Data Processing Addendum
Version 1.0 | Last Updated: September 20, 2026
This Data Processing Addendum (“DPA”) forms part of the Tuxedo Drive Master Services Agreement (the “Agreement”) between Tuxedo Drive, Inc. (“Tuxedo Drive”) and the customer identified in an Order Form (“Customer”). It governs Tuxedo Drive’s processing of personal information on Customer’s behalf.
Capitalized terms not defined here have the meaning given in the Agreement. If this DPA conflicts with the Agreement on a data protection matter, this DPA controls.
1. Roles and Scope
Customer is the business (or controller) with respect to personal information about its members, customers, employees, and prospects that Customer collects or that is collected through the Service at Customer’s facility. Tuxedo Drive is a service provider (or processor) with respect to that information and processes it on Customer’s documented instructions.
Customer’s instructions are: (a) the Agreement and this DPA, (b) Customer’s configuration and use of the Service, and (c) any further written instruction the parties agree to. Tuxedo Drive may notify Customer if it believes an instruction violates applicable data protection law, and may decline to act on that instruction.
Tuxedo Drive acts as a business in its own right with respect to information it collects about Customer’s owners, operators, and staff as users of the Service, and with respect to its own marketing to car wash businesses. That processing is governed by the Tuxedo Drive Privacy Policy, not this DPA.
Deidentified and aggregated data is outside this DPA. As permitted by Section 5.3 of the Agreement, Tuxedo Drive may create deidentified and aggregated data from Service data. Tuxedo Drive will maintain such data in deidentified form, will not attempt to reidentify it, will implement technical safeguards and business processes prohibiting reidentification, and will contractually obligate any recipient to the same. Deidentified and aggregated data is not personal information and is not subject to this DPA.
2. Nature of the Processing
Subject matter. Provision of the Tuxedo Drive car wash membership, billing, vehicle identification, customer communication, and analytics platform.
Duration. The term of the Agreement, plus the retention periods described in Section 8.
Categories of data subjects. Customer’s members and wash customers; prospective customers, leads, and referred individuals; drivers of enrolled vehicles; Customer’s employees, staff, and representatives; individuals who contact Customer through the Service; individuals captured by cameras at Customer’s facility.
Categories of personal information processed:
| Category | Examples |
|---|---|
| Identifiers | Name, email address, mobile number, mailing address, account identifiers, IP address |
| Vehicle information | License plate number and images; make, model, color, year; vehicle condition records |
| Commercial information | Membership plan, billing history, transaction and visit records, promotions applied |
| Payment information | Payment method token and card metadata held by the payment processor; Tuxedo Drive does not store full card numbers |
| Communications | Email, SMS, and call content and metadata exchanged through the Service, including support conversations, and recordings and transcripts of automated voice interactions |
| Workforce information | Where Customer uses workforce features: staff contact details, role, schedule, timekeeping, commission, and payroll-related amounts |
| Prospect and referral information | Contact details submitted through a lead form, promotion, or referral, and referral reward records |
| Safety and fraud signals | Indicators of fraud, membership misuse, or abuse, and records of a for-cause refusal of service |
| Facility imagery | Images and video recorded by cameras at Customer’s facility, including people present in the wash area, held both on equipment at the facility and in Tuxedo Drive’s cloud environment |
| Inferences and analytics | Visit patterns, membership and churn signals, and other outputs generated by the Service |
Sensitive information. Tuxedo Drive does not seek sensitive personal information and configures the Service to discard sensitive attributes before persistence, as described in the Privacy Policy. Customer will not submit government identification numbers, health information, financial account numbers, or biometric identifiers to the Service, including through any generative AI feature.
3. Service Provider Commitments
Tuxedo Drive will:
- Process personal information only to perform the Service, for the business purposes specified in the Agreement and this DPA, and as otherwise permitted by applicable data protection law
- Not sell or share personal information as those terms are defined under the California Consumer Privacy Act, as amended by the CPRA, and comparable state laws
- Not retain, use, or disclose personal information outside the direct business relationship with Customer, or for any commercial purpose other than performing the Service, except as expressly permitted by applicable law
- Not combine personal information received from Customer with personal information received from another source, except as permitted by applicable law to perform the Service or a permitted internal use
- Limit access to personnel with a need to know, bound by confidentiality obligations
- Implement and maintain the security measures described in Section 6 and in Section 9 of the Agreement
- Promptly notify Customer if Tuxedo Drive determines it can no longer meet these obligations, and, on notice from Customer of unauthorized use, take reasonable steps to stop and remediate it
Tuxedo Drive certifies that it understands the restrictions in this Section and will comply with them.
