Data Processing Agreement (DPA)
Last updated: 8 July 2026
This Data Processing Agreement (“DPA”) forms part of the agreement between the workshop using CarsEXP (“Controller”) and GBO Eesti OÜ, Estonia (“Processor”, “CarsEXP”), and governs the processing of personal data on the Controller’s behalf under the EU General Data Protection Regulation (GDPR), Article 28. It applies automatically when you use CarsEXP to process personal data of your clients.
1. Roles
For the personal data a workshop enters into CarsEXP (its clients, vehicles, orders, invoices, inspection media), the workshop is the Controller and CarsEXP is the Processor. For account and platform data, CarsEXP is the Controller (see the Privacy Policy).
2. Subject matter, nature and purpose
CarsEXP processes personal data solely to provide the workshop-management service: managing clients and vehicles, repair orders and inspections, invoicing, the customer portal, scheduling and communications. Processing lasts for the duration of the subscription and the retention periods below.
3. Categories of data and data subjects
Data subjects: the workshop’s customers and their representatives. Categories: identification and contact data (name, e-mail, phone), vehicle data (plate, VIN), service history, invoices and payment status, and photos/notes from vehicle inspections. Special-category data is not required by the service.
4. Processing on documented instructions
CarsEXP processes personal data only on the Controller’s documented instructions, including the configuration and use of the platform, unless required by EU or member-state law (in which case CarsEXP informs the Controller unless prohibited).
5. Confidentiality
Personnel authorised to process personal data are bound by confidentiality and access it strictly on a need-to-know basis.
6. Security measures (Art. 32)
CarsEXP implements appropriate technical and organisational measures: strict tenant isolation (database Row-Level Security plus application filtering), encryption in transit and at rest, strong authentication, role-based access control, a tamper-evident audit log, backups and monitoring. See the Security page for details.
7. Subprocessors
The Controller authorises CarsEXP to engage the subprocessors listed at /legal/subprocessors (hosting, payments, messaging). CarsEXP imposes data-protection obligations on each subprocessor no less protective than this DPA, and will give advance notice of new subprocessors so the Controller may object on reasonable data-protection grounds.
8. Assistance to the Controller
Taking into account the nature of processing, CarsEXP assists the Controller with data-subject requests (access, rectification, erasure, portability), and with security, breach notification and data-protection impact assessments. The platform provides self-service data export and deletion tools.
9. Personal data breach
CarsEXP notifies the Controller without undue delay after becoming aware of a personal data breach affecting the Controller’s data, with the information the Controller needs to meet its own notification obligations.
10. Deletion or return
On termination, CarsEXP deletes or returns the Controller’s personal data at the Controller’s choice, except where storage is required by law (e.g. accounting/tax records for invoices). The Controller can export its data at any time before deletion.
11. Audits
CarsEXP makes available the information necessary to demonstrate compliance with Art. 28 and allows for and contributes to audits, including inspections, conducted by the Controller or a mandated auditor, subject to reasonable notice and confidentiality.
12. International transfers
CarsEXP hosts data in the EU. Where a subprocessor processes data outside the EEA, transfers rely on an adequacy decision or the EU Standard Contractual Clauses with supplementary measures. Current locations are shown on the Subprocessors page.
13. How to put this DPA in place
This DPA applies automatically to your use of CarsEXP. If your organisation requires a countersigned copy, contact privacy@carsexp.com and we will provide one.