Data processing agreement (Art. 28 GDPR)

Part of the terms accepted by every repair shop ("controller") when it creates a Caree account. Processor: housee s.r.o..

1. Subject and duration: processing of the shop's customer, vehicle and repair data for providing Caree, for the duration of the subscription.
2. Categories: drivers and vehicle keepers; identity and contact data, vehicle data incl. VIN and plate, repair and invoice data, photos of vehicles.
3. Instructions: the processor acts only on documented instructions of the controller (use of the service and its settings).
4. Confidentiality: persons with access are bound to confidentiality.
5. Security (Art. 32): TLS, per-shop data isolation, hashed credentials, access logging, backups, least-privilege access.
6. Sub-processors: Fly.io (hosting, EU region); data partners enabled by the controller. The controller is informed of changes in advance and may object.
7. Assistance: export, correction and erasure functions for data-subject requests; assistance with breaches (notification without undue delay, at most 48 hours after becoming aware) and DPIAs.
8. End of contract: export to the controller, deletion within 90 days unless law requires storage.
9. Audit: information needed to demonstrate compliance is provided on request.