Data Processing Agreement pursuant to Art. 28 GDPR

1. Parties and allocation of roles

1.1 The Client is the controller within the meaning of Art. 4(7) GDPR of the personal data of its employees and drivers that it enters into the WeDriver platform or that are generated there on its instructions (driver list, orders, invoicing). In this processing the Processor acts as processor within the meaning of Art. 4(8) GDPR.

1.2 For its own purposes, which it determines itself, the Processor is an independent controller. These include in particular performance of the vehicle rental contract concluded with the lessor, security of the platform and vehicles, compliance with legal obligations (for example accounting and tax obligations) and protection against misuse and fraud. This Agreement does not apply to such processing and the Processor fulfils its own information obligations towards data subjects under Arts. 13 and 14 GDPR.

1.3 Each party declares that it will comply with the GDPR, the Slovak Data Protection Act and other binding data protection rules when processing personal data.

2. Subject matter and duration

2.1 The subject matter of this Agreement is the regulation of the rights and obligations of the parties in the processing of personal data that the Processor processes on behalf of the Client in connection with the provision of the WeDriver platform services under the platform use agreement concluded between the parties (the “main agreement”).

2.2 The Agreement takes effect on the date of signature by both parties and remains in force for the duration of the main agreement and for as long as the Processor continues to retain the Client's personal data in accordance with the article on deletion or return of data.

2.3 Annex 1 (description of processing), Annex 2 (technical and organisational measures) and Annex 3 (list of sub-processors) form an integral part of the Agreement.

3. Nature and purpose of processing

3.1 The Processor processes personal data solely for the purpose of providing the WeDriver platform services to the Client, in particular maintaining the Client's driver list, creating and managing vehicle orders and bookings, verifying the driver's fitness to drive, invoicing, and communicating with drivers in connection with bookings.

3.2 The nature of processing includes in particular the collection, recording, organisation, storage, retrieval, consultation, use, disclosure by transmission, restriction, erasure and destruction of personal data, by automated means.

3.3 The Processor does not process personal data for any purpose other than that arising from this Agreement and the Client's instructions, unless required to do so by Union law or the law of the Slovak Republic; in that case the Processor will inform the Client of that requirement in advance, unless that law prohibits it.

4. Categories of personal data and data subjects

4.1 The data subjects are the Client's employees and drivers whom the Client has added to the WeDriver platform or for whom a user account or booking is created in the platform on the Client's instructions.

4.2 Categories of personal data processed:

• identification data: first name and surname, date of birth,
• contact data: e-mail address, telephone number,
• driving licence data and its verification: licence number and validity, entitled categories, result and date of verification,
• data on the pick-up and return location of the vehicle,
• booking and order data: vehicle, date, duration, price, status and booking history,
• invoicing data linked to the driver or the order,
• technical data on use of the platform needed for its secure operation (for example login records).

4.4 Processing of special categories of personal data under Art. 9 GDPR is not required and the Client does not enter such data into the platform. Details are set out in Annex 1.

5. Controller's instructions

5.1 The Processor processes personal data only on documented instructions from the Client. The instructions are this Agreement, the main agreement and the Client's settings and actions in the WeDriver platform. The Client gives further instructions in writing, including by e-mail, to info@wedriver.cz.

5.2 If, in the Processor's opinion, an instruction infringes the GDPR or other data protection rules, the Processor will inform the Client without undue delay and may suspend execution of the instruction until the Client confirms or amends it.

5.3 The Client is responsible for having a valid legal basis for processing the personal data of its employees and drivers, for having informed data subjects in accordance with Arts. 13 and 14 GDPR, and for its instructions complying with the law.

6. Confidentiality

6.1 The Processor will ensure that persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, including after the end of their employment or other relationship with the Processor.

6.2 Only those persons of the Processor who need access to perform this Agreement have access to personal data, to the extent necessary for their activity and on the Processor's instructions.

7. Security of processing

7.1 The Processor will implement and maintain throughout the term of the Agreement appropriate technical and organisational measures to ensure a level of security appropriate to the risk pursuant to Art. 32 GDPR, taking into account the state of the art, the costs, the nature, scope, context and purposes of processing and the risks to the rights and freedoms of natural persons.

7.2 The minimum scope of measures is set out in Annex 2. The Processor may adapt the measures on an ongoing basis provided that the level of security is not reduced.

7.3 The Client is responsible for the security of its users' access credentials in the platform, for correctly configuring the permissions of its employees, and for not entering more data into the platform than is necessary.

8. Sub-processors

8.1 The Client grants the Processor general written authorisation to engage other processors (sub-processors) within the meaning of Art. 28(2) GDPR. The categories of sub-processors are:

• hosting and database,
• e-mail delivery,
• payment gateway,
• SMS and push notifications,
• verification of identity and driving entitlement.

