Data Processing Agreement

1. Parties and scope

This DPA applies to personal data that the Customer and its users enter into, or generate in, the Service ("Customer Personal Data"). It does not cover data for which Spannr is itself the controller (such as account and billing information), which is covered by the Privacy Policy. The Customer accepts this DPA by accepting the Terms of Service.

2. Details of the processing

3. Instructions

• Spannr processes Customer Personal Data only on the Customer's documented instructions, which are: the Terms, this DPA, and the Customer's use and configuration of the Service. Spannr may also process it where required by EU or Member State law, in which case it will tell the Customer first unless the law forbids this.
• Spannr will tell the Customer if, in its opinion, an instruction infringes data protection law.
• The Customer is responsible for the lawfulness of the processing it instructs, including having a lawful basis to collect its customers' data and giving them the information required by GDPR Articles 13 and 14.

4. Confidentiality

Spannr ensures that everyone it authorises to process Customer Personal Data is bound by confidentiality, and limits access to those who need it to provide, support or secure the Service.

5. Security

Spannr implements appropriate technical and organisational measures under GDPR Article 32, including:

• encryption in transit (HTTPS/TLS) for all access to the Service, and encryption at rest provided by our hosting providers;
• logical separation of each Customer's data, enforced on every request;
• role-based access within each workshop (for example mechanics cannot see customer phone numbers; dealers see only their own vehicles);
• passwords stored only as salted hashes; rate limiting of sign-in attempts; immediate removal of access for deactivated users;
• photos stored under unguessable addresses; uploads limited in size and checked by file type;
• backups and recovery capability through our database provider;
• keeping software dependencies up to date and reviewing changes before release.

6. Sub-processors

The Customer gives Spannr general authorisation to use sub-processors. Spannr imposes data protection obligations on each sub-processor that are no less protective than this DPA, and remains responsible for their performance. Current sub-processors:

Spannr will give at least 30 days' notice (by email or in the app) before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that period; if we cannot address the objection, the Customer may end the subscription and receive a refund of prepaid fees for the period after the change.

Stripe Payments Europe, Limited processes payment data as an independent controller and is not a sub-processor under this DPA. Voice dictation uses the speech recognition built into the user's own browser, which the user's browser provider operates independently of Spannr.

7. International transfers

Spannr will only transfer Customer Personal Data outside the European Economic Area where it is protected as required by Chapter V of the GDPR, for example by an adequacy decision, the EU-U.S. Data Privacy Framework, or the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), with supplementary measures where needed.

8. Assistance and data subject requests

• Taking into account the nature of the processing, Spannr will help the Customer respond to requests from data subjects exercising their rights. Much of this the Customer can do directly in the Service (viewing, correcting and deleting records). If Spannr receives a request directly, it will pass it to the Customer without undue delay and will not respond itself except to direct the person to the Customer.
• Spannr will provide reasonable help with the Customer's obligations on security, breach notification, data protection impact assessments and prior consultation (GDPR Articles 32 to 36), taking into account the information available to Spannr.

9. Personal data breaches

Spannr will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will include the information the Customer needs to meet its own obligations under GDPR Articles 33 and 34, as far as it is available, and Spannr will take reasonable steps to contain the breach and limit its effects.

10. Deletion or return at the end

When the Customer's use of the Service ends, the Customer may request an export of its data within 30 days. After that, Spannr will delete Customer Personal Data from the live Service, and from backups within a further 30 days, unless EU or Member State law requires it to be kept. A workshop deleted at the Customer's request is removed immediately from the live Service, including its photos.

11. Information and audits

Spannr will make available to the Customer the information reasonably necessary to demonstrate compliance with this DPA and Article 28 GDPR, and will allow for and contribute to audits, including inspections, by the Customer or an auditor it appoints. Audits must be on reasonable notice (at least 30 days unless required sooner by a supervisory authority), during business hours, no more than once a year, under confidentiality, and at the Customer's cost. Spannr may first answer by providing documentation and sub-processors' certifications.

12. Liability, term and precedence

• The limitations of liability in the Terms of Service apply to this DPA, to the extent permitted by law.
• This DPA lasts for as long as Spannr processes Customer Personal Data.
• If this DPA conflicts with the Terms of Service on the processing of personal data, this DPA prevails.
• This DPA is governed by the laws of Ireland.
• Contact for data protection matters: privacy@spannr.ie.