Data Processing Agreement (DPA)
Effective date: September 2026
Este documento tiene validez legal únicamente en su versión en español. Las versiones en otros idiomas son traducciones de referencia. / This document is legally binding only in its Spanish version.
1. Parties and scope
This Agreement forms part of the Terms and governs the processing of personal data that MecánicOS carries out on behalf of the workshop when it uses the service (Art. 28 GDPR).
- Processor: the provider identified in the Legal notice (trade name MecánicOS).
- Controller: the workshop (natural or legal person) that holds the account, whose details appear in it.
It is deemed accepted when the Terms are accepted and the service is used. The workshop can consult it and keep a copy on this page at any time.
2. Subject matter and duration
The processor will process personal data on behalf of the controller to provide the workshop management service described in the Terms. The duration is that of the contractual relationship (including the trial), plus the reasonable period needed to return or delete the data.
3. Nature, purpose, data and data subjects
- Nature of the processing: hosting, storage, consultation, organisation and document generation; sending emails at the controller's request; backups.
- Purpose: day-to-day management of the controller's workshop.
- Types of data: identification and contact details of customers; vehicles; history of orders, repairs and documents (quotes, delivery notes, invoices); photographs, signatures and notes; data of the workshop's users (name, email, role).
- Categories of data subjects: the workshop's customers and their contacts, the workshop's users and employees, and suppliers who are natural persons.
- Processing of special categories of data is not foreseen; the controller will avoid entering them.
4. Obligations of the processor
- Process the data only on the controller's documented instructions. The Terms, this Agreement and the use of the service's features constitute those instructions.
- Inform the controller if it considers that an instruction infringes data protection law.
- Ensure that the persons authorised to process the data have committed to confidentiality.
- Apply technical and organisational measures appropriate to the risk (Art. 32 GDPR), including: encryption in transit, user authentication, role-based access control, logical separation of each workshop's data and activity logs.
- Make available to the controller the information necessary to demonstrate compliance with this Agreement and allow reasonable audits, with reasonable notice, during working hours, without compromising security or third-party data and, preferably, through documentation and certifications. Costs are borne by whoever requests the audit, unless it reveals a breach by the processor.
5. Sub-processors
The controller grants general authorisation for the following sub-processors. The processor imposes on them obligations equivalent to those of this Agreement and remains liable to the controller for their compliance.
| Sub-processor | Service | Notes |
|---|---|---|
| Google (Firebase) | Database, authentication and file storage | May involve transfers outside the EEA (section 10) |
| Vercel | Hosting and running the application | May involve transfers outside the EEA (section 10) |
| Cloudinary | Storage and delivery of photographs | May involve transfers outside the EEA (section 10) |
| Resend | Sending emails at the controller's request | May involve transfers outside the EEA (section 10) |
| Anthropic | AI assistant, only when a user uses it and with the context it sends | May involve transfers outside the EEA (section 10) |
| Sentry | Error monitoring (EU server); end-customer data is not intended to be sent | Technical data |
The processor will inform the controller of any addition or replacement of sub-processors with at least 30 days' notice, by email to the account contact or by a notice in the service. The controller may object on reasonable data protection grounds during that period; if no solution is reached, it may cancel the service without penalty.
6. Assistance to the controller
- Data subject rights: forward to the controller, within a reasonable time, the requests it receives, and provide the service's tools (export, rectification and deletion) to handle them.
- Security, breaches, impact assessments and prior consultations: provide the information it has and cooperate reasonably when the controller must carry them out.
7. Personal data breaches
If the processor becomes aware of a personal data breach affecting data it processes on the controller's behalf, it will notify the controller without undue delay, by email to the workshop's account contact (the registered owner or administrator). The notification will include, to the extent available: the nature of the breach, the categories and approximate number of data and data subjects concerned, the likely consequences, the measures taken or proposed and a contact point. It is for the controller to decide whether to notify the supervisory authority and the data subjects.
8. Return or deletion
When the service ends, the owner can generate a versioned, encrypted local backup from Settings. It contains the restorable data and files that can be downloaded; the manifest declares omissions and excludes credentials and secrets. After cancellation, the processor will delete or return the data within a reasonable period, unless a legal obligation requires keeping it, and without prejudice to sub-processors' backups under their retention policies.
9. Obligations of the controller
The controller guarantees that it has a legal basis and sufficient information for the data it enters, and that its instructions comply with the law.
10. International transfers
When a sub-processor processes data outside the European Economic Area, the transfer relies on an adequacy decision (such as the EU-US Data Privacy Framework if the provider is certified), on the European Commission's standard contractual clauses or on another safeguard under Chapter V GDPR.
11. Applicable law
This Agreement is governed by the GDPR (EU) 2016/679 and the LOPDGDD (Spanish Organic Law 3/2018). Spanish law applies, and the courts determined by the applicable rules will have jurisdiction.
12. Term and changes
Valid while the contractual relationship exists. It will be updated in the event of relevant regulatory changes, with 30 days' notice by email or a notice in the service.