Data processing agreement (GDPR, Article 28)

1.Purpose and parties

This agreement is concluded between the customer garage, as controller (the “Customer”), and Orfi BODLLI EI, a sole trader trading as Praz SI (185 avenue des Nations, 57970 Yutz, France; SIREN 131 404 634 — RCS Thionville), as processor (“Praz SI”). It applies to all the personal data that Praz SI processes on behalf of the Customer within the service, for the whole duration of the subscription.

It supplements the general terms of sale and prevails over them for everything concerning personal data. The version signed by the Customer in “My documents” is authoritative; this page reproduces its content so that everyone can read it.

2.Roles

The Customer decides why and how its customers’ data is processed: it is the controller. Praz SI acts for it, on its instructions: it is the processor.

For the Customer’s own data (account, billing, security log, signed documents), Praz SI is the controller: that processing is described in the privacy policy.

3.Data subjects and categories of data

Data subjects: the garage’s customers and prospects, the people who call or write to it, and the members of its team.

Data processed: identity, phone, email, address; vehicles (registration number, make and model, mileage, photo of the registration document); content of calls and messages (summary, transcript and, if the Customer activates it, audio recording); appointments, quotes, invoices and payments; photos sent for a repair; contact preferences and consents.

No so-called sensitive data (health, opinions, etc.) is requested. If a person spontaneously provides some over the phone, it is not used.

4.Register of entrusted processing: purpose, legal basis, retention

Each processing below is carried out on behalf of the Customer. The legal basis is the one that founds the processing between the garage and its customer; the retention periods are default periods; the Customer can shorten them for a person by erasing that person’s record.

– Incoming calls (answered by Sia, appointment booking, message taking): performance of the contract between the garage and its customer or pre-contractual measures; transcript and summary kept as long as the customer’s record exists.

– Audio recordings of calls (option activated by the Customer): legitimate interest of the garage, with callers informed at the start of every call; ninety days, then automatic deletion.

– Outgoing calls by Sia (car ready, confirmation the day before, servicing, roadworthiness-test and tyre reminders, quote follow-up): performance of the contract for messages related to a service in progress; the customer’s consent for reminders that offer a service; same retention as incoming calls. Available only once they have been checked and activated.

– Automatic messages by text message, email or messaging (confirmations, reminders, follow-ups): same bases as above; kept with the customer’s conversation.

– Emails from the garage’s mailbox, if the Client links it to the service: the inbox is read (nothing is deleted or marked as read there) and each email is filed in Messages like the other messages received; same bases and same retention. The Client removes this access in one click; it is removed at the end of the contract. The mailbox password is encrypted and never shown.

– Photo of the registration document (automatic reading of the registration number and model): performance of the contract; as long as the vehicle appears in the customer’s file.

– Photos sent by the customer for a repair (leak, part, warning light): performance of the contract; as long as the workshop record exists.

– Review requests after a job: legitimate interest, sent to all the customers concerned without selection; twelve months, with immediate compliance with any unsubscription.

– Online booking on the garage’s mini-page: pre-contractual measures then performance of the contract; as for appointments.

– Sia demonstration and call-back requests made by a prospect of the garage: consent; twelve months.

– Prospecting by the garage towards its own customers (text-message and email campaigns): consent or legitimate interest depending on the country and the relationship; until consent is withdrawn or the person unsubscribes, which are complied with immediately (“STOP” word, link).

– Garage memory (“Sia learns your garage”: habits, durations, validated answers): performance of the contract; no customer data, only the garage’s operating rules, kept for the duration of the contract and editable by the Customer.

– Diagnosis with photo analysis (help for the mechanic): performance of the contract; the photo is described by a provider’s model and is then not kept by this processing; only the description enters the analysis, kept with the workshop record.

– Interpreter at the counter, conversation on the garage’s website (online assistant), public directory and online payment of invoices: processing planned but not yet built; they will be added here, with their legal basis and retention period, before being offered.

