Data Processing Agreement

This agreement is an annex to the General Terms and Conditions (GTC) of ForkScan Pro. It becomes part of the contract when the contract is concluded, including for the trial period (GTC § 15).

The controller is the customer, that is the company that uses ForkScan Pro under the GTC. The processor is the provider:

WebPX - Graupner & Kozhevnikov GbR Reumtengrüner Str. 32B 08209 Auerbach Germany

Where this agreement governs data protection differently from the GTC, it takes precedence over the GTC. Terms such as “processing” or “personal data breach” have the meaning given to them by the General Data Protection Regulation (GDPR).

The subject matter is the provision of ForkScan Pro as software as a service under the GTC. For this purpose the provider stores the data that the customer and its users store in their company's area, makes them available to the customer's users in the web application and in the mobile apps (once these have been released), changes and deletes them at their request, backs them up and sends invitations to the team and reminders of inspection dates by email, in the apps also as push notifications.

The sole purpose of the processing is to provide these services to the customer.

This agreement applies for the term of the contract, including the trial period, and beyond that for as long as the provider processes the customer's data on its behalf, in particular for as long as they remain stored and readable after a trial or a plan has ended (GTC § 4).

The following types of personal data are processed (customer data):

• details of the users in the customer's company: membership of the company with its role (administrator or member), invitations to the team with the invitees' email addresses and who created or changed an entry; the users' names and email addresses insofar as they are shown in the company's area for this purpose
• fleet data: vehicles with name, manufacturer, device type, serial and inventory number, year of manufacture, location, operating hours, status, photos and documents
• inspection dates (e.g. statutory safety inspections) with date, interval, status, notes, inspector and inspection report
• documented errors with error code, time, operating hours, status, resolution, notes and photos
• device and licence data of the company's mobile devices registered for the apps: licence key, device identifier, device name, platform and time of last use
• other personal data that the customer's users store in free-text fields, photos or documents

The data subjects are the customer's employees and other persons who use ForkScan Pro for the customer or are invited to do so, as well as persons who are named in entries or identifiable in photos and documents, such as inspectors.

Special categories of personal data (Art. 9 GDPR) are not intended for ForkScan Pro. The customer ensures that its users do not store such data.

This agreement does not cover processing for which the provider is itself the controller. Such processing is described in the privacy policy, in particular:

• user accounts with name, email address and sign-in data, sign-in (also with Google or Apple) and sessions (sections 4 and 5 of the privacy policy)
• performance of the contract and billing with the customer, including payment processing via Stripe (section 9)
• emails regarding the account, trial period, subscription and payments (section 10)
• security and abuse detection, including the automatic blocking of device licences (section 13)
• the counting of error code searches, our own usage statistics and reach measurement (section 12) and the marking of delivered error code texts (section 6)
• tips and ratings that the customer's users publish in the community area; they are visible to all ForkScan Pro customers (section 6, GTC § 9)

Stripe is therefore not a sub-processor under this agreement. Stripe only receives the details for billing between the provider and the customer (section 9 of the privacy policy), for which the provider is itself responsible, and processes some data under its own responsibility. Stripe does not receive fleet data, inspection dates, documented errors or device data.

The provider processes customer data only on documented instructions from the customer, including with regard to transfers to a third country, unless required to do so by Union or Member State law to which the provider is subject. In such a case, the provider informs the customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

The customer's instructions follow from the GTC, this agreement and the use of the features of ForkScan Pro by the customer and its users. The customer's administrators give further instructions in text form to info@webpx.de.

If the provider considers that an instruction infringes the GDPR or other data protection provisions, it informs the customer without delay. It may suspend carrying out the instruction until the customer confirms or changes it.

The provider ensures that the persons it authorises to process customer data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, also after their work has ended. Only persons who need access for the operation, maintenance and support of ForkScan Pro are given access to customer data.

The provider takes the measures required by Art. 32 GDPR to ensure a level of security appropriate to the risk. Currently these are:

• Physical access: the servers are located in data centres of Hetzner Online GmbH in Germany. The provider does not operate server rooms of its own; Hetzner ensures the physical protection of the data centres.
• System access: passwords are stored only as a cryptographic hash, and sign-in attempts are limited. A user account can be signed in to at most three browsers at the same time; these sign-ins can be ended individually in the account settings. Sign-ins in the mobile apps are bound to the registered device and a device licence.
• Data access: roles for a company's administrators and members and for the administration of the platform. Only the company's members and the platform administration access a company's data; the server checks this on every request. Photos and documents can only be retrieved through signed links that expire after at most one hour on the web and at most 24 hours in the apps.
• Separation: each customer's data are separated from those of other customers by the identifier of its company. Development and automated tests run in an environment separate from production, with test data. In production the provider checks functions only with its own test accounts; it corrects data there through migrations that are tested with test data beforehand.
• Transfer: data are only transmitted in encrypted form (TLS). The mobile apps also check the server's certificate (certificate pinning) and sign write requests; they additionally encrypt the renewal of the sign-in.
• Input: an internal change log records, with the time and the person acting, every change to vehicles, inspection dates and documented errors, in the customer portal and in the apps: creating, changing, status, operating hours, archiving, completing and resolving, photos and documents, and deleting. For these, it records only which free-text fields changed, not their contents; for statuses and dates the old and the new value, for photos their number. It also records changes to the team (invitations, roles, removal of members), the deactivation of devices and requests to release licences. Entries deleted together with a vehicle (planned inspection dates and the operating-hours history) belong to its logged deletion.
• Availability and resilience: the database is backed up together with the uploaded files every two hours; each backup is checked for its content after writing and deleted after 7 days. Restoring has been tested. The backups are currently stored on the same server as the database; there is no copy at a second location yet. The number of requests is limited at the apps' interface and for individual functions of the web application, such as resetting the password, confirmation emails and deleting an account; technical errors are detected with Sentry.
• Review: automated tests and security checks on every change to the code, including a search for accidentally stored credentials; a nightly check of the software packages used and of the server image for known vulnerabilities; a defined procedure for security incidents; a review of these measures at least once a year.

