Data Processing Addendum

Last updated: October 28, 2026

This Data Processing Addendum ("DPA") is part of the Terms of Service (the "Terms") between Logrrr LLC, a Florida limited liability company (Florida document number L26000520966), 55 SE 2nd Ave, Delray Beach, FL 33444 ("Logrrr"), and the customer that holds the Logrrr account ("Customer"). It applies to every account automatically. Customer may also ask for a copy signed by Logrrr at ahoy@logrrr.com. Words defined in the Terms have the same meaning here.

1. Definitions

• "Customer Data" means the license plate detection data, images, video and related information Customer's camera systems send to Logrrr, and everything Logrrr derives from it for Customer (for example vehicle records, matches, vehicle colour and type, and appearance descriptions), as described in Annex 1.
• "Personal Information" means Customer Data that identifies, relates to, or could reasonably be linked to a natural person, as defined by Applicable Data Protection Law.
• "Applicable Data Protection Law" means the US federal and state laws that apply to the processing of Personal Information under the Terms, including the California Consumer Privacy Act as amended (CCPA), the state consumer privacy laws modelled on it, and state laws on automated license plate reader data.
• "Process" means any operation on Customer Data, such as collecting, storing, using, displaying, deleting or disclosing it.
• "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Data held by Logrrr or its sub-processors.
• "Sub-processor" means a third party Logrrr engages to Process Customer Data, as listed at /sub-processors.

2. Roles

2.1 Customer is the business, controller or operator of the camera systems and of the Customer Data. Logrrr Processes Customer Data on Customer's behalf as its service provider, processor or contractor.

2.2 Customer is responsible for the lawfulness of collecting Customer Data, for any notices and consents the law requires, for its own retention settings and for its use of the Service, as set out in Section 4 of the Terms. If Customer is a government agency, Customer is the custodian of its records and is responsible for public-records and records-retention requirements.

2.3 Logrrr's state-law limits (blocked locations, retention caps and similar), shown at /state-rules, are applied as a convenience. They are not legal advice and do not shift Customer's responsibility for compliance.

3. Logrrr's obligations

3.1 Instructions. Logrrr Processes Customer Data only to provide the Service under the Terms, this DPA and Customer's documented instructions, which include Customer's settings and actions in the console and through the API. If Logrrr believes an instruction violates Applicable Data Protection Law, or can no longer meet its obligations under it, Logrrr will tell Customer promptly.

3.2 Confidentiality. Logrrr limits access to Customer Data to the people who need it to provide the Service. Everyone with access is bound by a duty of confidentiality. Logrrr staff view Customer Data only to provide support, to investigate abuse or a security incident, or where the law requires it; each view requires a recorded reason, is logged, and appears in Customer's access log in the console.

3.3 Processor duties under state law. Where Applicable Data Protection Law gives Customer the rights of a controller, Logrrr will: (a) assist Customer, through the console's tools and on reasonable request, in responding to consumer requests and in meeting its security, breach-notification and data-protection-assessment obligations, taking into account the nature of the Processing and the information available to Logrrr; (b) make available to Customer the information reasonably needed to demonstrate Logrrr's compliance with this DPA (Section 9); (c) engage Sub-processors only under a written contract that requires them to meet obligations substantially similar to Logrrr's for the Customer Data they Process (Section 7); and (d) delete or return Customer Data at the end of the Service (Section 10).

3.4 No other use. Logrrr does not sell Customer Data, share it between customers, combine it across customers, search across customers' data, or use it for any purpose other than providing the Service, except:

• aggregated statistics that cannot identify any person or vehicle and contain no plate text or images (for example event counts and storage volumes), used to operate and improve the Service; and
• where Customer has turned on feedback sharing in the console, the copy of Customer's plate list, vehicle records and matching decisions described in the Privacy Policy (Section 4), kept for up to 12 months and deleted within 30 days after sharing is turned off or the account is closed.

Logrrr does not use Customer Data to train artificial-intelligence models except under such an opt-in. Logrrr never runs facial recognition or facial analysis on any image and never uses images to identify people.

4. CCPA service provider terms

Where the CCPA applies to Customer:

4.1 The business purpose for which Logrrr Processes Personal Information is providing the Service described in the Terms: receiving, storing, analysing, displaying, exporting and deleting Customer's license plate detection data and the information derived from it, at Customer's direction.

4.2 Logrrr will not: (a) sell or share the Personal Information; (b) retain, use or disclose it for any purpose other than the business purpose in 4.1, or as the CCPA otherwise permits a service provider; (c) retain, use or disclose it outside the direct business relationship between Logrrr and Customer; or (d) combine it with personal information Logrrr receives from or on behalf of anyone else, or collects from its own interactions with a consumer, except as the CCPA permits.

