Data Processing Agreement

Parties and scope

This agreement applies between the RentalHandover customer as controller and TM Systems Till Merlé, Birkenstr. 19, 61440 Oberursel, Germany, as processor. It forms part of the Terms and Conditions and is concluded upon registration. On request it is signed separately; an individually concluded agreement takes precedence over this one. It applies for the duration of the service and beyond, for as long as the processor processes the customer's data.

1. Subject matter, nature and purpose of processing

The processor provides the RentalHandover platform (web app and apps for iOS and Android) for digital handover and return protocols. Personal data is collected, stored, displayed, rendered as PDF, sent by email, exported and deleted, solely to provide this service.

Data subjects

• renters and customers of the controller, for business customers their contacts and drivers
• drivers other than the customer, where recorded in the controller's usage contract
• employees of the controller who use the platform
• in workshop mode: keepers of customer vehicles

Types of data

• customer data: name, company, email address, phone, address, language
• details requested by the controller's usage contract, such as date of birth and driving licence details
• protocol data: vehicle and registration number, mileage and fuel level, inventory, damage, notes, name of the employee
• photos of vehicles and damage
• signatures with time, IP address, device identifier and time zone; location only if the signing person allows it on their device
• generated protocol PDFs and signed contracts
• user data of employees: name, email address, role, login data

Special categories of personal data (Art. 9 GDPR) are not intended.

2. Instructions

The processor processes the data only on documented instructions from the controller. Instructions are this agreement, the use and settings of the platform, and individual instructions in text form to hello@rentalhandover.com. If the processor considers an instruction unlawful, it informs the controller without delay. No processing takes place for the processor's own purposes.

3. Confidentiality and security

Everyone with access to the data is bound to confidentiality. The processor takes in particular these technical and organisational measures under Art. 32 GDPR:

• strict separation of customers: every query is limited to the customer's own account
• encryption of all connections (TLS 1.2 or 1.3) and of stored files
• files only through time-limited signed links (24 hours), under names that cannot be guessed
• passwords and device identifiers stored only as hashes, roles for administrators and employees, limits on login attempts
• signed protocols cannot be changed
• daily database backup, kept for 30 days, in the EU
• error monitoring without IP addresses, cookies, form contents or signatures
• test environment separate from production, without production data

In the app's offline mode, a protocol's data stays on the device until it is uploaded. In the apps, a login remains active until signed out. The controller therefore secures its devices with a screen lock.

4. Sub-processors

The controller authorises the use of these sub-processors:

• OVH GmbH, Cologne: servers and database in a data centre in Germany, emails sent through mail servers in France
• Cloudflare, Inc., USA: R2 file storage for photos, signatures, PDFs, exports and database backups, with EU jurisdiction
• Functional Software, Inc. (Sentry), USA: error monitoring in the EU data region; transmitted are the error message with address and method of the failed request, pseudonymous user and account identifiers, role and plan

The processor announces new or changed sub-processors by email at least 30 days in advance. The controller may object for an important data protection reason and terminate the agreement with effect from the change. No data is transferred to any provider of artificial intelligence; that, too, would be announced in advance.

5. Transfers to third countries

The data is stored exclusively in the EU. Cloudflare and Sentry are based in the USA; access from there cannot be ruled out. It relies on the EU-U.S. Data Privacy Framework or EU Standard Contractual Clauses.

6. Assistance, personal data breaches

The processor assists the controller with requests from data subjects, with data protection impact assessments and towards supervisory authorities. Requests reaching the processor directly are forwarded. The processor reports a personal data breach without undue delay, at the latest within 48 hours of becoming aware of it, with the known details of its nature, scope, consequences and countermeasures.

7. Audits

The processor provides the information needed to demonstrate compliance and allows audits by the controller or an auditor bound to confidentiality, announced with reasonable notice and as a rule no more than once a year. For the sub-processors' data centres, their certifications and audit reports suffice.

8. Deletion and return

During the term the controller can export its protocols as an Excel or CSV file and as a ZIP archive of all PDFs. Customers, assets and users removed in the platform are first archived so that existing protocols stay complete; signed protocols cannot be changed. The processor carries out the final deletion of individual records, for example at the request of a data subject, on instruction in text form.

After the end of the agreement the data remains available for 90 days and is then deleted; from the database backups no later than 30 days after that. Statutory retention obligations of the processor remain unaffected.

9. Liability and final provisions

Liability is governed by Art. 82 GDPR and, between the parties, by the liability clause of the Terms and Conditions. German law applies; the place of jurisdiction is Frankfurt am Main, Germany, where legally permitted. In matters of data protection this agreement takes precedence over the Terms and Conditions.