Data Processing Agreement

1. Parties

• Data Controller: The auto repair shop that contracts the service (hereinafter, "the Controller" or "the Workshop").
• Data Processor: El Bujías (hereinafter, "the Processor"), operator of the elbujias.es platform.

2. Subject matter and scope

This agreement governs the processing of personal data that the Processor carries out on behalf of the Controller within the framework of providing the SaaS service for managing auto repair shops.

The data processed includes:

• Workshop customer data: name, phone, email, address.
• Vehicle data: registration plate, make, model, year, VIN, roadworthiness test (ITV) data.
• Work order data: descriptions, quotes, photos, videos, documents.
• Invoicing data: invoices, amounts, tax data.
• Workshop employee data: name, email, role, time-tracking records.

The data subjects are: workshop customers, workshop employees and the workshop owner themselves.

3. Controller's instructions

The Processor will process personal data solely according to the documented instructions of the Controller, which are:

1. Store and process the data required to provide the contracted service.
2. Send communications to the workshop's customers (quotes, notifications, reminders) when the Controller requests this through the platform.
3. Generate invoices and tax documents based on the data provided.
4. Maintain backups to ensure service continuity.

The Processor will immediately inform the Controller if, in its opinion, an instruction infringes the GDPR or any other data protection provision.

4. Security measures

The Processor will implement the following appropriate technical and organisational measures to ensure a level of security appropriate to the risk:

• Encryption in transit: All communications are carried out over HTTPS/TLS.
• Encryption at rest: Passwords are stored using bcrypt hashing. VeriFactu certificates are encrypted with Fernet.
• Access control: JWT authentication with short-lived tokens, multi-tenant isolation per workshop.
• Backups: Daily database backups with 30-day retention.
• Infrastructure: Servers located in the EU (Hetzner, Germany), GDPR-compliant.
• Minimisation: Only the data strictly necessary for the service is collected and processed.

5. Sub-processors

The Controller generally authorises the Processor to use the following sub-processors:

The Processor will inform the Controller of any change to the list of sub-processors at least 30 days in advance, allowing the Controller to object.

6. Security breach notification

The Processor will notify the Controller without undue delay, and in any case within a maximum of 72 hours from becoming aware of a security breach affecting personal data processed on behalf of the Controller.

The notification will include, as a minimum:

• A description of the nature of the breach.
• The categories and approximate number of data subjects affected.
• The likely consequences of the breach.
• The measures taken or proposed to remedy the breach.

7. Data subjects' rights

The Processor will assist the Controller in fulfilling its obligation to respond to requests from data subjects exercising their rights (access, rectification, erasure, portability, restriction and objection).

The platform offers the following features to facilitate these rights:

• Data export: The Controller can export all of its workshop's data in JSON format (Art. 20 GDPR).
• Erasure: The Controller can delete customers, vehicles and work orders.
• Access: All data is accessible through the platform interface.

8. Return and erasure of data

• At the end of the service, the Controller may export all of its data before cancellation.
• After cancellation, the Processor will retain the data for 30 days (grace period for reactivation).
• Once the 30 days have elapsed, the data will be permanently deleted, except issued invoices, whose retention tax law requires. Keeping the rest of the business's documentation (deposit receipts, time records) is the Controller's duty, which it can meet by exporting its data before cancelling.
• Issued invoices: Will be kept for 10 years from issue in accordance with Spanish tax regulations (Ley General Tributaria, arts. 66 and 66 bis), after which they will be deleted.

9. Audit

The Processor will make available to the Controller all the information necessary to demonstrate compliance with the obligations set out in this agreement and will allow for and contribute to audits, including inspections, carried out by the Controller or an auditor authorised by the Controller.

10. Confidentiality

The Processor guarantees that the persons authorised to process personal data have committed to respecting confidentiality or are under a legal obligation of confidentiality.

This confidentiality obligation remains in force even after the termination of this agreement.

Contact

For any enquiry relating to this Data Processing Agreement:

• Email: [email protected]
• Web: https://elbujias.es