Data Processing Agreement

Annex 1 to the Terms, with the content required by Article 28(3) GDPR. Version: 2026-12-10 (in force together with the Terms, clause 12)

Translation for information. Unless the parties agree otherwise in writing, the Hungarian version prevails.

Parties: the Subscriber as controller (the "Controller") and the Provider as processor (the "Processor").

1. Subject and duration

The Processor processes the personal data of the Controller's customers and staff to provide the Garagevo Service, for the term of the subscription and until deletion under clause 10.4 of the Terms.

2. Nature and purpose

Storage, organisation, retrieval, display, transmission on the Controller's instruction (for example sending a quote to the customer, creating an invoice in the connected invoicing service), backup and deletion. Purpose: keeping the workshop's work orders, quotes, customer and vehicle records.

The program does not keep the photos and signatures of a work order indefinitely: retention follows the actual warranty period of the work order and the time available for asserting legal claims related to it, according to the Controller's settings. In a dispute the Controller may exclude the photos and signatures of a work order from deletion with a retention hold, until the hold is lifted. These are the Controller's instructions on retention.

3. Data subjects and categories of data

The data subjects include the Subscriber's customers, their representatives and contact persons, and the owners, keepers and actual users of the vehicles serviced, including the drivers of company vehicles.

The program does not ask for special categories of data (health, criminal etc.) and the Controller may not record them.

4. Obligations of the Processor

4.1. Processes data only on the Controller's documented instructions: the Terms, this agreement and the Controller's actions in the program. It informs the Controller immediately if an instruction infringes the law.

4.2. Binds its staff with access to the data to confidentiality.

4.3. Takes the measures of Article 32 GDPR (clause 5).

4.4. Uses only the sub-processors listed in Annex 2, for the purpose stated there. It notifies the Controller (the owners) by e-mail of a new sub-processor, or of an existing sub-processor used for a new purpose, at least 8 days before the actual start of its use, and updates Annex 2 at the same time; the notice period is tied to the actual start, not to the acceptance of the Terms. The Controller may object within the notice period; failing agreement, it may terminate free of charge. Sub-processors are bound by the same obligations.

4.5. Assists the Controller with data subject requests (access, rectification, erasure, portability), mainly through search, editing, deletion and export in the program. Requests received directly are forwarded to the Controller.

4.6. Notifies the Controller of a personal data breach without undue delay and at the latest within 48 hours of becoming aware of it, with its nature, the categories of data, likely consequences and the measures taken.

4.7. Assists with data protection impact assessments and consultations with the authority, using the information available to it.

4.8. At the end of the contract makes the data available under clause 10.3 of the Terms, then deletes it under clause 10.4.

4.9. Provides on request the information needed to demonstrate compliance and allows an audit once a year after prior agreement, primarily by written questionnaire.

5. Security measures

• Data stored in the EU (Frankfurt), encrypted; network traffic encrypted (HTTPS/TLS).
• Workshops' data separated by row level security, checked by automated tests on every change.
• Roles and permissions within the workshop.
• Daily backups kept for 7 days, encrypted (AES256) before they leave the Provider's systems and stored encrypted by GitHub; only the Provider holds the key.
• Quote and intake links sent to customers are unique, unguessable, expire and show only that document.
• Only an automatically redacted copy of problem reports goes to GitHub (clause 6).
• Administrator access only for support, at the Controller's request.
• Regular updates, only components with trusted licences.

6. Transfers outside the EU

6.1. The Processor transfers personal data outside the EU (to the USA) only to the recipients below, for the purpose marked in Annex 2. It determines the appropriate safeguard for each recipient: if the recipient holds a valid EU–US Data Privacy Framework (DPF) certification for the transfer, that is the safeguard; if not, the European Commission's standard contractual clauses (SCC), with a transfer impact assessment (TIA) and supplementary measures. The Processor checks the DPF certification on the official list (dataprivacyframework.gov) before use and every year after, records the date of the check, and if the certification lapses it continues under the SCC or stops the transfer.

6.2. The Processor checked the recipients' statements on 5 November 2026, Microsoft's on 7 November 2026. On request it provides the Controller with the result of the DPF check, the transfer impact assessment and the contracts concerned.

7. Liability

Article 82 GDPR and clause 9 of the Terms apply.