Data processing agreement

1. Subject

The processor processes personal data on behalf of the controller only to provide WashDesk: orders and queue, bookings, customers, cash desk, staff, subscriptions and notifications to customers.

2. Data and data subjects

• the car wash's customers: name, phone, email (optional), licence plate and car details, visits and amounts, photos of the car, SMS and email messages and browser notifications;
• the car wash's staff: name, role, shifts, commission and daily wage.

No special categories of data (Art. 9 GDPR) are processed.

3. Term

The agreement applies for as long as the car wash uses WashDesk.

4. Processor's obligations

• processes the data only on documented instructions from the controller: this agreement and the car wash's actions in WashDesk. If an instruction infringes the GDPR, it informs the controller immediately;
• people with access to the data are bound by confidentiality;
• applies technical and organisational measures (Art. 32 GDPR): a separate database per car wash, encrypted connections, passwords and PIN codes stored only as hashes, role-based permissions checked on the server, limits on login attempts and nightly backups with a tested restore;
• helps the controller answer customer requests: export and erasure of a customer's data from “Customers”, and the automatic deletion periods;
• assists with data security, impact assessments and consultations with the supervisory authority;
• notifies the controller without undue delay and within 48 hours of becoming aware of a personal data breach;
• on termination deletes the data within 30 days, or returns it before that on request, unless the law requires it to be kept; it disappears from backups within 14 days after that;
• makes available the information needed to demonstrate compliance with Art. 28 GDPR and allows audits.

5. Sub-processors

The controller gives general authorisation for these sub-processors:

• Hostinger: server and database, Frankfurt, Germany (EU);
• LINK Mobility Bulgaria EAD, UIC 131384920 (SMSAPI.bg), Bulgaria (EU): sending SMS messages;
• Sendinblue SAS (Brevo), Paris, France (EU): sending emails.

The processor notifies the controller of a new sub-processor at least 14 days in advance, and the controller may object. Sub-processors have the same data protection obligations. The data is not transferred outside the EU and the EEA.

6. Controller's obligations

The controller has a legal basis for the processing, informs its customers (it may use the car wash's “Personal data” page in WashDesk), answers their requests and enters only the data that is needed.

7. Conclusion

The agreement is concluded electronically: on registration the owner confirms that they accept it on behalf of the car wash. The date and version are stored in WashDesk. Bulgarian law applies.