Data Processing Agreement (Article 28 GDPR)

Version 2026-10-21. Between the repair shop using Repair Command Center ("the controller") and EVOCELL S.R.L., company ID 38764900, Str. Valea Miroslavei nr. 1B, Camera 1, Miroslava village, Miroslava commune, Iași County, Romania ("the processor", "we"). It forms part of the RepairCmd Terms of Service and is accepted together with them by the shop account's owner. The Romanian version prevails if versions differ.

In short

  • Your customers' data is yours. We use it only to make RepairCmd work for your shop.
  • We do not sell it, use it for our own purposes or show it to other shops.
  • We use only the providers in Annex 3 and tell you before adding a new one.
  • We help you when a customer exercises their rights and tell you without undue delay if an incident happens.
  • At the end you get your data back (the export, and anything outside it on request) and we delete it, as you choose.

1. Subject and duration

We process personal data of the controller's customers to provide RepairCmd (Annex 1), for as long as the account exists. Nature of processing: storage, organisation, display, transmission at the controller's request, backups and deletion.

2. Instructions

We process the data only on the controller's documented instructions: this agreement, the Terms and the actions the controller takes in the app. If we think an instruction infringes the law, we tell you. If the law requires us to process data, we inform you first unless the law forbids it.

3. Confidentiality

People with access to the data (currently only EVOCELL's technical staff) are bound by confidentiality and have access only as needed to operate and support the service.

4. Security (Article 32)

We apply the measures in Annex 2 and update them according to risk. We do not lower the level of protection without telling you.

5. Sub-processors

  • The controller gives a general authorisation for the providers in Annex 3.
  • We notify you in the app or by e-mail in advance before adding or replacing a provider, so you can object on reasonable grounds. If no solution is found, you may close the account at no cost.
  • We impose equivalent data-protection obligations on each provider and remain responsible to you for them.

6. International transfers

Some provider services may involve processing outside the EEA (Annex 3). Such transfers happen only with the appropriate safeguards provided in that provider's data processing terms: the European Commission's standard contractual clauses and/or the EU-US Data Privacy Framework.

7. Help with data-subject rights

RepairCmd lets you export data and remove a customer's contact details. If one of your customers contacts us directly, we ask for only their name, contact and your shop's name, handle that message as our own correspondence (Privacy Policy), forward the request to you without undue delay and do not answer in your place unless you ask us to; we keep only proof that it was forwarded. We also help, where possible, with impact assessments and consultations with the authority.

8. Personal-data breaches

We notify you without undue delay after becoming aware of any security breach affecting your data, with the information available (nature, categories and approximate number of people and records, likely consequences, measures taken), completed as it becomes known. We help you meet your notification duties (Articles 33–34 GDPR).

9. Deletion and return at the end

When the account is closed, the controller chooses: return of the data (the export, plus any data outside it on request) and/or its deletion. We then delete the data from the database without undue delay after the confirmed request and confirm it in writing. Encrypted database backups expire automatically within at most 400 days and are used only to restore after an incident and for restore tests on an isolated system. Exception: data the law requires us to keep.

10. Audits and information

We provide the information needed to demonstrate compliance with this agreement (description of measures, provider list, restore-test results). We allow and contribute to audits, including inspections, by the controller or an auditor it mandates (Article 28(3)(h) GDPR), with reasonable notice, at the controller's cost and respecting other customers' confidentiality. Routine on-site audits are normally held at most once a year; additional audits take place after an incident, when a supervisory authority requires it, or when the information provided is not sufficient to demonstrate compliance.

11. Responsibility

Each party is responsible for its own GDPR obligations. The controller is responsible for the lawfulness of the data it enters and the instructions it gives. The liability limits in the Terms also apply to this agreement, as far as Article 82 GDPR allows.

12. Term and precedence

The agreement lasts as long as we process data for the controller. Between this agreement and the Terms, this agreement prevails on data protection. Romanian law applies.

Annex 1 — Processing

  • Data subjects: the controller's customers and their contact persons; the controller's staff, as far as they appear in the history.
  • Data categories: name, phone, e-mail, address (if entered); device brand, model, IMEI or serial number; fault, repair ticket, quotes, approvals, warranties; photos and attachments; payments and financial-document references; messages; action history.
  • Special categories (Article 9): not required. The controller must not enter them in notes or photos.
  • Purpose: managing the controller's repairs in RepairCmd and technical support requested by the controller.

Annex 2 — Technical and organisational measures (implemented on 2026-10-21)

  • Encrypted connections (HTTPS/TLS) between browser, server and database.
  • Per-shop data isolation enforced in the database (Row-Level Security) and server-side authorisation checks; customers' public access only through private links.
  • Passwords stored only as hashes; minimum length 10; e-mail confirmation; two-step verification (TOTP) mandatory for platform administrators.
  • Daily backups encrypted with OpenPGP, stored in a Cloudflare R2 bucket in the EU jurisdiction with deletion lock (31 days daily, 400 days monthly), recovery key held offline by EVOCELL, and a weekly automatic restore test.
  • Backup monitoring with failure alerts; a log of important actions.
  • Application secrets are kept only on the server, with restricted access.

Annex 3 — Sub-processors

  • Supabase, Inc. — database and authentication; data stored in the EU (Ireland, eu-west-1); US company (SCC / DPF).
  • Acvile Tech / Cloudify.ro — application server; Romania.
  • Cloudflare, Inc. — network, DNS, CDN and firewall; photo storage (R2); encrypted backups (R2, EU jurisdiction); US company (SCC / DPF).
  • Brevo (Sendinblue SAS) — account e-mails sent to the shop's users; EU.

Invoicing through SmartBill (optional): if the controller connects its OWN SmartBill account, RepairCmd sends the invoice data (customer billing details, lines, amounts) to that account only when a user confirms an invoice. SmartBill then processes it under the controller's own contract with SmartBill, not as our sub-processor.

E-mail is not a channel for processing the controller's customer data under this agreement: support requests refer to repairs by ticket number, and the controller does not send its customers' personal data by e-mail (our support mailbox, Cloudflare Email Routing → Google Gmail, is described in the Privacy Policy). Backup monitoring (Healthchecks.io) receives no data of the controller's customers.

Version 2026-10-21