4.3 Logrrr will comply with the CCPA's obligations that apply to service providers and provide the same level of privacy protection the CCPA requires of businesses. Logrrr will notify Customer if it determines it can no longer meet those obligations.

4.4 Customer may take reasonable and appropriate steps to ensure that Logrrr uses the Personal Information consistently with Customer's obligations under the CCPA, and, on notice, to stop and remediate unauthorized use. The assessment process in Section 9 is the principal such step.

4.5 Logrrr will cooperate with Customer in responding to verifiable consumer requests, mainly by the console tools that let Customer find, export and delete Customer Data. If a consumer contacts Logrrr directly about Customer Data, Logrrr will refer them to Customer and will not search Customer Data for them.

4.6 Logrrr certifies that it understands and will comply with the restrictions in this Section 4.

5. California ALPR law

Where Customer operates or uses an automated license plate recognition system in California, Customer is responsible for its own usage and privacy policy and for its own access records under Civil Code §1798.90.51 and §1798.90.52. Logrrr supports those duties: the console records who accessed Customer Data and what they searched for, and Customer can view and export that record. Logrrr maintains reasonable security for Customer Data (Annex 2) and publishes its own ALPR usage and privacy policy.

6. Security

6.1 Logrrr implements and maintains the technical and organizational measures in Annex 2, appropriate to the risk of the Processing. Logrrr may update those measures as long as the overall level of protection is not reduced.

6.2 Customer is responsible for the security of its own systems, cameras, network, account credentials and API keys, and for the people it gives access to its account.

7. Sub-processors

7.1 Customer authorizes Logrrr to engage the Sub-processors listed at /sub-processors. Logrrr is responsible for each Sub-processor's performance as for its own.

7.2 Logrrr will post changes to that page and email account holders at least 30 days before a new Sub-processor begins Processing Customer Data, except where a change is needed urgently for security or availability, in which case Logrrr will notify Customer as soon as practicable.

7.3 If Customer objects to a new Sub-processor on reasonable data-protection grounds, Customer may close its account before the change takes effect; that is Customer's remedy.

7.4 Customer Data is stored in the United States. Logrrr does not transfer Customer Data outside the United States.

8. Security Incidents

8.1 Logrrr will notify Customer without undue delay, and in any case within 72 hours, after Logrrr confirms a Security Incident affecting Customer Data.

8.2 The notice goes to the account owner's email address and includes, as far as then known: what happened, the Customer Data affected, the likely consequences, and what Logrrr has done and will do. Logrrr will add information as it learns it.

8.3 Logrrr will take reasonable steps to contain and remedy the Security Incident and will reasonably assist Customer with any notice Customer must give to individuals or regulators. Customer decides whether and how to notify individuals about Customer Data, except where the law requires Logrrr itself to notify.

8.4 Logrrr's notice is not an admission of fault or liability.

9. Assessments and information

9.1 On Customer's written request, no more than once in any 12 months (or after a Security Incident affecting Customer Data), Logrrr will answer a reasonable written security and privacy questionnaire and provide the documentation reasonably needed to show compliance with this DPA.

9.2 Answers and documents are Logrrr's confidential information. Customer may share them only with its own advisers and regulators under a duty of confidentiality.

9.3 Logrrr does not permit on-site audits. Where Applicable Data Protection Law requires Customer to be able to conduct, or to obtain, a further assessment of Logrrr, Logrrr will cooperate in the way that law requires, no more than once in any 12 months, at Customer's cost, under confidentiality, and without access to other customers' data or to Logrrr's security secrets.

10. Return and deletion

10.1 While the account is open, Customer may export Customer Data at any time in a commonly used machine-readable format, with images and video as the original files, through the console or Logrrr's download tool, and may delete individual records or all Customer Data. Data Customer deletes is removed as Privacy Policy Section 6 describes.

10.2 When the account is closed, Customer Data is hidden at once, an export remains available for 30 days, and Customer Data is then permanently deleted, except records Logrrr must keep for billing, tax or legal purposes and records of the terms Customer accepted.

10.3 Deleted Customer Data may persist in encrypted, write-protected backups for up to 30 days, until the backup is removed in the ordinary course. Backups are used only for disaster recovery; if Logrrr restores from one, it replays deletions made since the backup was taken.

