Draft: this text is waiting for legal review and isn't final yet.

Data Processing Agreement

Version 1.0 · Last updated: 25 October 2026

How LiftSlot processes your garage's customer data on your behalf (GDPR Article 28).

How this agreement is made

This agreement is between the garage that uses LiftSlot (the controller) and Erotronics, obrt za usluge (the processor). The garage accepts it, together with the Terms of use, by ticking the box at sign-up. We store which version was accepted and when. It applies for as long as we process personal data for the garage.

It follows the structure of the European Commission's Standard Contractual Clauses between controllers and processors (Implementing Decision (EU) 2021/915).

Section I

Clause 1. Purpose and scope

(a) This agreement ensures compliance with Article 28(3) and (4) of Regulation (EU) 2016/679 (GDPR).
(b) The controller and processor are listed in Annex I.
(c) It applies to the processing described in Annex II.
(d) Annexes I to IV are an integral part of this agreement.
(e) It is without prejudice to the obligations the controller has under the GDPR.
(f) It doesn't on its own ensure compliance with the GDPR's rules on international transfers (Chapter V).

Clause 2. Invariability

(a) The parties won't change this agreement except to complete or update the annexes.
(b) This doesn't stop the parties from including these clauses in a broader contract, or adding other clauses or safeguards, as long as they don't contradict these clauses or reduce the protection of data subjects.

Clause 3. Interpretation

(a) Terms defined in the GDPR have the same meaning here.
(b) This agreement is read in the light of the GDPR.
(c) It won't be read in a way that runs counter to the GDPR or reduces data subjects' fundamental rights.

Clause 4. Hierarchy

If this agreement conflicts with the Terms of use or another agreement between the parties, this agreement prevails for anything to do with personal data.

Clause 5. Docking clause

Not used.

Section II. Obligations of the parties

Clause 6. Description of the processing

The details of the processing, in particular the categories of personal data and the purposes, are in Annex II.

Clause 7. Obligations of the parties

7.1 Instructions

(a) The processor processes personal data only on documented instructions from the controller, unless EU or Member State law requires otherwise; in that case it tells the controller first, unless the law forbids it. The controller's instructions are this agreement, the Terms of use, and what the controller does in the app (entering, changing, exporting and deleting data, settings). The controller may give further instructions throughout the processing; they must be documented.
(b) The processor tells the controller straight away if it thinks an instruction breaks the GDPR or other data protection law.

7.2 Purpose limitation

The processor processes the personal data only for the purposes in Annex II, unless the controller instructs otherwise.

7.3 Duration

Processing lasts only as long as set out in Annex II.

7.4 Security

(a) The processor applies at least the technical and organisational measures in Annex III. This includes protecting the data against a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access (a personal data breach). The parties take into account the state of the art, the costs, the nature, scope, context and purposes of the processing, and the risks for data subjects.
(b) The processor gives its staff access to the data only as far as strictly necessary to provide, manage and monitor the service, and makes sure people authorised to process the data are bound by confidentiality.

7.5 Sensitive data

The service isn't meant for special categories of data (Art. 9 GDPR) or data about criminal convictions (Art. 10), and the controller agrees not to enter them. If such data is nonetheless processed, the processor applies the measures in Annex III to it as well.

7.6 Documentation and compliance

(a) The parties must be able to show compliance with this agreement.
(b) The processor deals promptly and adequately with the controller's questions about the processing.
(c) The processor gives the controller the information needed to show compliance with this agreement and Article 28 GDPR. At the controller's request, it also allows and contributes to audits, at reasonable intervals or where there are signs of non-compliance. An audit is announced at least 30 days in advance, takes place at most once a year, and is at the controller's cost, unless it follows a confirmed personal data breach at the processor.
(d) The controller may carry out the audit itself or appoint an independent auditor. Audits may include inspections at the processor's premises and are carried out with the notice in point (c).
(e) The parties make this information, including audit results, available to the supervisory authority on request.

7.7 Use of sub-processors

(a) The controller gives general authorisation for the sub-processors in Annex IV. The processor tells the controller by e-mail about any intended addition or replacement of sub-processors at least 30 days in advance, so the controller can object. If the controller objects and the parties can't agree, the controller may end the agreement, with no charge for the rest of the period.
(b) The processor engages sub-processors only through a contract that gives them, in substance, the same data protection obligations as this agreement.
(c) At the controller's request, the processor provides a copy of the sub-processor agreement; commercial secrets may be redacted.
(d) The processor remains fully responsible to the controller for its sub-processors, and tells the controller if a sub-processor fails to meet its obligations.
(e) Where a sub-processor's contract allows it, the controller may enforce it directly if the processor has disappeared, ceased to exist or become insolvent.

7.8 International transfers

(a) The processor transfers data outside the EU/EEA only on the controller's documented instructions or where EU or Member State law requires it, and only in line with Chapter V GDPR. The controller instructs the transfers needed to use the sub-processors in Annex IV, under the safeguards listed there.
(b) Where a sub-processor processes data outside the EU/EEA, the processor and the sub-processor rely on an adequacy decision (such as the EU-US Data Privacy Framework) or the Standard Contractual Clauses adopted under Article 46(2) GDPR. The safeguard for each sub-processor is listed in Annex IV.

Clause 8. Assistance to the controller

(a) The processor tells the controller promptly about any request it receives from a data subject. It doesn't answer the request itself, unless the controller authorises it.
(b) The processor helps the controller answer data subjects' requests. The app already lets the controller access, correct, export and delete a customer's personal data itself.
(c) The processor also helps the controller, taking into account the nature of the processing and the information available, with: (1) data protection impact assessments; (2) prior consultation of the supervisory authority; (3) keeping personal data accurate and up to date, by telling the controller without delay if it learns that data is inaccurate or outdated; (4) its obligations under Article 32 GDPR.
(d) The technical and organisational measures for this assistance are in Annex III.

