Data processing agreement (DPA)

This document is the standard data processing agreement under Article 28 of Regulation (EU) 2016/679 (GDPR) between the Service Recipient (controller) and Tiskel sp. z o.o. (processor, hereinafter also the Provider) for the tiskelcloud.com SaaS. It constitutes Annex 1 to the Regulations of using the tiskelcloud.com SaaS and binds the Parties from the conclusion of the Agreement for the provision of tiskelcloud.com SaaS, without a separate signature. Capitalised terms have the meaning given to them in the Regulations. On request the same text can be printed or saved as PDF and signed, without changes to its provisions.

§1 Parties and roles

1. For personal data entered into the Platform and its Modules in connection with the use of the Service – in particular data of passengers and other customers of the Service Recipient, bookings, Drivers and Users – the Service Recipient acts as the data controller and the Provider acts as the processor.
2. The Provider acts as an independent controller for data processed for its own business purposes, including the Service Recipient's data provided in the Form, the Service Recipient's Account, billing and Credit Card data, technical support, website forms on tiskel.com, newsletter, analytics and security logs. Information about this processing is set out in §13 of the Regulations.

§2 Subject matter, duration and scope

1. The subject matter of the processing is providing the Service Recipient with the tiskelcloud.com Platform to manage vehicles, bookings, customer contact and telephone lines in a taxi company, including receiving and dispatching bookings, communication with Drivers and customers (including via the Passenger Application, SMS messages and telephony integrations) and storing data in the Service Recipient's Account.
2. Processing includes collection, recording, storage, retrieval, modification, transmission and erasure of data.
3. Categories of data subjects: passengers and other persons contacting the Service Recipient or booking rides, Drivers, Users and other employees and contractors of the Service Recipient.
4. Types of data: names, phone numbers, e-mail addresses, pickup and drop-off addresses, booking details and ride history, vehicle location data, content of messages and notes, account data (logins) of Users and Drivers, vehicle identification data and any other data entered into the Platform by the Service Recipient or its customers.
5. The Service does not require special categories of data (Article 9 GDPR). If such data is entered into the Platform, it is processed only to the extent necessary to handle the booking.
6. The processing lasts for the term of the Agreement for the provision of tiskelcloud.com SaaS.

§3 Provider obligations

1. The Provider, as processor:
   1. processes data only on documented instructions from the Service Recipient. The Regulations, the configuration of the Platform and Modules made by the Service Recipient (the Service Recipient's Administrator) and instructions given in writing or by e-mail are considered instructions. If the Provider considers an instruction to infringe data protection law, it will immediately inform the Service Recipient;
   2. ensures that persons authorised to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
   3. implements technical and organisational measures required by Article 32 GDPR that are appropriate to the risk of the processing, including securing data against loss and against unauthorised internal and external access;
   4. engages further processors (sub-processors) only under the conditions described in §4 and enters into a contract with them imposing the obligations required by Article 28(4) GDPR;
   5. assists the Service Recipient, insofar as possible and by appropriate technical measures (including Platform functionality), in responding to requests from data subjects exercising their rights (access, rectification, erasure, restriction, portability, objection);
   6. assists the Service Recipient in meeting its obligations under Articles 32 to 36 GDPR. The Provider notifies the Service Recipient of a personal data breach without undue delay after becoming aware of it, to the e-mail address provided in the Form, together with the information the Provider has available;
   7. at the end of the Service, at the Service Recipient's choice, deletes or returns the personal data processed on its behalf, unless law requires further storage. The time limits for returning and deleting data are set out in §8 of the Regulations. Backup copies are deleted on their retention cycle. If the Service Recipient does not make a choice, this is treated as an instruction to delete;
   8. makes available to the Service Recipient the information necessary to demonstrate compliance with Article 28 GDPR. An audit is at the Service Recipient's cost, on at least 14 days' written notice, no more than once a year unless a supervisory authority requires it or a breach has occurred, and in a manner that does not compromise the security of other Service Recipients' data. The Provider first responds to written questions and provides documentation.

§4 Sub-processors

1. The Service Recipient gives general authorisation for the Provider to engage sub-processors.
2. As of the last update of this agreement, the Provider uses the following sub-processors:
   1. Google Cloud (Google Ireland Limited) – hosting and infrastructure of the tiskelcloud.com Platform (Google Kubernetes Engine); scope: all data processed in the Platform.
3. Third-party service providers used by the Service Recipient within the Modules and integrations it has chosen, under the Service Recipient's own agreements with those providers (in particular telecommunications operators, SMS gateways and booking platforms), are not sub-processors of the Provider. The Provider transmits data to them only to the extent resulting from the Platform configuration made by the Service Recipient.
4. The Provider informs the Service Recipient of an intended addition or replacement of a sub-processor by e-mail or through the Platform. Where the change is needed for continuity or security of the Service, notice may follow the change. The Service Recipient may raise a reasoned objection. The Provider remains liable to the Service Recipient for the acts and omissions of its sub-processors.

§5 Transfers outside the EEA

1. If data is transferred outside the European Economic Area, the transfer takes place under the safeguards of Chapter V GDPR.

§6 Service Recipient obligations and liability

1. The Service Recipient is responsible for the lawfulness of entering data into the Platform, including informing passengers, Drivers and Users that their data is processed using the tiskelcloud.com Platform (including vehicle location tracking and SMS and telephone communication), and for ensuring a valid legal basis for such processing.
2. The Service Recipient is also responsible for the content of its instructions, the configuration of the Platform and Modules, managing access of Users and Drivers, and for not entering into the Platform data that is not necessary to provide the Service.
3. The Provider will reasonably assist the Service Recipient in responding to data subject requests related to data processed in the Platform. The limitations of liability in §11 of the Regulations also apply to this agreement to the extent permitted by law.

§7 Signatures

A signature is not required for this agreement to bind the Parties when using the Service. If the Service Recipient needs a signed copy, save this page as PDF (print / save as PDF) and return a scan to info@tiskel.com. The text is not open to individual changes.