Data Processing Agreement (DPA)

This Personal Data Processing Agreement (hereinafter, the “DPA”) forms an integral part of the Public Offer (Terms of Use of the Evimarko service) and is concluded between a user of the Service (hereinafter, the “Studio”, the controller of personal data) and [details to be provided] (hereinafter, “Evimarko”, the processor of personal data) at the moment the Terms are accepted. This DPA is concluded in accordance with Articles 2 and 4 of the Law of Ukraine “On Personal Data Protection” (hereinafter, the Law) and Article 28 of Regulation (EU) 2016/679 (GDPR).

1. Roles of the parties

1. The Studio is the controller of the personal data of its clients, their representatives and its own employees which it enters into the Service or receives through it (online booking, messengers, the studio’s website, integrations). The Studio independently determines the purpose, scope and means of processing such data.
2. Evimarko is the processor and processes such data solely on behalf of and on the documented instructions of the Studio, to the extent necessary to provide the Service.
3. The Studio’s instructions consist of: the Terms and this DPA; actions of the Studio and its employees in the Service (entering, changing, deleting data, configuring mailings, integrations, online booking); written requests from the Studio to Evimarko’s email. If, in Evimarko’s opinion, an instruction infringes the law, Evimarko shall notify the Studio thereof and may refrain from carrying it out.

2. Subject matter, nature and duration of processing

• Nature of processing: collection (through forms and integrations), recording, storage, organisation, alteration, retrieval, consultation, transfer according to the Studio’s settings (notifications to clients, messengers, fiscalisation), depersonalisation, erasure, backup.
• Purpose: providing the Studio with CRM functions — records of clients, bookings, orders, vehicles, vehicle check-in, estimates, payments, warranties, and communication with clients.
• Categories of data subjects: the Studio’s clients and prospective clients, their representatives, and the Studio’s employees.
• Categories of data: full name, telephone number, email, language; vehicle data (registration plate number, VIN, make, model); address; order and payment history; photos; signatures; correspondence; call recordings (where an integration is in place); notes. The Studio does not enter special categories of data (health, biometric data for identification purposes, etc.) into the Service.
• Duration: for the term of the Terms and until the data is deleted in accordance with Section 8.

3. Obligations and warranties of the Studio

1. The Studio warrants that it has a lawful basis for processing each item of personal data that it enters into the Service or collects through it, and that it shall, independently and at its own expense:
   • obtain the necessary consents of clients (in particular, for photographs of vehicles, for mailings and advertising messages, and for correspondence via messengers), and retain evidence of such consents;
   • inform clients about the processing of their data (Article 12 of the Law; Articles 13–14 GDPR), including the fact that the Evimarko Service is used for such processing;
   • handle clients’ requests concerning their rights (access, rectification, erasure, etc.);
   • comply with the rules for sending messages (no spam, with an option to unsubscribe) and with the rules of messengers;
   • not enter excessive data or data not required for the purpose of processing.
2. The Studio is responsible for the lawfulness of the collection of its clients’ data and for its instructions. The Studio shall indemnify Evimarko for losses, fines and expenses (including legal costs) arising from claims by data subjects or public authorities caused by the Studio’s breach of the law or of this DPA.
3. The Studio is responsible for the actions of its employees in the Service, for granting them access rights and for keeping passwords secure.

4. Obligations of Evimarko

1. To process data only on the documented instructions of the Studio, except where processing is required by law (in which case Evimarko shall inform the Studio, unless prohibited from doing so).
2. To ensure that persons with access to the data are bound by an obligation of confidentiality.
3. To implement technical and organisational security measures in accordance with Article 24 of the Law and Article 32 GDPR: encryption of connections (TLS); encryption of sensitive fields in the database; storage of passwords in hashed form; two-factor authentication; isolation of the data of different studios; role-based access; activity log; backups; hosting of servers in the EU (Poland).
4. To assist the Studio (taking into account the nature of processing) in responding to data subjects’ requests, carrying out impact assessments and consulting the supervisory authority — within the existing functions of the Service; additional assistance may be chargeable.
5. To notify the Studio of a personal data breach (leak) without undue delay and, where feasible, within 48 hours of Evimarko becoming aware of it, describing the nature of the breach, its likely consequences and the measures taken.
6. Not to use the data of the Studio’s clients for its own purposes, not to sell it and not to transfer it for advertising. Evimarko may compile depersonalised aggregated statistics from which it is impossible to identify a person or the Studio.

5. Subcontractors (sub-processors)

1. The Studio grants general authorisation to engage sub-processors: a hosting provider in the EU, an email delivery service, backup services, as well as services that the Studio connects itself (messengers, SMS, telephony, fiscalisation, payment services) — with respect to the latter, the Studio acts at its own discretion and subject to the rules of those services.
2. Evimarko imposes on sub-processors data protection obligations no less stringent than those in this DPA and is liable to the Studio for their actions within the limits set by the Terms.
3. Evimarko shall give notice of any replacement or addition of a sub-processor (other than those chosen by the Studio) in the Service or by email. If the Studio has reasonable objections, it may stop using the Service before the changes take effect — this is its sole remedy.

6. International transfers

Data is stored on servers in the EU (Poland). Data is transferred outside the EEA and Ukraine only according to the Studio’s settings (for example, through messengers it has connected) or subject to the safeguards provided for by Article 29 of the Law and Chapter V GDPR (adequacy decisions, EU standard contractual clauses).

7. Audit

Upon the Studio’s written request, Evimarko shall provide the information necessary to demonstrate compliance with this DPA (a description of security measures, a list of sub-processors). An on-site inspection may take place no more than once a year, with at least 30 days’ notice, during business hours, at the Studio’s expense, subject to the signing of a non-disclosure agreement and without access to the data of other studios.

8. Return and deletion of data

During the term of the Terms, the Studio may export and delete data in the Service itself. After termination of the Terms, data is retained for 30 calendar days for export at the Studio’s request and is then deleted; backups are overwritten within the following 30 days. Evimarko may retain data for longer only where required by law.

9. Liability and term

1. Evimarko’s liability under this DPA is limited in the same way as set out in Section 9 of the Terms (the amount paid for the last month), to the extent permitted by law.
2. This DPA remains in force for as long as the Terms are in force and, with respect to data deletion and confidentiality, until the relevant obligations have been fully performed.
3. In the event of any conflict between the Terms and this DPA concerning the processing of personal data, this DPA shall prevail.

10. Processor’s details

[details to be provided]
Individual tax number (RNOKPP) / EDRPOU code: [details to be provided]
Address: [details to be provided]
Email: [email protected]
Phone: [details to be provided]