Data Processing Agreement

1. Parties

The processor is MACET, s.r.o., registered office Nitrianska 32/189, 949 11 Nitra, Slovak Republic, company ID (IČO) 35953781, tax ID (DIČ) 2022057752, VAT ID SK2022057752, registered in the Commercial Register of the District Court Nitra, section Sro, insert No. 17071/N (the “provider”).

The controller is the car dealer that created an organisation in carsLOG (the “dealer”). Its identification details are in the organisation settings.

2. Subject, nature and purpose

The provider processes personal data on behalf of the dealer solely to provide the carsLOG service: vehicle stock, customers, enquiries, deals, contracts, invoices and cash records, automated reading of documents, sending emails and SMS, storage and backup.

3. Duration

This agreement applies for as long as the dealer uses the service and until the data is deleted or returned under this agreement.

4. Categories of data and data subjects

Data subjects are mainly the dealer’s customers and prospects, sellers, consignors, test drive drivers and the dealer’s employees. The data includes in particular:

• name, address, date of birth, phone and email,
• identity document and driving licence numbers, if the dealer records them,
• details of deals, payments, vehicles and signatures on documents,
• communication with the dealer, such as enquiries and chat on the dealer’s website.

5. Dealer’s instructions

The provider processes data only on the dealer’s documented instructions. Instructions are this agreement and the actions the dealer takes in the service. If the law requires other processing, the provider tells the dealer in advance unless the law forbids it. If the provider believes an instruction breaches data protection law, it says so without undue delay.

6. Dealer’s obligations

The dealer is responsible for having a legal basis for the processing and for informing data subjects, including about the processing of a document photo by a sub-processor under this agreement.

7. Confidentiality and security

People with access to the data at the provider are bound by confidentiality. The provider applies appropriate technical and organisational measures, in particular:

• separation of each dealer’s data at database level,
• encrypted connections and encrypted backups,
• two-factor authentication for the provider’s staff,
• recording of important actions in an audit log.

8. Sub-processors

The dealer gives general authorisation to engage further processors. The provider imposes the same data protection obligations on them and tells the dealer about intended changes in advance so that the dealer can object. At the date of this draft they are:

• Hetzner Online GmbH, Germany: server and database, data centre in the EU,
• Backblaze, Inc., USA: encrypted backup copy, data centre in Amsterdam, EU,
• Anthropic PBC, USA: automated reading of documents, draft listing texts and chat replies,
• Webglobe, a.s., Slovakia: email delivery,
• TOPefekt s.r.o. (BulkGate service), Czechia: SMS delivery,
• Stripe: payment of the subscription and credits, processes only the dealer’s data as the payer, not its customers’ data.

9. Services the dealer switches on

If the dealer connects an accounting service, a social network or a listing portal, data is passed there on the dealer’s instruction and the dealer deals with that provider on its own behalf.

10. Transfers outside the EU

The transfer to the USA concerns Anthropic PBC and takes place under standard contractual clauses. carsLOG does not store the document photo. It is discarded after reading and only the details the user confirms in the form remain.

11. Assistance

The provider helps the dealer meet its obligations to data subjects. The service offers export and anonymisation of a customer’s data for this. The provider also gives reasonable help with security, impact assessments and consultation with the supervisory authority.

12. Personal data breach

The provider informs the dealer of a personal data breach without undue delay after becoming aware of it and gives the dealer the information it has.

13. Deletion and return of data

Before the agreement ends the dealer can export its data in the service. After it ends the provider deletes or returns the data as the dealer decides, unless the law requires it to be kept. The final wording of this agreement will set the time limit.

14. Audit

The provider makes available the information needed to demonstrate compliance and allows audits by the dealer or an auditor it appoints, after reasonable prior notice.

15. Acceptance

The agreement is concluded by ticking the consent box at registration. The provider records the document version, time, user and organisation.