Data Processing Agreement (DPA)

1. Parties

Data Processor: MecánicOS, soporte@mecanicos.app, Murcia, Spain.
Data Controller: the vehicle repair workshop subscribed to the MecánicOS service.

2. Subject matter

The Processor will process personal data on behalf of the Controller to provide the workshop management service (work orders, customers, vehicles, inventory, invoicing) described in the MecánicOS Terms and Conditions.

3. Nature and purpose of processing

• Types of data: name, contact details and vehicles of the workshop's customers; repair history; invoicing data.
• Categories of data subjects: end customers of the workshop (natural persons).
• Purpose: operational management of the workshop.
• Duration: for the duration of the active subscription and the additional time needed to complete service termination.

4. Processor obligations

• Process data only in accordance with documented instructions from the Controller.
• Ensure confidentiality through agreements with authorised staff.
• Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.
• Assist the Controller in responding to data subject rights requests.
• Delete or return the data processed on behalf of the Controller upon termination of the service, within a reasonable period.
• Notify the Controller, without undue delay, of any personal data breach it becomes aware of, at soporte@mecanicos.app.
• Not subcontract without prior authorisation from the Controller, except for the sub-processors listed in Annex I.

5. Controller rights

• Issue instructions to the Processor regarding processing at any time.
• Request reasonable information about the security measures applied and compliance with this agreement.
• Demand immediate deletion of data upon judicial or administrative order.
• Export the workshop's main data in CSV format from Settings → Export data.

6. Authorised sub-processors (Annex I)

The Controller expressly authorises the use of the following sub-processors:

7. International transfers

Where an international data transfer takes place, appropriate safeguards under applicable data protection law will apply.

8. Applicable law and jurisdiction

This agreement is governed by the GDPR (EU) 2016/679 and the LOPDGDD (LO 3/2018). Jurisdiction: courts of Murcia, Spain.

9. Term

Valid while there is an active contractual relationship. Updated upon relevant regulatory changes with 30 days' notice by email.

DPA contact: soporte@mecanicos.app