This Agreement is entered into between CARTRIGO Advanced LLC ("CARTRIGO") and the participating dealer entity identified at the time of affiliation ("Dealer"). Together referred to as "the Parties."

Dealer hereby authorizes CARTRIGO to perform the following activities on Dealer's behalf, within strictly defined limits:

• Lead reception: Receive inquiries and leads from consumers interested in vehicles, financing scenarios, or purchase preparation.
• Preliminary data collection: Collect basic consumer information to organize the initial inquiry file, subject to consumer consent.
• Disclosures and consent forms: Present pre-approved privacy disclosures, consent forms, and data use notices to consumers before any information is collected.
• Broker coordination: Coordinate the consumer interaction with an authorized CARTRIGO broker or directly with Dealer, as agreed in the operational flow.
• Lead transmission: Transmit consumer-authorized information to Dealer within the scope defined in this Agreement.
• OTD estimation: Provide preliminary Out-The-Door price estimates and financing scenario modeling as educational tools for consumer preparation. All results are reference estimates only.

• Documented consent process: Maintain a documented process for consumer consent capture, including method, date, and evidence of acceptance before any data is collected.
• Access controls: Implement role-based access controls so that only the assigned broker and authorized administrators can view each consumer's inquiry file.
• Confidentiality: Maintain strict confidentiality over all consumer data and Dealer information. Never share data with unauthorized parties.
• Preliminary nature of results: Never present OTD estimates, financing scenarios, or preliminary eligibility results as final, guaranteed, or binding figures. Always label them as reference estimates.
• Data retention: Retain consumer data only as long as necessary for the authorized purpose, and destroy it in accordance with CARTRIGO's Data Retention and Destruction Policy.
• Incident reporting: Report any actual or suspected data breach or security incident to Dealer and to the appropriate authorities within the timeframes required by Florida law (Fla. Stat. § 501.171).
• Traceability: Maintain evidence of the consent form version used, date, method of capture, and a sufficient audit trail for internal review or legal inspection.

Both Parties acknowledge that consumer information processed under this Agreement is sensitive from a commercial, operational, and privacy perspective. The Parties agree to:

• Maintain strict confidentiality and limit internal access to personnel with a functional need.
• Not reutilize consumer information for purposes outside the authorized flow.
• Apply the principle of data minimization — collecting only what is strictly necessary for the defined purpose.
• Implement and maintain reasonable technical and organizational security measures proportionate to the sensitivity of the data.

Both Parties agree to comply with all applicable laws governing the collection, use, and protection of consumer financial information, including but not limited to:

• Fair Credit Reporting Act (FCRA): Any consumer report inquiry must have a documented permissible purpose and valid consumer consent.
• Gramm-Leach-Bliley Act (GLBA) / FTC Safeguards Rule: Nonpublic personal financial information must be protected with a written information security program.
• FTC Act Section 5: Neither Party may engage in unfair, deceptive, or misleading practices in connection with vehicle purchase or financing advisory services.
• Florida Consumer Protection Laws: Including the Florida Deceptive and Unfair Trade Practices Act (FDUTPA).
• Florida Breach Notification Law (Fla. Stat. § 501.171): Consumer notification within 30 days and Florida AG notification for breaches affecting 500+ residents.

By signing below or by electronically accepting this Agreement through the CARTRIGO dealer affiliation process, both Parties agree to be bound by all terms of this Agreement.