Permitted internal use. Tuxedo Drive may use personal information internally to build, improve, secure, and troubleshoot the Service, to detect and prevent fraud and abuse, and to comply with law, in each case to the extent permitted by applicable data protection law. This permission does not authorize Tuxedo Drive to disclose personal information of one customer to another customer, or to use one customer’s personal information to provide services to another customer other than through deidentified or aggregated data.
4. Artificial Intelligence and Automated Processing
The Service uses artificial intelligence, including generative AI and computer vision, to provide features such as vehicle identification, vehicle condition analysis, safety monitoring, support and communication assistance, business insights, and marketing content generation. Because these features process personal information, the following apply in addition to Section 3.
Model training. Tuxedo Drive contracts with third-party AI providers on enterprise or API terms that exclude content submitted through the Service from training the provider’s general-purpose models, and does not knowingly submit Customer’s personal information to a provider for that purpose. Tuxedo Drive may use Service data to train, tune, and evaluate its own detection and inference models used to provide the Service, consistent with the permitted internal use in Section 3 and Section 5.2 of the Agreement.
Generative AI providers. Content submitted to a generative AI feature is transmitted to the AI provider identified in Section 5 for processing and is returned to the Service. Tuxedo Drive does not control, and does not warrant, the accuracy or suitability of generated output. Customer is responsible for reviewing generated content — including marketing copy, customer communications, and business insights — before relying on or sending it.
Human review. Tuxedo Drive personnel may review inputs and outputs of AI features on a limited, need-to-know basis for quality, safety, abuse prevention, and troubleshooting. Such review is subject to the confidentiality and access controls in this DPA.
Automated decisions. Where an automated feature takes an action affecting an individual, Customer remains responsible for any notice, explanation, opt-out, or human review that applicable law requires of a business. Tuxedo Drive will provide Customer reasonable assistance in responding to such a request.
The Service does not ban an individual, cancel a membership for cause, or refuse service by automated means. Those actions require a decision by Customer’s personnel. Automated identification and fraud signals surface information for that decision; they do not make it.
4A. Safety, Fraud, and Platform Integrity
Customer and Tuxedo Drive each have a legitimate interest in preventing fraud, protecting staff and customers from unsafe conduct, and protecting the integrity of the platform. Applicable data protection law permits a service provider to retain, use, and disclose personal information to detect security incidents and to protect against fraudulent, malicious, deceptive, or illegal activity. This Section describes that processing.
Fraud and misuse signals. Tuxedo Drive processes Service data to generate signals indicating possible fraud, membership misuse, payment abuse, or chargeback abuse, and makes those signals available to Customer. Customer decides what action to take on them.
Cross-customer safety and fraud sharing. Where Customer refuses service to, or bans, a person or vehicle for cause, Customer may direct Tuxedo Drive to share the fact of that refusal and a general reason category with other Tuxedo Drive customers, and may receive equivalent information from them. Tuxedo Drive is not obligated to make this capability available in any particular form. The parties agree to the following limits on its use:
- Minimum necessary. Only the identifiers needed to recognize the person or vehicle and a general reason category are shared. Payment card data, billing history, communication content, and facility imagery are not shared through this mechanism.
- For cause only. Customer will report a refusal only where it is based on a documented cause — conduct, financial abuse, operational disruption, or a legal or regulatory requirement — and will not report a refusal that is based on, or is a pretext for, a protected characteristic. Customer is solely responsible for the accuracy of what it reports and for its own decision to act on information it receives.
- Categories, not narratives. Only a defined reason category is shared. Customer will not share free-text allegations, accusations, or commentary about an individual through this mechanism. Where a category reflects a suspicion or an unresolved allegation rather than a determination, it is transmitted and displayed as such.
- Not a consumer report. The parties do not intend this exchange to constitute a consumer report, and neither party will assemble, furnish, or use this information for any purpose covered by the Fair Credit Reporting Act, including decisions about credit, insurance, employment, housing, or government benefits. Customer will not use it for any such purpose and will not supplement it with information obtained for such a purpose.
