Data Processing Agreement

The Processor processes personal data solely to provide, secure, maintain and support AutoDeck DMS, including CRM, inventory, sales, documents, communications, reporting and the dealership public website. Processing lasts for the Main Agreement and the limited return, deletion or legally required retention period. Operations include collection through Controller-configured interfaces, organisation, storage, retrieval, authorised transmission, export, restriction, anonymisation and deletion.

Data is limited to information entered or generated through the Controller’s configured use.

• Data: identity and contact details, addresses, fiscal or identity identifiers where required, preferences and consent records, CRM communications and notes, appointments, vehicle and transaction data, contractual/fiscal documents, billing data, user accounts and roles, access/security logs, device identifiers and IP addresses.
• Data subjects: dealership customers and prospects, contacts and representatives of corporate customers, dealership staff, contractors and users, and visitors to the dealership public website.
• Special-category or criminal-offence data must not be entered unless the Controller documents necessity, lawful basis and additional instructions.

The Processor acts only on documented Controller instructions, including for international transfers. The Main Agreement, authorised configuration and actions in the service, support tickets and agreed written directions are instructions. If Union or Romanian law requires other processing, the Processor informs the Controller first unless legally prohibited. The Processor promptly flags an instruction it believes infringes data-protection law and may suspend it pending clarification.

• The Controller determines purposes and lawful bases, provides notices, handles data-subject requests and sets lawful retention periods.
• The Controller grants access only to authorised users, protects credentials and does not request unlawful or disproportionate processing.

Access is limited to authorised people who need it to provide the service and who are bound by statutory or contractual confidentiality. Access rights are role-based and removed when no longer needed; confidentiality survives termination.

The Processor maintains risk-appropriate technical and organisational measures described in Annex 2 to protect confidentiality, integrity, availability and resilience, restore availability, and assess control effectiveness. The Controller applies the controls within its responsibility, including user administration, multi-factor authentication and secure endpoints.

The Controller gives general written authorisation for Annex 1 sub-processors. The Processor gives at least 30 days’ written notice before adding or replacing a sub-processor that will process Controller data, allowing a reasoned data-protection objection. Equivalent relevant obligations are imposed by contract, and the Processor remains liable to the Controller for sub-processor performance. If a justified objection cannot reasonably be resolved, the parties limit the affected service or use termination rights under the Main Agreement.

Taking account of the processing, the Processor assists through product functions and reasonable measures with access, rectification, erasure, restriction, portability and objection requests. A request received directly is forwarded promptly; the Processor does not answer for the Controller without instruction or legal duty.

The Processor reasonably assists with processing security, breach notification, notices to data subjects, impact assessments and prior consultation. It notifies the Controller without undue delay after becoming aware of a breach affecting Controller data and supplies available details on nature, approximate categories/volumes, likely consequences, mitigation and a contact point. It documents the incident and cooperates with applicable deadlines.

At the Controller’s choice after termination, the Processor returns data in an available export format or deletes it and its copies, except where Union or Romanian law requires retention. Annex 3 records the choice and operational period. Backup deletion follows the documented retention cycle; isolated copies are not used for another purpose. Fiscal, accounting or other legally held evidence is retained only for the required period with restricted access.

The Processor provides information needed to demonstrate Article 28 compliance and permits reasonable audits by the Controller or its independent auditor. Ordinarily, audits receive 30 days’ notice, occur during business hours, protect other customers and security, and have exceptional reasonable costs agreed in advance. These limits do not prevent an urgent post-incident or supervisory-authority audit.

Romanian tenant operational data is hosted in the EU region. Any EEA export requires documented Controller instructions and a valid Articles 44–49 mechanism, such as adequacy, applicable Standard Contractual Clauses or Binding Corporate Rules, with supplementary measures where a transfer assessment requires them. Global email, SMS, payment or legacy-storage providers may involve international access or transfers; the owner must confirm active providers and safeguards before signature.

Romanian and applicable EU law govern this agreement. The Romanian supervisory authority is ANSPDCP, without limiting another authority’s competence under GDPR. Amendments must be written. If a provision is unenforceable, the remainder continues and the parties replace it with a lawful provision of equivalent purpose.