Data Processing Addendum

1. Roles

The Customer is the controller (or “business”) for personal data entered into the service. Dhorenz is the processor (or “service provider”) and processes that data only to provide the service.

2. Subject matter and duration

Processing covers the hosting, storage, display and transmission of Customer Data for the duration of the subscription and the return or deletion period that follows.

3. Nature of the data

• Categories of people: the Customer’s drivers, fleet managers, shop staff and other invited users.
• Types of data: names, work email addresses, roles, sign-in records, and entries made in the service (readings, inspections, defect notes, work order records), with author and time.
• The service is not designed for sensitive categories of data, and the Customer will not enter them.

4. Instructions

Dhorenz processes personal data only on the Customer’s documented instructions, which are these terms, the order and the Customer’s use of the service’s settings. Dhorenz will tell the Customer if it believes an instruction breaks the law. Dhorenz will not sell the data or use it for its own purposes.

5. Confidentiality and security

People authorized to process the data are bound by confidentiality. Dhorenz maintains appropriate technical and organizational measures, including encrypted connections (HTTPS), password-protected access, role-based permissions within the service and restricted internal access.

6. Sub-processors

The Customer authorizes Dhorenz to use sub-processors, such as its hosting provider and email delivery provider, to provide the service. Dhorenz imposes data protection obligations on each sub-processor equivalent to those in this addendum and remains responsible for them. The current list is available on request, and Dhorenz will notify the Customer of new sub-processors so the Customer can object on reasonable grounds.

7. Assistance

Taking into account the nature of the processing, Dhorenz will help the Customer respond to requests from individuals exercising their rights and meet its own obligations on security and incident notification.

8. Security incidents

Dhorenz will notify the Customer without undue delay after becoming aware of a breach of security affecting Customer personal data, with the information reasonably available to help the Customer meet its obligations.

9. Return and deletion

At the end of the subscription, the Customer may request an export of its data within 30 days. After that period, Dhorenz deletes Customer Data from the service, except where the law requires it to keep a copy; backups are overwritten in the normal course.

10. Audits

On reasonable written request, and no more than once a year, Dhorenz will provide the information necessary to show compliance with this addendum.

11. Contact

Questions about this addendum: contact@dhorenz.com.