Data Processing Addendum

1. Status and subject matter

This addendum is concluded between the Studio as the controller and Detailero s.r.o. as the processor and forms part of the professional service agreement . It applies to personal data entered by the Studio into the CRM for its own business.

2. Duration, nature and purpose

The processing lasts for the duration of the Studio's account and 30 days after its deletion, until the data is permanently erased. Its nature is storage, organization, retrieval, display, modification on the Studio's instruction, creation of documents, sending of messages, backup and erasure. Its purpose is the operation of the CRM, calendar, jobs, invoicing, communication and staff management.

3. Categories of data subjects and data

• Clients and contact persons of the Studio – identification, contact, address and billing data, business history, notes and communication preferences.
• Clients' vehicles – license plate, VIN, make, model, year, color, link to the client and job history.
• Employees and collaborators of the Studio – name, contact, role, access, assigned jobs and availability or attendance by individual days.
• Recipients of documents and messages – e-mail, content and delivery or unsubscribe status.

The processing of special categories of data is not intended. The Studio must not enter them into free-text fields unless this is necessary, lawful and Detailero has given its prior written consent.

4. Controller's instructions

Detailero processes the data only on documented instructions from the Studio contained in the agreement, the settings and authorized support instructions. If it considers that an instruction infringes a legal regulation, it will inform the Studio, unless prohibited by law.

5. Obligations of Detailero

• ensure the confidentiality of persons with access;
• adopt appropriate technical and organizational measures;
• assist the Studio with data subject requests, security assessments, incidents and any impact assessment;
• keep the necessary records and allow a reasonable audit;
• inform the Studio of a personal data breach affecting its personal data without undue delay after becoming aware of it;
• after termination, delete or return the data at the Studio's choice, unless prohibited by law.

6. Obligations of the Studio

• have a legal ground and fulfill the information obligation towards clients and employees;
• enter only adequate and accurate data and keep them up to date;
• manage roles, passwords and departing staff members;
• respect unsubscribes from marketing and keep evidence of consent or of the customer exception;
• not use free-text notes for disproportionate or discriminatory profiling of persons;
• promptly report security incidents and account misuse.

7. Security measures

• encryption of transmission using HTTPS/TLS;
• separation of the data of individual Studios by means of database permissions;
• individual accounts and roles, restricted administrator access;
• EU database region, daily backups with a retention of seven days;
• management of secret keys outside the source code, updates and incident monitoring;
• a recovery procedure and regular verification of access rights and critical flows.

8. Subprocessors

The Studio grants a general written authorization to engage subprocessors. Detailero will notify any intended material change in advance and allow the Studio to raise a reasoned objection.

• Supabase – database, authentication, file storage and backups, EU region;
• Laravel Cloud – hosting of the application interface, EU region;
• Cloudflare – hosting of the web application, security, DNS/CDN and form protection;
• Vercel – hosting of the website and internal administration;
• Resend – e-mail delivery;
• Stripe – subscriptions and related payment metadata;
• PostHog – analytics of the use of the app by the Studio's staff members;
• Google Maps Platform, CARTO and Photon – maps and address search;
• Google Firebase and Apple – push notifications.

The complete and continuously updated overview is in the List of Subprocessors . Detailero imposes on subprocessors data protection obligations corresponding to this addendum. It is liable to the Studio for their performance to the extent provided by the GDPR.

9. Transfers outside the EEA

If a subprocessor processes data outside the European Economic Area (EEA), Detailero uses a valid transfer mechanism, in particular an adequacy decision or standard contractual clauses, and supplementary measures as needed. The country and the safeguard used for each subprocessor are stated in the List of Subprocessors ; Detailero will provide the Studio with a copy of the safeguards on request.

10. Data subject requests

If Detailero receives a request concerning CRM data, it will forward it to the Studio without undue delay and will not respond to it on the merits without the Studio's instruction, unless required by law. It provides technical assistance to a normal extent within the price of the service; exceptionally demanding work may be charged after prior agreement.

