Data Processing Agreement

1. Scope and parties

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Pitempo and the Customer and applies to all personal data that Pitempo processes on behalf of the Customer when providing the Service (“Customer Personal Data”). The Customer is the controller (or, where it acts on behalf of another controller, a processor) and Pitempo is the processor (or sub-processor). In the event of a conflict, this DPA prevails over the Terms with regard to Customer Personal Data.

2. Definitions

“Data Protection Law” means all laws on the protection of personal data that apply to the processing, including, where applicable, Regulation (EU) 2016/679 (GDPR), the UK GDPR and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection (FADP), the Turkish Law No. 6698 on the Protection of Personal Data (KVKK), the Brazilian General Data Protection Law (LGPD) and US state privacy laws such as the California Consumer Privacy Act (CCPA). Terms such as “controller”, “processor”, “personal data”, “processing”, “data subject” and “personal data breach” have the meaning given to them in the applicable Data Protection Law; under the KVKK, “controller” means “veri sorumlusu” and “processor” means “veri işleyen”. Other capitalised terms have the meaning given in the Terms.

3. Details of the processing

The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1.

4. Instructions

Pitempo processes Customer Personal Data only on documented instructions from the Customer, including with regard to transfers to third countries, unless it is required to do so by law; in that case Pitempo informs the Customer of that legal requirement before the processing, unless the law prohibits this. The Terms, this DPA and the Customer’s use and configuration of the Service are the Customer’s documented instructions. Pitempo informs the Customer immediately if, in its opinion, an instruction infringes Data Protection Law.

5. Confidentiality

Pitempo ensures that persons authorised to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that access is limited to what is necessary.

6. Security

Pitempo implements the technical and organisational measures described in Annex 2 to ensure a level of security appropriate to the risk. Pitempo may update these measures provided that the overall level of security is not reduced.

7. Sub-processors

The Customer gives Pitempo a general authorisation to engage sub-processors. Pitempo makes the current list of sub-processors, including their function and the location of processing, available to the Customer on request at privacy@pitempo.com. Pitempo informs the Customer of any intended addition or replacement of a sub-processor at least 30 days in advance by e-mail or in the Service. The Customer may object on reasonable data protection grounds within this period; if the parties cannot resolve the objection, the Customer may terminate the affected Service before the change takes effect. Pitempo imposes on each sub-processor, by contract, data protection obligations that provide at least the same level of protection as this DPA, and remains liable to the Customer for the performance of its sub-processors.

Services that the Customer engages directly and connects to the Service, for example the Customer’s own SMS provider account, are not sub-processors of Pitempo; the Customer instructs Pitempo to transmit to them the data required for the respective service.

8. International transfers

Pitempo transfers Customer Personal Data to a third country only in compliance with Data Protection Law.

To the extent that the processing involves a transfer subject to Chapter V of the GDPR, the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914 (“SCCs”) apply and are incorporated into this DPA by reference, as follows: Module Two applies where the Customer is a controller, and Module Three where it is a processor; clause 7 (docking clause) applies; under clause 9(a), option 2 (general written authorisation, with 30 days’ prior notice) applies; the optional wording in clause 11 does not apply; under clause 17 the SCCs are governed by the law of Ireland, and under clause 18 disputes are resolved by the courts of Ireland; the competent supervisory authority is determined in accordance with clause 13; Annexes I and II of the SCCs are completed with the information in Annexes 1 and 2 of this DPA, the Customer being the data exporter and Pitempo the data importer.

For transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner also applies. For transfers subject to the FADP, the SCCs apply with the adaptations required by Swiss law, and the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority. Where other Data Protection Law, for example the KVKK or the LGPD, requires a specific transfer instrument, the parties will put it in place before the transfer takes place.

9. Assistance

Taking into account the nature of the processing and the information available to it, Pitempo assists the Customer with appropriate technical and organisational measures in responding to requests from data subjects and in complying with the Customer’s obligations regarding security, personal data breaches, data protection impact assessments and prior consultation of supervisory authorities. If a data subject contacts Pitempo directly with a request concerning Customer Personal Data, Pitempo forwards the request to the Customer without undue delay and does not respond to it itself unless the Customer instructs it to do so.