8.3 The Processor will impose on each sub-processor by contract the same data protection obligations as those agreed in this Agreement, in particular guarantees of appropriate technical and organisational measures. If a sub-processor fails to fulfil its obligations, the Processor remains fully liable to the Client for their performance.

8.4 The Processor will inform the Client in advance of any intended change (addition or replacement of a sub-processor), as a rule at least 30 days before it takes effect, by e-mail to ……………………… or through the platform. Within that period the Client may object to the change in writing on objective grounds relating to the protection of personal data. If the parties do not agree on another solution, the Client may terminate the main agreement to the extent affected by the change.

8.5 The Processor will provide the current list of sub-processors on request at gdpr@wedriver.cz. An overview of categories is in Annex 3.

9. Transfers to third countries

9.1 The Processor transfers personal data to a country outside the European Economic Area or to an international organisation only on the Client's instructions or where necessary to use a sub-processor under the preceding article, and always only if the conditions of Chapter V GDPR are met.

9.2 A transfer takes place only if there is a European Commission adequacy decision or if appropriate safeguards are in place, in particular standard contractual clauses approved by the European Commission, supplemented where necessary by additional measures.

9.3 The Client hereby gives instructions for transfers made under these conditions. At the Client's request the Processor will provide information on the safeguards used.

10. Assistance with data subject rights

10.1 Taking into account the nature of the processing, the Processor will assist the Client by appropriate technical and organisational measures in fulfilling the Client's obligation to respond to data subjects' requests to exercise their rights under Chapter III GDPR (access, rectification, erasure, restriction, portability, objection).

10.2 If a data subject sends a request directly to the Processor and its content shows that it relates to processing on behalf of the Client, the Processor will forward it to the Client without undue delay and will not respond to it on the merits without the Client's instructions, unless required by law.

10.3 Requests relating to processing for which the Processor is an independent controller are handled by the Processor in its own name.

11. Assistance with security incidents

11.1 The Processor will notify the Client of a personal data breach affecting data processed on its behalf without undue delay after becoming aware of it and no later than 48 hours, to ……………………….

11.2 The notification will contain, to the extent the information is available: a description of the nature of the breach including the categories and approximate number of data subjects and records concerned, a contact point, a description of the likely consequences, and a description of the measures taken or proposed to address the breach and mitigate its effects. Information may be provided in phases.

11.3 The Processor will provide the Client with the assistance necessary to comply with its obligations under Arts. 33 and 34 GDPR, in particular in notifying the supervisory authority and informing data subjects. The decision whether to notify the supervisory authority and data subjects rests with the Client as controller.

12. Impact assessment and prior consultation

12.1 Taking into account the nature of the processing and the information available to it, the Processor will assist the Client in ensuring compliance with the obligations under Arts. 32 to 36 GDPR, in particular with data protection impact assessments and prior consultation with the supervisory authority.

12.2 The Processor will provide the assistance under this article on a reasoned request from the Client, in particular by providing a description of the processing activities and of the security measures taken.

13. Deletion or return of data after termination

13.1 After the provision of the WeDriver platform services under the main agreement ends, the Processor will, at the Client's choice, either delete the personal data processed on its behalf or return them in a commonly used machine-readable format, and subsequently delete existing copies. The Client will communicate its choice in writing no later than the date the main agreement ends; if it does not, the data will be deleted.

13.2 Deletion will be carried out as a rule within 30 days of the end of the main agreement; copies in backups are deleted in their standard cycle. At the Client's request the Processor will confirm deletion in writing.

13.3 The obligation to delete does not apply to data that the Processor must retain under Union law or the law of the Slovak Republic, or that it processes as an independent controller for the purposes referred to in the second paragraph of the first article of this Agreement.

14. Audit and inspection

14.1 The Processor will make available to the Client all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR and will allow for and contribute to audits, including inspections, conducted by the Client or an auditor mandated by it.

14.2 The Client will give at least 30 days' written notice of an audit, carry it out during normal business hours, without unreasonably disrupting the Processor's operations and no more than once per calendar year, unless the audit follows a security incident or is ordered by a supervisory authority. The mandated auditor must be bound by confidentiality.

14.3 The Processor may replace an audit by presenting current reports or certificates of independent auditors, where they suffice to demonstrate compliance. An audit must not disclose confidential information of the Processor's other clients or trade secrets beyond what is necessary. Each party bears its own audit costs.

15. Liability

15.1 Each party is responsible for performing its obligations under the GDPR and this Agreement. The Processor is liable for damage caused by processing only where it has not complied with obligations of the GDPR specifically directed to processors or where it has acted outside or contrary to the Client's lawful instructions (Art. 82 GDPR).