Clause 9. Personal data breaches

9.1 A breach of data the controller processes: the processor helps the controller to notify the supervisory authority and, where needed, the data subjects, with the information in Article 33(3) GDPR that the processor has.

9.2 A breach of data the processor processes: the processor notifies the controller without undue delay, and at the latest within 48 hours, after becoming aware of it. The notification includes at least: (a) the nature of the breach, including where possible the categories and approximate number of data subjects and records concerned; (b) a contact point for more information; (c) the likely consequences and the measures taken or proposed to address the breach and limit its effects. Where not all information is available at once, it is provided in phases without undue delay.

Section III. Final provisions

Clause 10. Non-compliance and termination

(a) If the processor breaches this agreement, the controller may instruct it to suspend the processing until it complies or the agreement ends. The processor tells the controller promptly if it can't comply, for whatever reason.
(b) The controller may end the agreement as far as it concerns processing of personal data if: (1) processing was suspended and compliance isn't restored within a reasonable time, at most one month; (2) the processor is in substantial or persistent breach of this agreement or its GDPR obligations; (3) the processor doesn't comply with a binding decision of a court or the supervisory authority about its obligations under this agreement or the GDPR.
(c) The processor may end the agreement as far as it concerns processing of personal data if the controller insists on instructions the processor has said break the law, after telling the controller that they can't be followed.
(d) When the agreement ends, the processor deletes all personal data processed for the controller, as set out in the Terms of use: the owner can export the data first as CSV files; the data is deleted 30 days after the account deletion request, and disappears from backups within a further 6 hours. Until deletion, the processor keeps ensuring compliance with this agreement. Data is kept longer only where EU or Member State law requires it.

Annex I. List of parties

Controller: the garage that accepted this agreement at sign-up, with the name, address and contact details entered in its account. Contact person: the account owner, at the e-mail address of the owner's account. Accepted electronically by ticking the box at sign-up; the date and version are stored in the account.

Processor: Erotronics, obrt za usluge, owned by Dominik Oreč, Put Strinje 35A, 21212 Kaštel Sućurac, OIB 40273465235. Contact: kontakt@liftslot.com.

Annex II. Description of the processing

Categories of data subjects	The controller's customers (vehicle owners and drivers, and contact people at business customers); people who send a booking request through the controller's public booking page; the controller's staff, as far as they appear in appointment data (assigned mechanic, who created a booking).
Categories of personal data	Name, phone number, e-mail address; vehicle data (make and model, licence plate, VIN, mileage); appointment data (service, date and time, lift, status, price, notes, work done); free-text notes entered by the controller's staff or by the customer in a booking request.
Sensitive data	None intended (clause 7.5).
Nature of the processing	Storage, organisation, display, search, change, export and deletion of data in the app; collecting booking requests on the controller's public booking page; preparing message texts that the controller sends itself; backups.
Purpose	Providing the scheduling and online booking service to the controller under the Terms of use.
Duration	For as long as the controller's account exists, then until deletion as in clause 10(d) (30 days after a deletion request, plus up to 6 hours in backups).
Frequency	Continuous.
Sub-processors	As listed in Annex IV, for the same purposes and duration.

Annex III. Technical and organisational measures

Only measures that are in place today:

Encryption in transit: HTTPS for every connection (with HSTS), and TLS between the app and the database.
Encryption at rest: the database provider (Neon) encrypts stored data with AES-256.
Separation between garages: every garage's data is tagged with its account, and the database enforces row-level security for the app's database user, so one garage can't read another's data even if the app had a bug.
Access control inside a garage: roles (owner, admin, mechanic); only the owner can export data or delete the account; only owner or admin can delete a customer's personal data.
Authentication: passwords and PINs stored only as bcrypt hashes; PIN sign-in locks for 15 minutes after repeated failures; password reset links stored as hashes, single-use, valid for one hour; a password reset signs out every session.
Abuse protection: rate limits on sign-in, sign-up, password reset, PIN sign-in and the public booking form; spam checks on the booking form.
Browser security: Content Security Policy, no framing by other sites, no MIME sniffing, strict referrer policy.
Availability and recovery: database point-in-time restore (6 hours).
Data subject requests: the controller can correct, export and delete customer data in the app; erasure overwrites the customer's name, phone, e-mail and notes, and the vehicle's licence plate and VIN.
Data minimisation: no analytics or tracking; IP addresses aren't stored in the database.
Staff: only the owner of the processor has access to personal data and administrative access to production systems. Apart from that, only the sub-processors in Annex IV process the data, as described there.

Annex IV. Sub-processors

The controller authorises these sub-processors (clause 7.7):

Provider	Purpose	Personal data	Location	Safeguard for transfers outside the EU
Neon, LLC (a Databricks company), USA	Database and its backups	All data in the service	EU: Frankfurt, Germany (Amazon Web Services)	Neon's DPA, with the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914)
Cloudflare, Inc., USA	Hosting, network and security (Workers, DNS, rate limiting, database connection), technical logs	All requests to the service, IP addresses, technical logs	Cloudflare's global network: a request is handled in the data centre nearest the visitor, which can be outside the EU	Certified under the EU-U.S. Data Privacy Framework, with the EU Standard Contractual Clauses in Cloudflare's DPA as a fallback

Resend (e-mail) only receives the data of the garage's own owners and staff, not of its customers, so it isn't listed here. It's in the privacy policy.