Data Processing Agreement

Version of 3 November 2026

This agreement (under art. 28(3) of Regulation (EU) 2016/679 — GDPR) forms part of the contract for the use of TIR Logix and governs the processing of personal data that the Provider carries out on the Customer's behalf.

1. Parties and roles

Controller: the Customer under the TIR Logix contract. Processor: VZ Services legal form, company no. (ЕИК) number, registered office: address, Bulgaria, e-mail: [email protected]. The Processor processes personal data solely on behalf of the Controller and on its documented instructions; the contract, the Terms of Service and the use of the system's functions constitute such instructions.

2. Subject matter, duration, nature and purpose

The subject matter is the provision of TIR Logix as a service: hosting, storage, backups, maintenance and technical support. The duration equals the term of the contract plus the deletion period in clause 9. The nature of the processing is automated storage, retrieval, structuring and display of the data entered by the Controller's users. The purpose is the management of the Controller's fleet and finances. Details in Annex 1.

3. Obligations of the Processor

• process the data only on the Controller's instructions, including with regard to transfers to a third country, unless required to do so by EU or Member State law; in that case the Processor informs the Controller before processing, where the law permits;
• ensure that persons with access to the data have committed themselves to confidentiality;
• implement the technical and organisational measures of Annex 2 and maintain them in line with art. 32 GDPR;
• respect the conditions for sub-processors in clause 4;
• assist the Controller with appropriate measures in responding to data subject requests (access, rectification, erasure, portability etc.) — forward requests received within 3 business days and provide the necessary extracts;
• assist with security, breach notification, impact assessments and prior consultation (art. 32–36 GDPR), taking into account the nature of the processing and the information available;
• notify the Controller without undue delay and no later than 48 hours after becoming aware of a personal data breach, with the information available under art. 33(3), supplementing it as it becomes available;
• on termination delete or return the data as set out in clause 9;
• make available the information necessary to demonstrate compliance with art. 28 and allow audits under clause 6;
• inform the Controller immediately if, in its opinion, an instruction infringes the GDPR or other applicable law.

4. Sub-processors

The Controller gives general authorisation for the sub-processors listed in Annex 3. The Processor notifies the Controller at least 30 days before adding or replacing a sub-processor; the Controller may object in writing within that period on reasonable grounds and, if no solution is found, terminate the contract without penalty. The Processor imposes the same data-protection obligations on every sub-processor in writing and remains responsible for their performance.

5. Transfers outside the EEA

Data is stored in the European Union. Transfers outside the EEA take place only through the sub-processors in Annex 3 and with appropriate safeguards under Chapter V GDPR (an adequacy decision — the EU-US Data Privacy Framework — or standard contractual clauses).

6. Audits

Once a year, with 30 days' written notice, the Controller may request documents and written answers demonstrating compliance with this agreement. An on-site inspection is allowed where there is reasonable suspicion of a breach or at the request of a supervisory authority, during business hours, without compromising the security of other customers, at the Controller's cost unless the inspection reveals a material breach.

7. Obligations of the Controller

The Controller ensures that it has a legal basis for the processing and has fulfilled its duty to inform data subjects; enters only the data necessary for the purpose; does not enter special categories of data under art. 9 GDPR; manages its users and their permissions; and issues instructions in writing (e-mail suffices).

8. Liability

The parties' liability is governed by the contract and the Terms of Service, save where the GDPR provides otherwise.

9. Deletion and return of data

Up to 30 days after the end of the contract the Controller may request a complete copy of the data (SQL dump and/or XLSX). After that period, or earlier at the Controller's request, the Processor deletes the Controller's instance and database; backups are deleted automatically within a further 30 days. Data that EU or Member State law requires to be retained is kept only for that period and purpose.

Annex 1 — Description of the processing

Annex 2 — Technical and organisational measures

• Isolation: a separate container and a separate database per Controller; access between instances is technically impossible.
• Encryption in transit: TLS on every connection; HTTP is redirected to HTTPS; certificates renew automatically.
• Access control: roles and granular permissions; passwords stored only as bcrypt hashes; mandatory change of temporary passwords; login throttling (5 failures per user, 20 per IP address per 15 minutes); short-lived access tokens with automatic renewal and the ability to revoke sessions.
• Traceability: complete history of creation, change and deletion of business data with user and time (Hibernate Envers).
• Availability and recovery: nightly backups of every database, kept 30 days on the server and copied to separate storage; a backup immediately before every update; system monitoring with alerts to the team.
• Software security: daily automated scans of dependencies and images for vulnerabilities, of the repository for leaked secrets and of the code for defects; prompt patching; a protective network layer in front of every address.
• Organisational: production access only for the Processor's team with personal keys; confidentiality obligations; least-privilege principle; documented incident procedure.
• Hosting: EU data centre with physical access control, ISO 27001 certified (Hetzner).

Annex 3 — Sub-processors

The current list is published at tirlogix.com/en/dpa.html; changes are notified under clause 4.