15.2 If a data subject suffers damage caused by processing in which both parties were involved and one of them compensates it beyond its share of responsibility, it is entitled to claim the corresponding part from the other party under Art. 82(5) GDPR.

15.3 The Processor's liability for damages and any contractual penalties are governed by the main agreement, to the extent mandatory law permits. Liability for damage caused intentionally or by gross negligence cannot be excluded or limited.

16. Term and termination

16.1 This Agreement is concluded for the duration of the main agreement and ends with its termination; obligations which by their nature are meant to continue after the Agreement ends (in particular confidentiality, deletion or return of data, and liability) remain in force.

16.2 The Client may withdraw from or terminate the Agreement with immediate effect if the Processor seriously or repeatedly breaches its obligations under this Agreement or the GDPR and fails to remedy the breach even within a reasonable period set by the Client in a written notice.

16.3 Termination of the main agreement for any reason results in termination of this Agreement as set out in the preceding article. If the Processor continues to retain personal data after the main agreement ends, the provisions of this Agreement apply to them until they are deleted.

17. Governing law and final provisions

17.1 This Agreement is governed by the law of the Slovak Republic and the GDPR. Disputes arising from this Agreement are decided by the competent general courts of the Slovak Republic, unless the parties have agreed otherwise in the main agreement.

17.2 In the event of a conflict between this Agreement and the main agreement, the provisions of this Agreement prevail in matters of personal data protection. The Agreement and its annexes must not be interpreted to the detriment of the rights and freedoms of data subjects.

17.3 Amendments and supplements to this Agreement, including the annexes, are valid only in writing; written form is also satisfied by electronic signature or exchange of e-mails where Annex 3 is updated under the article on sub-processors.

17.4 If any provision of this Agreement becomes invalid or unenforceable, the remaining provisions stay valid. The parties will replace the invalid provision with a valid one that comes closest to its purpose.

17.5 The Agreement is made in two copies or in electronic form, each party receiving one copy. The Processor's contact for personal data protection matters: gdpr@wedriver.cz.

18. Annex 1 – Description of processing

18.1 Purpose of processing:

• management of the Client's driver list in the WeDriver platform,
• creation, management and history of vehicle orders and bookings for the Client's drivers,
• verification of the validity of the driver's driving entitlement,
• invoicing and settlement of services to the Client,
• communication with drivers in connection with bookings (confirmations, changes, notices).

18.3 Categories of data:

• first name and surname, date of birth, e-mail, telephone,
• driving licence number and validity, entitled categories, result and date of verification,
• pick-up and return location of the vehicle,
• booking, order and invoicing data,
• technical data on use of the platform (login records).

18.5 Categories of data subjects:

• the Client's employees,
• the Client's drivers (including external ones) whom the Client has added to the platform.

18.7 Retention periods:

• driver and booking data for the duration of the main agreement; after it ends, according to the Client's decision on deletion or return,
• driving licence verification data for no longer than needed for the verification and for evidencing it, and in any case no longer than the contractual relationship with the Client,
• login records and the audit log for as long as needed to ensure security, as a rule no more than 12 months,
• copies in backups for the standard backup cycle, as a rule no more than 35 days.

18.9 Data that the Processor must retain by law (for example accounting documents) are retained for the period prescribed by the rule, as the Processor's own independent obligation.

19. Annex 2 – Technical and organisational measures

19.1 The Processor ensures at least the following measures:

• encryption of data in transit (TLS) and encryption of stored sensitive data, in particular driving licence data,
• role-based access and permission management on the principle of least privilege, regular review of permissions and immediate removal of access once no longer needed,
• two-factor authentication for the Processor's personnel with access to the administration and to personal data,
• an audit log of access to and changes of personal data, protected against unauthorised alteration,
• regular backups and testing of data recovery,
• separation of production, test and development environments; real personal data are not used in test environments,
• retention periods and secure deletion of data after the period expires or on the Client's instruction,
• regular training and instruction of persons authorised to process personal data on data protection and security,
• an incident response plan covering identification, containment, eradication, recovery, notification to the Client and review,
• continuous software updates, protection against malicious code and vulnerability monitoring,
• physical protection of premises and equipment; for hosting, ensured by the hosting provider.

20. Annex 3 – List of sub-processors

20.1 The Processor uses sub-processors in the following categories:

• hosting and database – operation of infrastructure and data storage,
• e-mail – sending transactional e-mails and confirmations,
• payment gateway – payment processing and payment card authorisation,
• SMS and push notifications – delivery of notices and verification codes,
• identity verification – verification of identity and driving entitlement.

20.3 WeDriver will provide the current list of the specific sub-processors, including the country of processing, on request at gdpr@wedriver.cz.