The provider may adapt the measures to technical progress provided that the level of protection does not decrease. The customer receives the current description on request.

By concluding the contract, the customer approves the following sub-processors:

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany: servers for the website, application, database, uploaded files and backups and for the provider's own mail server, through which all emails are sent. Place of processing: Germany.
• Functional Software, Inc. (Sentry), 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA: error analysis; error reports may contain customer data. Place of processing: Sentry's EU region (Germany), deleted after 90 days; access from the USA cannot be excluded (§ 9).
• Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA (Apple Push Notification service): delivery of push notifications to iPhones and iPads once the iOS app has been released and the user allows notifications. The push token and the content of the notification are transmitted, for example the name of a vehicle and when its inspection is due. Place of processing: USA.
• Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and its affiliates (Firebase Cloud Messaging): delivery of push notifications to Android devices once the Android app has been released and the user allows notifications, with the same data. Place of processing: USA possible.

The provider contractually binds each sub-processor to data protection obligations that meet the requirements of Art. 28 GDPR. It remains responsible to the customer for compliance with these obligations (Art. 28 (4) GDPR).

If the provider intends to engage an additional sub-processor or to replace one, it notifies the customer's administrators by email at least four weeks in advance. The customer may object in text form within this period for an important reason relating to data protection. If the provider maintains the change, the customer may terminate the contract in text form with effect from the date on which the new sub-processor is engaged; the provider points out this right in the notification.

Services of third parties that the provider uses purely as ancillary services, such as telecommunications or postal services, are not sub-processing.

Customer data are processed in Germany. Only the sub-processors Sentry, Apple and Google named in § 8 may process them outside the EU or access them from there. The transfer is based on an adequacy decision of the EU Commission (EU-U.S. Data Privacy Framework) or on standard contractual clauses (Art. 45, 46 GDPR).

Where possible, the provider assists the customer with appropriate technical and organisational measures in responding to requests from data subjects exercising their rights under Chapter III GDPR. Where the customer cannot correct or delete customer data in ForkScan Pro itself, the provider does so on the customer's instructions or restricts the processing. If a data subject contacts the provider about customer data, the provider forwards the request to the customer without delay.

Taking into account the nature of the processing and the information available to it, the provider also assists the customer with the obligations under Art. 32 to 36 GDPR: security of processing, notification and communication of personal data breaches, data protection impact assessment and prior consultation of the supervisory authority.

The provider notifies the customer of a personal data breach affecting customer data without undue delay after becoming aware of it, by email to the customer's administrators. Where known, the notification contains the information required by Art. 33 (3) GDPR; the provider supplies what is not yet known later.

The provider takes the necessary measures without delay to secure the data and to mitigate possible adverse effects for the data subjects, and coordinates them with the customer. Notifying the supervisory authority and communicating the breach to data subjects (Art. 33, 34 GDPR) is the customer's responsibility for customer data; the provider assists the customer in this.

After a trial or a plan has ended, the customer data remain stored and readable for the customer for 12 months (GTC § 4). The 12 months start when the trial ends or, if later, when the plan ends; they do not start while a payment is outstanding. If no plan is running by then, the provider deletes the customer data, at the earliest 30 days after a reminder by email to the customer's administrators. Section 16 “Retention period” of the privacy policy sets out which data of a company are deleted in this case and when its last member deletes their user account.

The customer may also request deletion of the customer data at any time in text form to info@webpx.de. Before deletion, the provider hands over a copy of the customer data in a common electronic format on the customer's instructions. During the trial, and with a plan that includes the export, the customer can also download the fleet, the inspection dates that are overdue or due within the next 30 days and the documented errors, each without photos and documents, as an Excel or PDF file in the customer portal under “Reports”; after the trial or the plan has ended, and while a payment has been outstanding for more than 14 days, the customer's administrators can do so without a plan as long as the data are stored.

Copies in backups are deleted with them, about 7 days after they were created. Data that the provider must retain under its own responsibility (§ 4), such as billing records, remain unaffected.

On request, the provider makes available to the customer all information necessary to demonstrate compliance with this agreement and Art. 28 GDPR, primarily information and documents in text form, such as the current description of the measures under § 7 and the evidence of the sub-processors.

If this is not sufficient, the provider allows audits, including inspections, by the customer or an auditor mandated by the customer who is bound to confidentiality and is not a competitor of the provider. Inspections must be announced with reasonable notice, usually two weeks, and take place during normal business hours without disrupting operations and without disclosing data of other customers. For Hetzner's data centres, the provider presents the evidence that Hetzner provides.

Liability between the parties is governed by § 13 of the GTC. Liability towards data subjects under Art. 82 GDPR remains unaffected.

§ 16 of the GTC applies accordingly to changes to this agreement; § 8 applies to changes of sub-processors.

Should individual provisions of this agreement be or become invalid, the validity of the remaining provisions remains unaffected.

This agreement is published in German and English; the German version prevails.

If you have any questions about this agreement or wish to give instructions, you can reach us at:

Phone: +49 (0) 3744 3515905 Email: info@webpx.de