Data Processing Agreement

UCSM Data Processing Agreement
Last updated: 14 October 2026 (pro forma, subject to final legal review)

This Data Processing Agreement ("DPA") forms part of the agreement between UCSM Solutions Ltd, a company incorporated under Bulgarian law, registered address 16 Aleko Konstantinov Str., floor 4, Plovdiv, Bulgaria, UIC/EIK [EIK] ("UCSM" or the "Processor"), and the business tenant that uses the UCSM platform as a service workshop or fleet (the "Tenant" or the "Controller"). It applies to the personal data that UCSM processes on behalf of the Tenant under the UCSM Terms and Conditions (the "Terms") and meets the requirements of Article 28 of Regulation (EU) 2016/679 (the "GDPR").

1. Roles
The Tenant is the controller of the personal data that it, its staff and its authorised users enter into the platform about its customers, vehicle holders, drivers, employees and other persons ("Tenant Data"). UCSM is the processor of Tenant Data.

UCSM is a separate controller of the data it needs to run the platform: accounts, sign-in and security, payments and Credits, support, notifications, audit records, and the shared service-history and vehicle records described in the Privacy Policy. This DPA does not apply to that processing.

2. Subject matter, duration and purpose
UCSM processes Tenant Data only to provide the platform to the Tenant, as described in Annex I. The DPA lasts as long as the Tenant has an account on the platform and, after that, for the period in which UCSM still holds Tenant Data under Section 11.

3. Instructions
UCSM processes Tenant Data only on the Tenant's documented instructions. The Terms, this DPA, and the Tenant's use and configuration of the platform are the Tenant's complete instructions. The Tenant may give further instructions in writing; UCSM will follow them where they are lawful and technically possible, and may charge for unreasonable effort. UCSM tells the Tenant at once if it believes an instruction infringes data protection law.

4. Confidentiality
UCSM makes sure that everyone it allows to process Tenant Data is bound by a duty of confidentiality, and gives access only to those who need it to provide the platform and support.

5. Security
UCSM takes the technical and organisational measures in Annex II, which are appropriate to the risk, having regard to Article 32 GDPR. UCSM may update the measures if the level of protection is not lowered.

6. Sub-processors
The Tenant gives UCSM a general authorisation to use the sub-processors in Annex III. UCSM binds each sub-processor to data protection obligations no less protective than this DPA and remains responsible for their performance. UCSM tells the Tenant at least 30 days before adding or replacing a sub-processor (by notice in the platform or by email). The Tenant may object on reasonable data protection grounds within that time; if the parties cannot agree, the Tenant may end the affected service and receive a proportionate refund for the unused prepaid amount under the Terms.

7. Transfers outside the EEA
UCSM transfers Tenant Data outside the European Economic Area only where there is an adequacy decision (including the EU-US Data Privacy Framework for certified recipients) or the standard contractual clauses approved by the European Commission, with additional safeguards where needed. Annex III states where the sub-processors process data.

8. Help with data subjects' rights
UCSM passes to the Tenant, without undue delay, any request it receives from a person about Tenant Data, and does not answer it itself unless the Tenant asks. Taking the nature of the processing into account, UCSM helps the Tenant to answer such requests with the platform's functions (for example search, correction, export and deletion) and, where these are not enough, with reasonable additional help.

9. Personal data breaches
UCSM tells the Tenant without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting Tenant Data. The notice describes, as far as known, the nature of the breach, the data and persons concerned, the likely consequences, and the measures taken or proposed. UCSM helps the Tenant to meet its duties under Articles 33 and 34 GDPR.

10. Impact assessments and prior consultation
UCSM gives the Tenant the information it reasonably needs, and helps within reason, for data protection impact assessments and prior consultation with a supervisory authority that concern the processing under this DPA.

11. Return and deletion
For 30 days after the end of the Tenant's paid access period or the termination of its account, Tenant Data is available for export through the platform or on reasonable request to info@ucsm.eu. After that, UCSM deletes or anonymises Tenant Data, except what it must keep by law. Backups are overwritten within [period, to be confirmed]. Verified service-history records that form part of a vehicle's history stay with the vehicle record; the personal data of the Tenant's customers in them is removed or anonymised where this is possible without breaking the record. UCSM is not liable for data lost because the Tenant did not export it in time.

