First Amendment to

    This First Amendment to the Commercial Agreement (“Amendment”) is entered into and effective this 13th day of May, 2022 (the “Effective Date”), by and between Caret Holdings, Inc. (“Company”), Carvana, LLC (“Dealer”), Carvana Insurance Services, LLC (“CIS”), and Carvana Group, LLC (“Parent”) (collectively, the entities Parent, CIS, and Dealer shall be referred to as “Carvana”). Carvana and Company shall be referred to as the Parties, and each a Party.

    WHEREAS, Carvana and Company entered into the Commercial Agreement dated October 1, 2021, as amended or modified from time to time (the “Agreement”); and

    WHEREAS, Carvana and Company wish to modify the Agreement to provide for the amended terms and conditions, as described herein.

    NOW, THEREFORE, in consideration of the promises, mutual covenants, and agreements as described in the Agreement and this Amendment, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties hereto agree as follows:

The original Schedule 2 to the Commercial Agreement shall be deleted in its entirety, and replaced with a revised and amended Schedule 2 which is attached hereto as Exhibit A.

2.Schedule 3.1 to the Commercial Agreement

The defined term for “Attributable Auto Policies” set forth in Schedule 3.1 of the Commercial Agreement shall be deleted in its entirety and replaced with the following revised defined term:

“Attributable Auto Policies” means the number of new Company Policies, for which the policies have become effective, excluding brokered automobile insurance policies, attributed to Carvana in a given calendar month pursuant to Section 1(a) of Schedule 3. If a Carvana Customer returns their vehicle to Carvana and cancels their Company policy within seven (7) calendar days of the return of said vehicle to Carvana, that policy does not count towards Attributable Auto Policies.

3.Schedule 5 to the Commercial Agreement

Section 6 of Schedule 5 to the Commercial Agreement (Agency Agreement) shall deleted in its entirety and replaced with the following:

“To the extent CIS possesses or otherwise stores, processes, or transmits cardholder data on behalf of Company, or to the extent that CIS could impact the security of Company's

cardholder data environment, CIS acknowledges responsibility for reasonably securing such data, which in no event shall be less than industry standard. CIS will provide materials and/or affirmations to Company demonstrating compliance, to the extent relevant, with the most current version of Payment Card Industry (PCI) Data Security Standard (DSS) published by the PCI Security Standards Council (PCI SSC), as may be applicable to or required of CIS as Company's service provider to assist with Company's provision of evidence of PCI DSS compliance. If CIS becomes aware that CIS, Agents, or Sub-Producers is not, or will not likely be, in compliance with applicable PCI DSS requirements, or CIS's materials and/or affirmations related thereto, for any reason, CIS will report in writing to Company within one (1) calendar day the non-compliance or likely non-compliance.”