Data Processing Agreement

1. Parties

Controller: the workshop subscribing to CarPulse, with the details given at registration. Processor: Blaze Data Solution Korlátolt Felelősségű Társaság (Blaze Data Solution Kft.), registered office: Gadó utca 8. TT 7. ajtó, 7636 Pécs, Hungary, company reg. no.: 02-09-088407 (Registry Court of the Pécs Regional Court), e-mail: support@blazedata.hu.

2. Subject matter and duration

Subject: job-management and customer-communication service relating to the workshop's customers and vehicles. Duration: the term of the subscription plus the deletion or return period after termination.

3. Nature and purpose of processing

Storage, organisation, display, transmission to the customer (tracking link, notifications), sending one-time codes for approvals, generating PDF job sheets.

4. Categories of data subjects

The workshop's customers (car owners, keepers, contact persons) and the workshop's staff.

5. Types of personal data

Name, phone number, e-mail address, plate and vehicle data, photos and videos, fault description, estimates and approvals, truncated IP address. Special categories of data are not intended; the workshop must not upload such data.

6. Controller's instructions

The processor processes data only on the controller's documented instructions — including the intended use of the service — and informs the controller immediately if an instruction infringes the law.

7. Confidentiality

Staff with access to the data are bound by confidentiality. Platform administrator access is logged.

8. Security measures

Under Article 32 GDPR the processor applies technical and organisational measures appropriate to the risks, in particular:

Encryption: all data in transit is encrypted (HTTPS/TLS, HSTS). Passwords are stored as strong salted hashes (bcrypt, cost factor of at least 12); session, tracking-link and one-time codes are stored only as hashes. The database and file storage run on the hosting provider's encrypted infrastructure in the EU.

Access control: role-based permissions (owner, manager, mechanic, customer); by default mechanics do not see customer contact details. A workshop can never see another workshop's data (every query is scoped to the workshop, verified by automated tests). Each user has at most one web and one mobile session; sensitive actions require a verified e-mail address.

Files: photos and documents are kept in private storage and are accessible only via short-lived (a few minutes) signed links.

Logging and integrity: approvals, stage changes, signed protocols, sent inspections and the audit log cannot be changed afterwards (enforced at database level). Platform administrator access is logged.

Abuse prevention: rate limiting, non-enumerating registration and password reset, one-time codes with limited attempts, a content security policy (CSP), isolated (sandboxed) PDF generation.

Availability: regular database backups, health monitoring and automatic restarts.

Organisational measures: access is limited to the necessary minimum and everyone with access is bound by confidentiality; development includes code review and regular security reviews; under the incident procedure the controller is notified within 48 hours at the latest.

9. Sub-processors

The controller gives general authorisation to engage sub-processors. Current list: hosting Railway Corporation (EU region, Netherlands), file storage Railway (EU region, Netherlands), e-mail Resend, SMS SeeMe / Twilio, push Google Firebase, payments Stripe, RevenueCat. The processor gives 30 days' notice of changes; the controller may object.

10. Assistance with data subject rights

The processor assists the controller with data subject requests and data protection impact assessments through product features (export, deletion, rectification) and, on request, individual support.

11. Breach notification

The processor notifies the controller without undue delay, at the latest within 48 hours of becoming aware of a breach, with the information listed in GDPR Art. 33(3).

12. Deletion or return of data

On termination, at the controller's choice, the processor returns the data in an exportable format or deletes it within 30 days, unless the law requires retention. Personal data in the immutable approval log is anonymised.

13. Audits

The processor makes available the information needed to demonstrate compliance and allows audits agreed in advance.

14. Transfers outside the EEA

Transfers outside the EEA only take place with safeguards under Chapter V GDPR (e.g. standard contractual clauses).

15. Final provisions

This agreement forms an integral part of the Terms of Service. In case of conflict on data protection matters this agreement prevails. Governing law: Hungarian law.