Data Processing Agreement (DPA)

1. Parties

Data Processor: MecánicOS, soporte@mecanicos.app, Murcia, Spain.
Data Controller: the vehicle repair workshop subscribed to the MecánicOS service.

2. Subject matter

The Processor will process personal data on behalf of the Controller to provide the workshop management service (work orders, customers, vehicles, inventory, invoicing) described in the MecánicOS Terms and Conditions.

3. Nature and purpose of processing

• Types of data: name, contact details and vehicles of the workshop's customers; repair history; invoicing data.
• Categories of data subjects: end customers of the workshop (natural persons).
• Purpose: operational management of the workshop.
• Duration: for the duration of the active subscription + 30 days after cancellation.

4. Processor obligations

• Process data only in accordance with documented instructions from the Controller.
• Ensure confidentiality through agreements with authorised staff.
• Implement appropriate technical security measures: TLS 1.2+ encryption in transit, encryption at rest, available authentication, automatic backups.
• Assist the Controller in responding to data subject rights requests.
• Delete or return all data upon termination of the service within 30 days.
• Notify any security breach within a maximum of 72 hours of detection to soporte@mecanicos.app.
• Not subcontract without prior authorisation from the Controller, except for the sub-processors listed in Annex I.

5. Controller rights

• Issue instructions to the Processor regarding processing at any time.
• Request compliance audits with 30 days' notice.
• Demand immediate deletion of data upon judicial or administrative order.
• Export the workshop's main data in CSV format from Settings → Export data.

6. Authorised sub-processors (Annex I)

The Controller expressly authorises the use of the following sub-processors:

7. International transfers

All sub-processors outside the EEA operate under the Standard Contractual Clauses approved by the European Commission (Decision 2021/914), offering guarantees equivalent to the GDPR. This agreement applies regardless of the workshop's location; for workshops located in the United Kingdom the UK GDPR additionally applies.

8. Applicable law and jurisdiction

This agreement is governed by the GDPR (EU) 2016/679 and the LOPDGDD (LO 3/2018). Jurisdiction: courts of Murcia, Spain. For users in the United Kingdom, the UK GDPR also applies.

9. Term

Valid while there is an active contractual relationship. Updated upon relevant regulatory changes with 30 days' notice by email.

DPA contact: soporte@mecanicos.app