- Independent decisions. Each customer decides independently whether to serve a person. Tuxedo Drive does not decide, and does not direct any customer to decide, whether an individual may be served.
- Correction. On notice that shared information may be inaccurate, Tuxedo Drive will forward the notice to the Customer that supplied it. Customer, not Tuxedo Drive, is responsible for reviewing and substantiating what it reported. Customer will respond promptly and will correct or withdraw information it cannot substantiate. Tuxedo Drive may remove or stop propagating information that Customer does not substantiate, and does not otherwise investigate or adjudicate the underlying facts.
- Indemnity. Customer’s indemnity in Section 13 of the Agreement extends to claims arising from information Customer reports through this mechanism and from Customer’s use of information it receives.
For this processing, Tuxedo Drive acts as a business in its own right with respect to platform integrity, and not solely as Customer’s service provider.
5. Sub-processors
Customer authorizes Tuxedo Drive to engage sub-processors to provide the Service. Tuxedo Drive remains responsible for each sub-processor’s performance of the obligations in this DPA and will impose data protection terms on each sub-processor no less protective than those in this DPA.
Tuxedo Drive engages sub-processors in the following categories:
- Cloud hosting, storage, content delivery, and infrastructure
- Payment processing and payment-related services
- Messaging, telephony, and automated voice services
- Transactional and marketing email delivery
- Artificial intelligence providers, for features that submit content to a model
- Vehicle recognition, video analysis, and vehicle attribute providers
- Analytics, error monitoring, and customer support tooling
- Payroll and timekeeping providers, where Customer uses workforce features
- Business platforms Customer elects to connect under Section 5.4 of the Agreement
A current list naming each sub-processor, the processing it performs, and its location is available from privacy@tuxedodrive.com on request. Tuxedo Drive maintains that list rather than publishing it in this Addendum so it stays accurate between revisions; the list, not this Section, is the authoritative record.
Changes. Tuxedo Drive will give Customer at least thirty (30) days’ notice before adding or replacing a sub-processor that processes personal information. Customer may object on reasonable data protection grounds within that period. The parties will work in good faith to resolve the objection; if they cannot, Customer may terminate the affected portion of the Service without penalty, and Tuxedo Drive will refund any prepaid fees for the terminated portion covering the period after termination.
6. Security
Tuxedo Drive maintains administrative, technical, and physical safeguards appropriate to the nature of the personal information and to the size and complexity of its business, including:
- Encryption of personal information in transit, and at rest where provided by its infrastructure and storage providers
- Access controls, authentication, and least-privilege access
- Logical separation of each customer’s data in the multi-tenant platform
- Network controls and logging
- Application of security updates on a risk-prioritized basis
- Confidentiality obligations and security guidance for personnel
- An incident response process
Security practices evolve. Tuxedo Drive may change these measures provided it does not materially reduce the overall level of protection.
On-site equipment. Part of the Service runs on equipment installed at Customer’s facility, which records and stores video and images locally and performs automated analysis on the premises, including generative AI inference. Video and images are also transmitted to Tuxedo Drive’s cloud environment and to sub-processors for storage and analysis. Tuxedo Drive is responsible for the software on that equipment and for the security of its transmission and cloud processing. Customer is responsible for the physical security of the equipment and of its premises, for network access at the facility, and for any copy of footage Customer retains on its own systems.
Customer responsibilities. Customer is responsible for configuring the Service appropriately, for managing its own user accounts and credentials, for deploying cameras and sensors lawfully and providing the notices applicable law requires, and for the accuracy and lawfulness of the data it submits, as set out in Sections 5.5 and 5.8 of the Agreement.
Workforce data. Where Customer uses workforce features, Customer is the employer and is solely responsible for its obligations to its own staff — including wage and hour, timekeeping, payroll, recordkeeping, notice, and any consent required to collect employee data. Tuxedo Drive processes workforce data only to provide those features and to exchange data with a payroll or timekeeping provider Customer uses.
Automated voice interactions. Where Customer enables an automated voice agent, Customer is responsible for determining whether the law of the states in which it operates permits recording, requires all-party consent, or requires disclosure that the caller is speaking with an automated system. Tuxedo Drive provides disclosure and consent functionality; Customer is responsible for enabling and configuring it correctly for its jurisdictions.
