Data Processing Agreement (DPA)

Last updated: June 2026.

This Data Processing Agreement ("DPA") applies when CARSGEST processes personal data on behalf of the Customer, in the context of the Service, under Article 28 of the GDPR. It forms an integral part of the Terms and Conditions.

1. Roles of the parties

The Customer is the controller of the data managed in the software (e.g. its own customers’ and drivers’ data). CARSGEST acts as processor for the processing it carries out on the Customer’s behalf (e.g. licence validation and support). Where CARSGEST is installed and hosted on the Customer’s own server, the operational data remains under the Customer’s control and infrastructure.

2. Subject matter, nature and purpose

Processing is solely for providing the Service: software provision, licence validation, billing and support. CARSGEST processes data only on the Customer’s documented instructions, save for legal obligations.

3. Data categories and data subjects

Customer contact and account data; technical data (domain, IP, logs). For processing on the Customer’s behalf, data subjects may include the Customer’s end customers and staff, as applicable.

4. Processor obligations

• Process data only on the Customer’s instructions.
• Ensure the confidentiality of those who process the data.
• Apply appropriate technical and organisational measures (Art. 32 GDPR).
• Assist the Customer with data-subject rights and its legal obligations.

5. Sub-processors

The Customer authorises the use of sub-processors (e.g. hosting, email, payments). CARSGEST undertakes to impose equivalent data-protection obligations on them and to inform of material changes.

6. Security

Measures such as secret encryption, role-based access control, strong authentication, HTTPS connections and audit logs are applied, appropriate to the risk.

7. Data breaches

CARSGEST will notify the Customer without undue delay after becoming aware of a breach affecting data processed on its behalf, providing the necessary information.

8. Assistance and audits

CARSGEST makes available the information needed to demonstrate compliance with this DPA and cooperates with reasonable audits, subject to confidentiality.

9. Deletion and return

On termination of the Service, CARSGEST deletes or returns the data processed on the Customer’s behalf, save where retention is required by law.

10. International transfers

Any transfer outside the EEA is carried out with appropriate safeguards, in accordance with the GDPR.

11. Contact

For matters relating to this DPA, contact us via the Contact page.