12. Information and audits
UCSM gives the Tenant the information needed to show that it meets this DPA and allows audits by the Tenant or an auditor it appoints, no more than once a year (and after a breach), on 30 days' written notice, in working hours, subject to confidentiality and without risk to other customers' data. The Tenant bears the cost of an audit. UCSM may meet an audit request by giving recent independent audit reports or certifications that cover the same matters.

13. The Tenant's responsibilities
The Tenant makes sure that it has a lawful basis for entering Tenant Data into the platform, informs the persons concerned as the law requires, enters only the data that its purposes need, does not enter special categories of personal data or national identity numbers (see the Terms, Section 14.2), manages its users' access, and keeps its own records of processing.

14. Liability
Each party's liability under this DPA is subject to the limits in Section 20 of the Terms, to the extent the law allows. Nothing limits a liability that cannot be limited by law, or the rights of data subjects.

15. Order of precedence, law and acceptance
If this DPA and the Terms conflict on data protection matters, this DPA prevails. The DPA is governed by the law of the Republic of Bulgaria, and the courts named in Section 23 of the Terms are competent. The Tenant accepts this DPA electronically on the platform, through the owner of the Tenant's account, who confirms authority to bind the Tenant. UCSM records the acceptance with the date, time, version, account and network details.

16. Contact
UCSM Solutions Ltd, 16 Aleko Konstantinov Str., floor 4, Plovdiv, Bulgaria, UIC/EIK [EIK]
Privacy and data processing: privacy@ucsm.eu
General: info@ucsm.eu

Annex I: Description of the processing
1. Subject matter: providing the UCSM platform (service workshop or fleet management) to the Tenant.
2. Duration: while the Tenant has an account, plus the return and deletion period in Section 11.
3. Nature of the processing: storing, organising, displaying, transmitting to the people the Tenant authorises, deleting, and, at the Tenant's request, text recognition of uploaded documents and AI-assisted suggestions.
4. Purpose: managing the Tenant's customers, vehicles, service requests and orders, appointments and Live Capacity offers, vouchers and campaigns, service history, documents, fleet members, drivers, authorisations and reports; sending the Tenant's messages and notifications to its customers.
5. Categories of personal data: names, email addresses, telephone numbers, role and organisation data; vehicle identification numbers, registration numbers and vehicle details linked to a person; appointment, order, operation, parts and cost records; messages and documents; photographs; user identifiers and activity records.
6. Categories of persons: the Tenant's customers and vehicle holders, drivers, employees, technicians and other authorised users, and persons named in documents and messages.
7. Special categories of data: not intended and not permitted.
8. Frequency: continuous, for as long as the Tenant uses the platform.

Annex II: Technical and organisational measures
1. Access control: role-based access; separation between the workspaces of different organisations; sharing of data only through explicit workflows, approvals and authorisations; administrator access limited to those who need it and recorded.
2. Authentication: sign-in through a dedicated identity provider; sessions with a limited lifetime; protection against suspicious sign-ins with alerts to the user.
3. Audit trail: important actions are recorded with date, time and network details.
4. Transmission security: encrypted connections (HTTPS) between users and the platform.
5. Availability: regular backups; recovery procedures [to be confirmed].
6. Segregation of purposes: Tenant Data is used only to provide the platform and support.
7. Deletion: a user can delete the account; administrators can delete in an emergency; data is deleted or anonymised after the return period.
8. Organisation: confidentiality duties, restricted staff access, incident procedure (Annex to the internal procedures) and a records-of-processing register.
9. Further measures [encryption at rest, vulnerability management, penetration testing, to be confirmed by the technical review].

Annex III: Sub-processors
Auth0 (Okta): sign-in and identity. Data: name, email, identifiers, sign-in events. Location: [to be confirmed].
Stripe: payment processing, invoicing and tax details. Data: billing details and payment identifiers. Location: [to be confirmed]. Stripe also acts as an independent controller for some payment data.
Microsoft Azure (Document Intelligence): text recognition of uploaded documents. Data: the uploaded documents. Region: [to be confirmed].
OpenAI: assistant, repair-suggestion and image-analysis features. Data: the query, text or image and the platform information needed to answer. Location: [to be confirmed].
Google Firebase Cloud Messaging: push notifications to the mobile application. Data: device identifier and notification text. Location: [to be confirmed].
Email delivery provider: sending email. Data: recipient address and message. Location: [to be confirmed].
Cloudflare: network protection and delivery. Data: IP address and traffic data. Location: [to be confirmed].
Hosting provider: hosting of the platform and its backups. Data: all Tenant Data. Location: [name and location, to be confirmed].