1. Scope and incorporation
This Data Processing Addendum forms part of the Terms and Conditions governing RepairDockCloud / RepairDock Cloud (the “Service”). It applies when a customer uses the Service to process personal data for which that customer is a controller and Gonzalo Cardozo, operating under the commercial name GCPSoft (“Processor”), processes that data on the customer’s behalf.
2. Roles and documented instructions
The customer is the Controller and determines the purposes and means of processing its Customer Data. The Processor will process Customer Data only to provide, secure, support and maintain the Service, to perform the customer’s documented instructions embodied in the Terms, this DPA and use of enabled features, or as required by applicable law. If the Processor believes an instruction infringes applicable data-protection law, it will inform the Controller unless prohibited by law.
3. Confidentiality and personnel
The Processor will ensure that persons authorized to process Customer Data are bound by confidentiality obligations and receive access only as needed for their functions.
4. Security
The Processor will maintain technical and organizational measures appropriate to the risk, including access controls, authentication, tenant separation, logging, backups, secure transport, restricted administrative access, vulnerability and patch management, and procedures for handling security incidents. The measures may evolve provided the overall level of protection is not materially reduced.
5. Subprocessors
The Controller gives general authorization for the Processor to use subprocessors necessary to provide the Service. The current list is available on the Subprocessors page. The Processor will provide at least 30 days’ notice before a material new subprocessor change where reasonably practicable, by email and/or in-product notice. The Processor will impose data-protection obligations on subprocessors appropriate to the services they provide.
6. International transfers
The Service is operated from Uruguay and is hosted in Santiago, Chile, with backup services in the United States and other providers identified on the Subprocessors page. Where GDPR transfer restrictions apply, the parties will rely on a lawful transfer mechanism appropriate to the destination and provider. Uruguay currently benefits from an EU adequacy decision for transfers to Uruguay; onward transfers are assessed separately.
7. Data-subject requests
Taking into account the nature of processing, the Processor will provide reasonable assistance to the Controller in responding to requests for access, rectification, erasure, restriction, objection and portability. The Service includes administrative tools intended to support these workflows. The Controller remains responsible for determining whether a request is valid and for communicating with its data subjects.
8. Personal-data breaches
The Processor will notify the Controller without undue delay after becoming aware of a personal-data breach affecting the Controller’s Customer Data and will provide reasonably available information necessary for the Controller’s assessment and notification obligations. The Processor may provide information in phases as the investigation develops.
9. DPIAs and supervisory authorities
Taking into account the nature of processing and information available to it, the Processor will provide reasonable assistance with data-protection impact assessments and prior consultations where the processing performed through the Service requires them.
10. Return and deletion
Upon termination and at the Controller’s request, the Processor will provide available export mechanisms and will delete or anonymize Customer Data in accordance with the Service’s deletion workflow, subject to legal retention obligations and limited backup retention. Account deletion is not triggered merely because a subscription expires. A confirmed account-deletion request becomes eligible for manual processing after a 30-day grace period. Backup copies may remain protected until they expire under the applicable backup lifecycle.
11. Information and audits
The Processor will make available information reasonably necessary to demonstrate compliance with Article 28 GDPR. Where additional audit rights are legally required, audits must be reasonable, proportionate, protect other customers’ confidentiality and security, and where possible rely first on documentation, records and remote evidence before requesting intrusive access.
12. Controller obligations
The Controller is responsible for having a lawful basis for Customer Data, providing required notices, configuring communications lawfully, managing its users and permissions, and using the Service in compliance with applicable law. Marketing preferences do not disable service-related communications necessary to perform requested services.
Annex I — Processing details
- Subject matter: cloud workshop/service-business management.
- Duration: the customer relationship plus applicable deletion/retention periods.
- Nature and purpose: hosting, storage, retrieval, organization, transmission, support, backup, security, customer communications and optional integrations/AI features enabled by the Controller.
- Data subjects: workshop customers, contacts, employees/users, suppliers and other persons whose data the Controller enters into the Service.
- Data categories: identity/contact details, work orders, assets/vehicles/devices, estimates, invoices, appointments, messages, files/images, notes, custom fields and related business records.
- Special-category data: the Service is not designed for systematic processing of special-category data; Controllers should avoid entering such data unless necessary and lawful.
Annex II — Current technical and organizational measures
- Access is authenticated and scoped by user permissions and workshop/TAG.
- HTTPS is used for production traffic; Cloudflare is used as a reverse proxy/security layer.
- Operational databases, application code and uploaded files are hosted on the production server in Santiago, Chile.
- Backups are stored in Backblaze B2 US East with object lock configured for 30 days; the lifecycle keeps the latest file version.
- Privacy operations are logged without intentionally preserving erased content in the audit record.
This DPA is intended to satisfy the contractual requirements applicable to controller-processor processing under Article 28 GDPR. It does not replace the Controller’s own assessment of its legal obligations.