Data Processing Agreement
Annex 1 to the Terms, with the content required by Article 28(3) GDPR. Version: 2026-11-03
Translation for information. Unless the parties agree otherwise in writing, the Hungarian version prevails.
Parties: the Subscriber as controller (the "Controller") and the Provider as processor (the "Processor").
1. Subject and duration
The Processor processes the personal data of the Controller's customers and staff to provide the Garagevo Service, for the term of the subscription and until deletion under clause 10.4 of the Terms.
2. Nature and purpose
Storage, organisation, retrieval, display, transmission on the Controller's instruction (for example sending a quote to the customer, creating an invoice in the connected invoicing service), backup and deletion. Purpose: keeping the workshop's work orders, quotes, customer and vehicle records.
3. Data subjects and categories of data
| Data subjects | Data |
|---|---|
| The workshop's customers (private persons, company contacts) | name, address, phone, e-mail, tax number (companies), billing data |
| Vehicles (linked to the keeper) | registration number, VIN, make, model, odometer, repair history, photos |
| Work orders, quotes | fault description, lines, prices, signature, time and way of approval |
| The workshop's staff | name, e-mail, role, sign-in log |
The program does not ask for special categories of data (health, criminal etc.) and the Controller may not record them.
4. Obligations of the Processor
4.1. Processes data only on the Controller's documented instructions: the Terms, this agreement and the Controller's actions in the program. It informs the Controller immediately if an instruction infringes the law.
4.2. Binds its staff with access to the data to confidentiality.
4.3. Takes the measures of Article 32 GDPR (clause 5).
4.4. Uses only the sub-processors listed in Annex 2. It notifies new sub-processors at least 30 days in advance; the Controller may object and, failing agreement, terminate free of charge. Sub-processors are bound by the same obligations.
4.5. Assists the Controller with data subject requests (access, rectification, erasure, portability), mainly through search, editing, deletion and export in the program. Requests received directly are forwarded to the Controller.
4.6. Notifies the Controller of a personal data breach without undue delay and at the latest within 48 hours of becoming aware of it, with its nature, the categories of data, likely consequences and the measures taken.
4.7. Assists with data protection impact assessments and consultations with the authority, using the information available to it.
4.8. At the end of the contract makes the data available under clause 10.3 of the Terms, then deletes it under clause 10.4.
4.9. Provides on request the information needed to demonstrate compliance and allows an audit once a year after prior agreement, primarily by written questionnaire.
5. Security measures
- Data stored in the EU (Frankfurt), encrypted; network traffic encrypted (HTTPS/TLS).
- Workshops' data separated by row level security, checked by automated tests on every change.
- Roles and permissions within the workshop.
- Daily backups kept for 7 days, encrypted (AES256) before they leave the Provider's systems and stored encrypted by GitHub; only the Provider holds the key.
- Quote links sent to customers are unique, unguessable and show only that quote.
- Administrator access only for support, at the Controller's request.
- Regular updates, only components with trusted licences.
6. Transfers outside the EU
Only where marked in Annex 2 (storage of the encrypted daily backup at GitHub; the text of problem reports when a member of the Controller's staff sends a problem or an idea, at GitHub, including any customer data written into it, which should therefore be left out; the AI provider, only if the Controller switches it on), covered by the EU–US Data Privacy Framework or the European Commission's standard contractual clauses (SCC).
7. Liability
Article 82 GDPR and clause 9 of the Terms apply.