11. Incidents

As soon as Detailero becomes aware of a personal data breach affecting the Studio's personal data, it will inform the Studio without undue delay, even if the investigation has not yet been concluded. It will provide the information it has at that moment: the nature of the breach, the categories and approximate number of persons and records concerned, the likely consequences, the measures taken or proposed and a point of contact. What it does not yet know, it will add gradually as soon as it finds out. Notification to the supervisory authority and to data subjects is ensured by the Studio as the controller; Detailero will provide it with assistance in doing so.

12. Audits

Detailero will provide the Studio with the information necessary to demonstrate compliance with Article 28 GDPR and will allow audits and inspections conducted by the Studio or by an auditor mandated by the Studio. As a rule, verification is carried out no more than once a year, and first by means of documentation and a remote assessment. This limitation does not apply if there has been a personal data breach affecting the Studio's personal data, if verification is requested by a supervisory authority or another public authority, or if the Studio has reasonable grounds to suspect that Detailero is not handling its data in accordance with this addendum. An audit must not endanger the security of other customers or trade secrets, and its scope and date will be agreed in advance.

13. Termination and erasure

After the service ends, Detailero will, at the Studio's choice, enable the available export or erase the data. After the Studio's account is deleted, it will permanently remove the active CRM data once 30 days have passed, during which the data can be restored or invoices handed over at the Studio's request; copies in rotating backups will be overwritten within seven days of erasure at the latest and will not be routinely restored other than for restoring the entire system after an incident. Data subject to mandatory retention will be isolated.

14. Precedence and contact

In the event of a conflict between this addendum and the general terms and conditions, this addendum takes precedence in matters of personal data processing. The processor's contact is info@detailero.com; the controller's contact is the person specified by the Studio in the account.

15. Allocation of responsibility

The Studio is responsible for the lawfulness of instructions, the legal bases, transparency, accuracy and retention rules of CRM data, the selection of recipients and the lawfulness of messages. Detailero is responsible for fulfilling its own obligations as a processor. No contractual arrangement changes the rights of data subjects or the powers of the supervisory authority.

16. Return of data and export limitations

Detailero will provide the available standard exports, if they are implemented in the product. If a complete export is not available, the Studio may download invoices before termination and ask support for reasonable assistance.

17. Requests from authorities and confidentiality

Detailero ensures that persons authorized to process CRM data are bound by confidentiality. It will inform the Studio of a legally binding request from an authority concerning CRM data before disclosure, unless prohibited by law, and will provide only the necessary scope.

18. Costs of extraordinary assistance

Normal assistance under Article 28 GDPR is included in the service. An exceptionally extensive audit, an individual export or a repeated request beyond the normal scope may be charged according to demonstrable costs after prior notice, provided that this does not prevent the effective exercise of a statutory obligation. Verification for reasons for which Article 12 does not apply the annual limitation is not charged.

19. Restoration from backups

Restoring a backup may temporarily return already deleted data to an isolated recovery copy. Detailero ensures that they are not routinely used again and are deleted again in accordance with the erasure process. A backup does not serve as the Studio's archive or as an individual option to restore each record.

20. Standard of evidence

Detailero may demonstrate compliance through security documentation, an overview of measures, the result of a relevant independent audit or targeted answers. The Studio must not test production systems, access other customers' data or carry out a penetration test without prior written permission.

Annex A – documented instructions

The instructions include operations triggered by authorized users of the Studio in the app, the settings of automatic notifications, the generation and sending of documents, support requests verified by an authorized person and deletion of the account. An instruction relating to a commercial communication does not relieve the Studio of responsibility for its lawfulness.

Annex B – minimum security standard

• tenant separation and regular verification of database access rules;
• strong authentication of administrators, the principle of least privilege and prompt removal of access;
• encryption of transmission, secure management of secret keys and change management;
• daily backups, recovery testing and seven-day rotating retention according to the confirmed production configuration;
• recording and investigation of incidents, dependency updates and protection against abuse;
• confidentiality of persons, controlled support access and auditing of administrator interventions.

Annex C – changes to subprocessors

The current public List of Subprocessors is a separate document. Detailero will notify the Studio in advance, by e-mail or in the app, of a new CRM subprocessor. An objection must be specific and based on the protection of personal data; if the parties do not agree on a solution, the Studio may terminate the service before the change takes effect.