– Cookie-free usage statistics: legitimate interest of Praz SI; aggregated data, without identification of persons.

As controller, the Customer checks that these purposes, legal bases and retention periods are suitable for its country and its activity; Praz SI applies the retention periods stated above.

5.Customer’s instructions

Praz SI processes data only on the Customer’s documented instructions, as they result from this agreement, the general terms and the settings chosen by the Customer in its workspace (announcements, recording, message channels). Praz SI informs the Customer if an instruction appears to it to infringe the law.

Praz SI never uses the data of the garage’s customers for its own account (prospecting, resale, model training), except anonymous and aggregated statistics.

6.Confidentiality and security

The persons authorised to process the data (Praz SI team) are bound by confidentiality. The measures in place are described on the “Security” page: each garage’s data isolated from the others’, encryption of exchanges, role-based access control, security log, nightly backups, passwords never stored in clear text, verification of the automatic messages received from providers.

What is not yet in place is stated on that same page (no certification, no external audit to date).

7.Sub-processors

The Customer authorises Praz SI to use the sub-processors listed in the annex for hosting, routing of calls and text messages, sending of emails, speech synthesis and recognition, language models, payment and the Google services connected by the Customer.

Any addition or replacement is announced to the Customer at least thirty days in advance (email and “My documents”), with the possibility to object; in case of a justified objection, the Customer may terminate free of charge. Praz SI imposes on each sub-processor obligations equivalent to those of this agreement and remains liable to the Customer for their performance.

8.Transfers outside the European Union and outside Switzerland

Several sub-processors are established in the United States or process data there. Praz SI transfers data outside the European Union and Switzerland only to sub-processors for which the transfer is governed by a safeguard provided for by the GDPR and Swiss law: adequacy decision (the EU–US Data Privacy Framework and, for Switzerland, its extension recognised by the Swiss Federal Council, for the providers certified under it) or standard contractual clauses. The safeguard relied on for each provider, according to the documents it publishes, appears in the annex. A provider that publishes no transfer safeguard is not used: this is why the voices of such a provider, even when offered by the voice assistant platform, are not offered by Praz SI.

Hosting region (site, database and files): Frankfurt (Germany). The host is a company established in the United States, where its main operations are located: data may be processed there, with the safeguards above.

9.Rights of data subjects

Praz SI helps the Customer respond to data subjects’ requests (access, rectification, erasure, objection, portability) through the functions of its workspace: complete export of a customer’s data, permanent erasure (which also removes that data from the garage’s backups and has the customer’s calls deleted at the telephony provider; issued invoices, kept under the accounting obligation, lose the customer’s phone number and e-mail: only the name, address and business number remain), unsubscription from messages. Any request received directly by Praz SI is forwarded to the Customer without delay, without answering it in the Customer’s place.

10.Data breach

Praz SI notifies the Customer of any personal data breach as soon as possible, and at the latest seventy-two hours after becoming aware of it, with the information needed for the notification to the authority (CNIL in France, FDPIC in Switzerland, CNPD in Luxembourg) and, if necessary, to the data subjects.

11.End of the agreement and retention

At the end of the agreement, the Customer can export its data (complete backup, exports per customer). Praz SI then deletes it, together with its copies and backups, within ninety days, except where a legal retention obligation applies (invoices: at least ten years, accounting obligation). Only the customer’s name, address and business number remain on those invoices: the phone number and e-mail are removed.

In case of termination for non-payment, the data is kept longer (twelve months by default) to allow a resumption without loss if the garage settles its situation; after that period, it is deleted. This period is stated to the Customer at the time of termination.

12.Control and audit

Praz SI makes available to the Customer the information needed to demonstrate compliance with its obligations (this page, the “Security” page, the list of sub-processors, the register) and allows, at the Customer’s reasonable request and expense, an audit by an independent third party bound by confidentiality, once a year at most, without access to other garages’ data.