7. Security Incidents
Tuxedo Drive will notify Customer without undue delay after becoming aware of a security incident resulting in the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Customer’s personal information, and in any event in time to allow Customer to meet its own notification obligations under applicable law.
The notice will describe, to the extent known: the nature of the incident, the categories and approximate number of individuals and records affected, the likely consequences, the measures taken or proposed, and a contact point for further information. Tuxedo Drive will provide updates as further information becomes available, and will reasonably cooperate with Customer’s investigation, mitigation, and any notification Customer must make to individuals or regulators.
Tuxedo Drive’s notification is not an acknowledgment of fault or liability. As between the parties, Customer is responsible for determining whether the incident requires notification under law and for making that notification, except where the incident arises from Tuxedo Drive’s own systems and law requires Tuxedo Drive to notify directly.
8. Data Subject Requests, Return, and Deletion
Individual rights requests. Where an individual submits a request to Tuxedo Drive that relates to Customer’s data, Tuxedo Drive will direct the individual to Customer unless applicable law requires otherwise. Tuxedo Drive will provide Customer reasonable assistance in responding to requests to access, correct, delete, limit, port, or opt out, primarily through the self-service functionality the Service provides. Where assistance is not available through that functionality and is non-routine, repeated, or manifestly unfounded, Tuxedo Drive may charge its reasonable costs, and will tell Customer before doing so.
Deletion and return. On termination or expiration of the Agreement, or on Customer’s written request, Tuxedo Drive will delete or return Customer’s personal information. Customer has thirty (30) days after termination to export its data through the Service or to request a copy. Tuxedo Drive will provide written confirmation of deletion on request.
Exceptions. Tuxedo Drive may retain personal information where required by law, and may retain it for the periods stated in the Privacy Policy for legal, tax, fraud-prevention, dispute-resolution, and recordkeeping purposes, and in routine backups until those backups expire. Retained information remains subject to this DPA. Deidentified and aggregated data is not subject to deletion under this Section.
9. Audit and Assurance
On Customer’s written request, no more than once every twelve (12) months and with at least thirty (30) days’ notice, Tuxedo Drive will provide information reasonably necessary to demonstrate compliance with this DPA, including a completed security questionnaire, a summary of its security program, and any third-party security attestation or penetration test summary Tuxedo Drive then holds. Tuxedo Drive does not commit to holding any particular certification, and will state plainly which attestations it does and does not have.
Where these materials are not sufficient to satisfy an audit obligation Customer has under applicable law, and Customer is required by a regulator to audit further, the parties will agree in good faith on the scope, timing, and cost of an audit. Any audit will be conducted during business hours, will not unreasonably interfere with operations, will not grant access to another customer’s data or to Tuxedo Drive’s confidential information beyond what is necessary, and will be at Customer’s expense unless it reveals material non-compliance.
10. Jurisdiction-Specific Terms
United States. The parties intend this DPA to satisfy the contractual requirements applicable to a service provider or processor under the California Consumer Privacy Act as amended by the CPRA, and under comparable comprehensive privacy laws of other US states, in each case as applicable to the processing.
Non-US data. The Service is operated from the United States and is intended for use by car wash businesses operating in the United States. Customer will not submit personal information subject to the EU or UK General Data Protection Regulation without first notifying Tuxedo Drive in writing. If the parties agree to such processing, the EU Standard Contractual Clauses (Module Two, controller to processor) and the UK Addendum are incorporated by reference, with Tuxedo Drive as data importer and Customer as data exporter, this DPA supplying the required annexes, and the governing law and forum of the Agreement applying to the extent permitted.
11. Liability
Each party’s liability under this DPA is subject to the limitations and exclusions in Section 12 of the Agreement. Nothing in this DPA limits either party’s liability to an individual or to a regulator where applicable law does not permit such a limitation.
Each party will indemnify the other against claims, fines, and penalties arising from its own breach of applicable data protection law or of this DPA, subject to the indemnification and liability provisions of the Agreement.
12. Term and Contact
This DPA takes effect when Customer accepts the Agreement and remains in effect for as long as Tuxedo Drive processes personal information on Customer’s behalf. Sections 3, 7, 8, and 11 survive termination.
Data protection contact
Tuxedo Drive, Inc. Attn: Privacy 2955 Shell Road Brooklyn, New York 11224 Email: privacy@tuxedodrive.com