Dealer is responsible for having the right to collect the data and give it to us, for telling its customers what the law requires, and for its instructions to us being lawful (see the terms of service, sections 5 and 6).

12. Contact

On anything about this annex: privacy@trytony.co.il.