13.Register of processing activities and impact assessment

Praz SI keeps its own register of processing activities (GDPR, Article 30): the processing carried out on behalf of garages (this document) and the processing for which it is the controller (privacy policy). The Customer may rely on this document to keep its own register.

The data protection impact assessment (DPIA, Article 35 of the GDPR) falls to the Customer where a processing is likely to result in a high risk: call recording, automatic outgoing calls, use of artificial intelligence for large-scale appointment booking. Praz SI helps the Customer carry it out, by providing on request the description of that processing, of the providers and of the security measures.

14.Garages established in Switzerland

For a Customer established in Switzerland, references to the GDPR also mean the Swiss Federal Act on Data Protection (revised FADP, “nLPD”, in force since 1 September 2023, Article 9 for processing by a processor) and its ordinance; breach notifications are made to the Federal Data Protection and Information Commissioner (FDPIC) where the law requires it. In Switzerland, recording a conversation without the consent of the other participants is punishable by law (Article 179ter of the Swiss Criminal Code): every recorded call starts with a clear announcement, and it is for the Customer not to activate recording if it considers that this announcement is not sufficient to obtain its callers’ consent.

15.Annex: list of sub-processors by name (at the date of this version)

This annex forms part of the agreement. It is updated at each change, with the thirty-day notice provided for above. Country: the provider’s registered office; transfer safeguards: at the end of the annex, provider by provider.

– Render (Render Services, Inc., United States): hosting of the site, the database and the files. Server region: Frankfurt (Germany); the company’s main operations in the United States.

– Autocalls (MULTICODE S.R.L., Romania): voice assistant platform (answering of calls by Sia, transcription, speech synthesis); servers in the European Economic Area or in the United States.

– Voice providers used by Autocalls: ElevenLabs (United States), Cartesia (United States), Microsoft Azure (United States): synthesis of Sia’s voice, depending on the voice chosen.

– Twilio (Twilio Inc., United States): telecom operator (phone numbers, routing of calls and text messages).

– Anthropic (Anthropic, PBC, United States, and Anthropic Ireland, Limited for the European Union and Switzerland; processing in the United States): Sia’s language models (understanding of requests, drafting of summaries and answers, description of photos for diagnosis) when Praz SI activates this provider; on Praz SI’s own behalf only, reading and translation of the replies of the garages it prospects (see the privacy policy).

– OpenAI (OpenAI Ireland Ltd, Ireland, and OpenAI, L.L.C., United States; processing in the United States): the same language models, when Praz SI has not activated Anthropic.

– Stripe (Stripe, Inc., United States, and Stripe Payments Europe for the European Union): payment of subscriptions, invoices, and later online payment of the garage’s invoices.

– Resend (Plus Five Five, Inc., United States): sending of emails (confirmations, reminders, invitations, invoices).

– Google (Google LLC, United States, and Google Ireland for the European Union): connected calendar, review requests and business listing, depending on the services connected by the Customer.

– Coming, announced with notice before use: identification of a vehicle by its plate, parts catalogue.

Transfer safeguards relied on for each provider, according to the documents it publishes: Render, Twilio and Stripe: certification under the EU–US Data Privacy Framework and its Swiss extension, with the standard contractual clauses of their data processing agreement as a fallback; Google: certification under the same framework and its Swiss extension; Microsoft Azure: certification under the EU–US framework; Resend, ElevenLabs and Cartesia: EU–US framework and standard contractual clauses; Anthropic: certification under the EU–US framework and its Swiss extension, and the standard contractual clauses of its data processing agreement; OpenAI: standard contractual clauses of its data processing agreement; Autocalls: established in the European Union, it governs itself the transfers to its servers and its voice providers.

For any question about this list: contact@praz.si.

This English translation is provided for convenience. In case of discrepancy, the French version of this document, published at praz.si/juridique, prevails.