Data processing agreement (DPA)
This agreement (GDPR Article 28) is entered into between the Customer (dealership, "Controller") and CarDesk ("Processor") and forms part of the Terms of service. It applies automatically when the Terms are accepted.
1. Subject matter and duration
The Processor processes personal data on behalf of the Controller solely to provide the CarDesk service, for the duration of the subscription and until the data is deleted or returned.
2. Description of processing (Annex I)
| Item | Description |
|---|---|
| Data subjects | The Controller’s prospective and existing customers (leads); the Controller’s employees/salespeople |
| Data categories | Name, phone, email, preferred language, vehicle of interest, lead source, message content, consent and opt-out records, audit trail |
| Special categories | None intended; the Controller must not enter GDPR Art. 9 or 10 data |
| Nature and purpose | Storage, organisation, AI drafting and sending of messages, receiving replies, compliance checks, reporting |
| Duration | Subscription term + up to 30 days for export; backups up to 14 days |
3. Processor obligations
- Process the data only on the Controller’s documented instructions (settings and actions in the application are such instructions) and inform the Controller if an instruction in its opinion infringes the GDPR.
- Ensure that persons with access are bound by confidentiality.
- Implement the Article 32 technical and organisational measures (Annex II).
- Assist the Controller with data subject requests (the application provides export, rectification, GDPR erasure and opt-out) and with the obligations in Articles 32–36.
- Notify the Controller without undue delay and, where possible, within 48 hours of becoming aware of a personal data breach.
- On termination, delete or return the data at the Controller’s choice, unless the law requires retention.
- Make available the information needed to demonstrate compliance and allow reasonable audits, with 30 days’ notice, up to once a year.
4. Subprocessors
The Controller gives general authorisation for the subprocessors below. The Processor will announce any new subprocessor at least 30 days in advance; the Controller may object on reasonable grounds and, if no solution is found, terminate the subscription. The Processor imposes equivalent obligations on subprocessors.
| Subprocessor | Purpose | Location / transfers |
|---|---|---|
| Hostinger International Ltd (Cyprus) | Server hosting (VPS), database, backups | Data centre in France (EU) |
| Twilio Ireland Ltd / Twilio Inc. | Sending and receiving SMS and WhatsApp messages | EU and US; EU-US Data Privacy Framework and Standard Contractual Clauses (SCCs) |
| Sendinblue SAS (Brevo), France | Sending and receiving email (transactional email, customer replies) | EU (France/Germany) |
| AI (language model) provider, e.g. OpenAI Ireland Ltd | Drafting message suggestions; data is not used to train models | EU/US depending on provider; SCCs / Data Privacy Framework |
| Stripe Payments Europe Ltd (Ireland) | Subscription billing and invoicing (dealer account data only) | EU and US; SCCs / Data Privacy Framework |
| Plausible Insights OÜ or Umami (optional) | Anonymous visit statistics, only with consent | EU |
5. International transfers
Transfers outside the EEA take place only with appropriate safeguards under GDPR Chapter V (an adequacy decision, in particular the EU-US Data Privacy Framework, or Standard Contractual Clauses).
6. Controller obligations
The Controller warrants that it has a lawful basis for all data it enters and every communication it triggers, that it has informed data subjects (Articles 13–14), and that it complies with ePrivacy rules for marketing messages.
7. Technical and organisational measures (Annex II)
- EU hosting, isolated Docker containers, a private network with no public access to the database or Redis, a firewall allowing only SSH and HTTPS.
- TLS for all traffic, HSTS, security headers, bcrypt-hashed passwords, signed session cookies (httpOnly, Secure).
- Logical separation of data per dealership in every query, user roles (owner, manager, salesperson).
- Login/signup rate limiting, an audit trail, and personal data redacted from logs.
- Nightly backups with 14-day retention, accessible only to administrators.
- Compliance checks before every send: opt-out, per-channel consent, quiet hours, limits.
8. Precedence
In case of conflict on data protection matters, this agreement prevails over the Terms of service. For a countersigned copy, email hello@getcardesk.com.