Data Processing Agreement

This page explains how to obtain our Data Processing Agreement, what it covers, and where it stands today. It is not the agreement itself, and nothing on this page is an offer of contractual terms. The executable text is being prepared for review by Bulgarian counsel; until that review is complete we conclude a DPA with you on request rather than publishing one here. When the reviewed text is signed off, it will be published on this page and this notice will be removed.

Where we process personal data on your instructions — your drivers, your contacts, the people in your mailbox — we act as your processor and you act as the controller. Art. 28(3) GDPR requires that relationship to be governed by a written agreement, and that agreement is the DPA. Where we process personal data for our own purposes — running and securing the platform, billing you, improving the product — we act as controller, and the Privacy Policy applies instead. The two are separate and you may well need both.

The DPA carries the terms Art. 28(3) GDPR requires: • The subject matter, duration, nature and purpose of the processing. • The categories of personal data and of data subjects. • Our security measures under Art. 32 GDPR. • Our confidentiality obligations, and those of anyone we authorise to process. • The rules on engaging sub-processors, and your right to object to a new one. • Our assistance with your own obligations under Art. 32 to 36 GDPR. • What happens to the data at the end of the contract — return or deletion, at your choice. This list restates the commitment already made in section 7 of the Terms of Use. It is a description of scope, not the operative wording.

The current list of sub-processors is published at /legal/sub-processors, and that page is the notification mechanism Art. 28(2) GDPR requires: we announce a new sub-processor there before it starts processing, and you may object. If you need to be told by email rather than by watching the page, say so when you request the DPA.

Email [email protected] from an address on your account and ask for a DPA. Tell us the legal name and seat of the controlling entity — that is the counterparty, and it is often not the same name as the account. We will send it for signature. There is no charge, and you do not need to be on a particular plan.

„АНДИМАКС“ ООД ("Andimax" Ltd.), Private limited company, UIC 203076382, VAT BG203076382, seat at Bulgaria, Sofia 1113, Izgrev district, Iztok, 1 Samokov St., fl. 8, ap. 37. The operating company is expected to change legal form shortly. That does not affect a DPA already signed; the successor entity assumes it by operation of law, and this page will name the new entity when the change takes effect.

Awaiting legal review. Published so that controllers can find the route to a DPA and see its scope, rather than having to guess whether one exists. The reviewed and executable text will replace sections 1 and 3 of this page. If you need the agreement before then, section 5 is the route and it works today.