Data Processing Terms

1. Parties and subject matter

These terms are a data processing agreement under Art. 28 of Regulation (EU) 2016/679 (GDPR) and form part of the Terms of Service. They are concluded between the customer of the EuMo service (a workshop or an organisation) as the controller and the provider as the processor:

The processor processes the personal data that the controller or its users enter into the service solely for the purpose of providing it, for the duration of the contract and to the extent set out in these terms.

2. Data subjects and categories of data

• The workshop's customers and their contact persons — name, contact and billing details, company ID and VAT ID, vehicle data (VIN, registration plate), work orders, estimates and their approval (including the approver's name and IP address), signatures, photos and documents, invoices and payments, chat messages.
• The workshop's employees — name and contact details, role, attendance and time worked, the location of clocking in where the workshop requires it, and absences (e.g. holiday, sickness).
• Job applicants — contact details, answers and CV.
• Callers to the phone assistant — phone number, name, call transcript and message (we do not store audio recordings of calls).

The service does not require special categories of data. If the controller records the reason for an employee's absence (sickness), it is responsible for having a legal basis to do so.

3. Obligations of the processor

1. It processes personal data only on documented instructions from the controller; the controller's configuration and use of the service count as instructions. If, in its opinion, an instruction infringes the law, it informs the controller.
2. It ensures that persons authorised to process the data are bound by confidentiality.
3. It takes technical and organisational measures under Art. 32 GDPR, in particular encrypted transmission, role-based access control, storing passwords only as hashes, a tamper-proof log of security-relevant actions, and storing the database and files in data centres in the EU.
4. It assists the controller in responding to data subject requests. The service allows data to be searched, viewed and corrected, and the workshop's data to be exported (see section 7). The service does not let the controller delete the workshop's customers or their vehicles; the processor erases them or restricts their processing at the controller's request without undue delay, so that the controller can respond to the data subject within the time limit under Art. 12 GDPR.
5. It notifies the controller of a personal data breach without undue delay and no later than 48 hours after becoming aware of it, together with the information available to it.
6. It makes available to the controller the information necessary to demonstrate compliance with the obligations under Art. 28 GDPR and allows audits to a reasonable extent, with at least 30 days' notice and at the controller's expense.

4. Sub-processors

The controller grants general authorisation to engage sub-processors. As of the last update, they are:

We notify the controller by email at least 14 days in advance of any intended addition or replacement of a sub-processor. The controller may object on serious grounds; if the objection cannot be resolved, it may terminate the contract as of the date the change takes effect. We bind sub-processors to the same data protection obligations as these terms.

5. Transfers outside the EU

Some sub-processors are based in the USA. Transfers rely on the European Commission's adequacy decision (EU-U.S. Data Privacy Framework) or, for recipients that have not joined it, on standard contractual clauses approved by the European Commission.

6. Retention periods set in the service

• Job applications are deleted 6 months after the decision or after the job post is closed (the workshop may shorten this period); the CV of a hired applicant 30 days after hiring.
• Documents submitted to verify a vehicle or a company are deleted 90 days after the verification is resolved.
• Files uploaded to chat but not sent are deleted after 24 hours.
• We keep all other data for the duration of the contract, unless the controller deletes it earlier or asks for its erasure; after the contract ends we proceed in accordance with section 7.

7. End of processing

Data export. For the duration of the contract, and so also before it ends, the controller can export the workshop's data itself at any time in the workshop settings under Advanced → Full data export. The export contains customers, vehicles, work orders, invoices (including cancelled ones), payments, parts and stock levels and, if the user starting the export has the permission, employee attendance. It is generated in the background as a ZIP archive of CSV or JSON files and sent by email once ready. It can be started even while the workshop is read-only after its subscription has ended. Data the export does not include (e.g. photos, documents and chat messages) is handed over by the processor to the controller on request in a commonly used format.

Erasure. After the contract ends, the processor erases the controller's personal data without undue delay once it receives the controller's request for erasure, and in any case no later than 90 days after the end of the contract, even if the controller does not request it. Until then, the controller may request the hand-over of data under the previous paragraph. Erasure is not automatic; the processor carries it out within the periods stated above. Deleting the workshop in the app ends access to its data but does not erase the data itself. Data whose further storage is required by European Union or Czech law is kept by the processor only to the extent necessary and for the period that law sets, and is not processed for any other purpose. The controller sends a request for erasure or hand-over by email at talalayev@outlook.com or by post to our registered office; the processor confirms to the controller that the erasure has been carried out.

8. Responsibility of the controller

The controller is responsible for having a legal basis for processing the personal data of its customers, employees and applicants, for having informed them about the processing, and for having the necessary legal basis for the text messages and emails it sends through the service.