10. Personal data breaches

Pitempo notifies the Customer without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. As far as the information is available, the notification describes the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. Pitempo takes reasonable steps to contain the breach and mitigate its effects. The Customer is responsible for notifying supervisory authorities and data subjects where required, for example within 72 hours under the GDPR and under the decisions of the Turkish Personal Data Protection Board.

11. Return and deletion

At the end of the provision of the Service, Pitempo enables the Customer to export Customer Personal Data as described in section 14 of the Terms and then deletes it within 30 days after the end of the retrieval period, unless the law requires its storage. Copies in backups are overwritten in the normal backup cycle and are not restored except to recover from a disaster. Pitempo confirms the deletion on request.

12. Information and audits

Pitempo makes available to the Customer all information necessary to demonstrate compliance with this DPA and with Article 28 of the GDPR, and allows for and contributes to audits, including inspections, conducted by the Customer or by an independent auditor mandated by the Customer. Audits must be announced at least 30 days in advance, take place during normal business hours without disrupting operations, be subject to confidentiality and take place no more than once a year, unless a personal data breach or a request from a supervisory authority gives reason for an additional audit. Pitempo may first respond to an audit request with written information and documentation. Each party bears its own costs.

13. US state privacy laws

To the extent that US state privacy laws apply, Pitempo acts as a “service provider” or “processor”. Pitempo does not sell or share Customer Personal Data; does not retain, use or disclose it for any purpose other than providing the Service to the Customer, including for any commercial purpose other than providing the Service, or outside the direct business relationship with the Customer; and does not combine it with personal data received from other sources, except as permitted by law. Pitempo complies with the obligations applicable to it under these laws, provides the level of privacy protection they require and notifies the Customer if it determines that it can no longer meet its obligations. The Customer may take reasonable and appropriate steps to stop and remediate unauthorised use of Customer Personal Data. Pitempo certifies that it understands and will comply with these restrictions.

14. Obligations of the Customer

The Customer is responsible for the lawfulness of the processing, including having a legal basis, informing data subjects (for example the customers whose vehicles it services) and obtaining any consents required. The Customer must not store special categories of personal data or data relating to criminal convictions in the Service.

15. Liability and term

The liability of each party under this DPA is subject to the limitations set out in the Terms, except to the extent that such limitation is not permitted by Data Protection Law or the SCCs. This DPA remains in force for as long as Pitempo processes Customer Personal Data.

Annex 1: Details of the processing

Annex 2: Technical and organisational measures

• Encryption in transit: all connections to the Service use HTTPS/TLS; e-mails are sent to our e-mail provider over an encrypted connection (STARTTLS).
• Access control: sign-in with a password and optionally with passkeys; passwords are stored only as salted hashes; one-time verification codes expire after 5 minutes; rate limits protect against brute-force attempts; sessions expire.
• Separation of Customers: each Customer’s data is isolated at database level with row-level security policies, so that one Customer cannot access the data of another.
• Authorisation: role-based permissions within each Account; prices, costs and profits are visible only to authorised roles, and fields that a role may not see are not sent to its browser at all.
• Accountability: audit records of changes (who, what, when) and sign-in history with masked IP addresses.
• Administrative access: server access only with SSH keys, with password and root login disabled; administration tools protected by additional access control; least-privilege principle.
• Credentials of connected services: credentials that the Customer enters for connected services, for example SMS provider accounts, are stored encrypted.
• Availability: daily database backups retained for 7 days and a documented restore procedure.
• Data minimisation and retention: automatic anonymisation of message logs after 12 months; automatic deletion of old notifications, of sign-in history after 180 days and of temporary import data after 30 days.
• Secure development: automated tests, including tests of Customer isolation and access rights, and dependency vulnerability audits before each release; prompt security updates.
• Incident management: a procedure for detecting, assessing, containing and notifying personal data breaches.