10.4 Retention is set by Customer's plan and settings, and by any state-law limit Logrrr applies to a location.

11. Legal requests and legal holds

11.1 Logrrr discloses Customer Data to a third party only when required by valid legal process (such as a subpoena, warrant or court order), or in an emergency involving an imminent risk of death or serious physical injury. Logrrr will notify Customer before disclosing unless the law prohibits it, will seek to narrow an overbroad request, and will disclose only what the request requires. Logrrr does not share one customer's data with another customer, including a government customer, without the owning customer's direction or legal process. The process is described in Logrrr's Law Enforcement Request Guidelines.

11.2 If a legal hold or preservation request applies to Customer's account, Logrrr may suspend deletion of the affected Customer Data for as long as the law requires and will tell Customer unless prohibited. Customer can still export Customer Data while a hold is in place. Where a court order or legal hold requires it, Logrrr may restore a backup to retrieve the data it covers; the restored copy is used only for that purpose and removed when the data has been retrieved.

12. Liability

Each party's liability arising out of or related to this DPA is subject to the exclusions and the limitation of liability in Section 15 of the Terms, which apply to this DPA as if set out here.

13. General

13.1 Order of precedence. If this DPA conflicts with the Terms on the Processing of Customer Data, this DPA controls. Otherwise the Terms control.

13.2 Term. This DPA lasts as long as Logrrr Processes Customer Data for Customer, including after the account is closed until deletion under Section 10.

13.3 Changes. Logrrr may update this DPA to reflect changes in law or in the Service. Changes that reduce Customer's protection take effect on at least 30 days' email notice, as for the Terms (Section 18). Logrrr will not reduce the protection of this DPA during the term of a copy Logrrr has signed, unless the law requires it.

13.4 Customer's own terms. Logrrr may, at its discretion and only in a signed writing, agree to a customer's own data processing terms in place of or in addition to this DPA.

13.5 Governing law. This DPA is governed by the law that governs the Terms (Section 19), except where Applicable Data Protection Law requires otherwise.

Annex 1: Details of the Processing

Subject matter	Providing the Logrrr Service to Customer.
Duration	The term of the account, then until deletion under Section 10.
Nature and purpose	Receiving license plate detection events from Customer's camera systems; storing them; deriving vehicle records, matches, vehicle colour and type and an appearance description of the vehicle, on Logrrr's own servers; search, dashboards, reports, alerts, webhooks, exports and deletion at Customer's direction.
Categories of data subjects	Drivers, owners and occupants of vehicles recorded by Customer's cameras, and people who appear in or near those images; Customer's own users, as recorded in Customer's access log.
Categories of Personal Information	License plate text and read confidence; date, time, camera and location of each detection; thumbnail images and short video clips, which may show vehicles and people; information derived from them (vehicle records, matches, vehicle colour and type, appearance descriptions); vehicle names and notes Customer enters; Customer's access log (which user viewed or searched what, when, from which IP address, and any search terms).
Sensitive information	Logrrr does not seek sensitive personal information. Images may incidentally show people. Logrrr never runs facial recognition or analysis and never uses images to identify people. Precise geolocation of a vehicle may be inferable from the location of Customer's camera.
Frequency	Continuous, as events arrive.
Retention	As set by Customer's plan and settings and any state-law limit (Section 10).
Location	United States.

Annex 2: Security measures

• Encryption: Customer Data is encrypted in transit (TLS) and at rest. Database backups are encrypted with keys Logrrr holds, and are write-protected so that no one, including Logrrr, can delete them before their scheduled removal.
• Hosting: US regions of the providers listed at /sub-processors; images and video in storage restricted to the United States.
• Access control: customer sign-in passwords are stored only as salted, slow hashes. Logrrr's staff administration site sits behind an identity check by Cloudflare Access, is reachable only from the United States, and requires a long password and a time-based one-time code; staff roles grant the least access needed, and viewing Customer Data requires a recorded reason. Database logins used by Logrrr's services are limited to the procedures each service needs.
• Logging: staff views of Customer Data are audited and shown in Customer's access log; the console records Customer's own users' access; failed requests and failed sign-ins are recorded for 30 days, and addresses that attack the Service may be blocked.
• Isolation: each customer's data is scoped to its account in every query and procedure; there is no cross-customer search.
• Resilience: encrypted backups and server snapshots for disaster recovery, kept up to 30 days; deletions replayed after any restore.
• Monitoring: continuous monitoring of the Service's availability and errors.
• People: access to Customer Data is limited to Logrrr's Managing Member today; anyone given access in future must first read and sign Logrrr's ALPR usage and privacy policy and a confidentiality agreement, and repeat the policy each year.
• Vulnerability reports: received at security@logrrr.com as described at /security.

Annex 3: Sub-processors

The current list, with each sub-processor's role and location, is at /sub-processors and forms part of this Annex.