Data Processing Agreement

The Processor processes personal data on the Controller’s behalf solely to provide, secure, maintain and support AutoDeck DMS: CRM, inventory, sales, documents, communications, reporting and the dealership public website.

Processing starts at service activation and lasts for the Main Agreement plus the return and deletion period in Annex 3. Operations include collection through the interface provided to the Controller, storage, retrieval, transmission to authorised destinations, export, restriction and deletion.

The data processed is the data entered or generated through the Controller’s configured use.

• Data: names, contact details, addresses, preferences and consent records, CRM communications and notes, appointments, vehicle and transaction data, contractual and fiscal documents, user accounts, roles, access logs and IP addresses.
• The personal numeric code (CNP) and identity-document data are processed only where a legal obligation of the Controller requires them, for example the vehicle transfer contract and registration or anti-money-laundering checks, on the basis of GDPR Art. 6(1)(c) and Article 4 of Romanian Law 190/2018.
• Data subjects: dealership customers and prospects, representatives of corporate customers, dealership staff, contractors and users, and visitors to the dealership public website.
• Special-category or criminal-offence data is not entered unless the Controller documents necessity, lawful basis and additional instructions.

The Processor processes the data only on documented Controller instructions, including for international transfers. The Main Agreement, authorised configuration and actions in the platform, and agreed written directions are documented instructions.

If Union or Romanian law requires other processing, the Processor informs the Controller first unless the law prohibits it. If an instruction appears to infringe data-protection law, the Processor informs the Controller immediately and may suspend it pending clarification.

• The Controller determines purposes and lawful bases, informs data subjects, answers their requests and sets retention periods.
• The Controller gives access only to authorised users and keeps credentials confidential.

The Processor gives access to the data only to people who need it for the service and who are bound by confidentiality, which continues after their access ends.

The Processor applies the technical and organisational measures in Annex 2. The Controller applies the measures within its control, including user administration and multi-factor authentication.

The Controller gives general written authorisation for the sub-processors in Annex 1A. The Processor gives at least 30 days’ written notice before adding or replacing a sub-processor, and the Controller may raise a reasoned objection.

Each sub-processor is bound by contract to equivalent data-protection obligations, and the Processor remains liable to the Controller for their performance. If a justified objection cannot be resolved, the Controller may terminate the Main Agreement.

The Processor helps the Controller, through platform functions and reasonable measures, to answer requests for access, rectification, erasure, restriction, portability and objection. A request received directly is forwarded to the Controller without delay.

The Processor assists the Controller with security of processing, breach notification, informing data subjects, impact assessments and prior consultation.

The Processor notifies the Controller of any breach affecting the Controller’s data without undue delay after becoming aware of it, with the nature of the incident, approximate categories and volumes, likely consequences, measures taken and a contact point, so that the Controller can notify the authority within 72 hours.

After the service ends, the Processor returns or deletes the data as set out in Annex 3, except data that Union or Romanian law requires it to keep. Backups expire as set out in Annex 3 and are not used for any other purpose meanwhile.

The Processor provides the information needed to demonstrate compliance with Article 28 and allows audits, including inspections, by the Controller or an auditor it mandates. Audits are ordinarily announced 30 days in advance and must not compromise other customers’ data; this does not prevent an urgent audit after an incident or at the authority’s request.

The Controller’s data, files and backups stay in the deployment of its account’s region, hosted in Germany (EU). An international transfer takes place only on documented Controller instructions and with a valid mechanism under GDPR Articles 44–49. Annex 1 states the location and basis of each transfer; Standard Contractual Clauses are those adopted by the European Commission.

Romanian and applicable EU law govern this agreement. The competent supervisory authority in Romania is ANSPDCP. Amendments are valid only in writing.