Data Processing Agreement
Effective from 29 October 2026
This Agreement is an integral part of the Terms of Use and is accepted together with them. It is concluded between the Customer as controller and ByteMe, obrt za računalno programiranje i ostale usluge, Hermanova 18D, 10000 Zagreb, OIB 62629762140 as processor, in accordance with Article 28 GDPR. Its structure follows the European Commission's standard contractual clauses between controllers and processors (Implementing Decision (EU) 2021/915).
1. Subject matter and duration
1.1. The processor processes personal data on behalf of the controller to provide the Gumoteka service. The subject matter, nature and purpose of processing, and the categories of data and data subjects are described in Annex 1.
1.2. This Agreement lasts as long as the Terms of Use; the deletion and confidentiality obligations continue afterwards for as long as the processor holds the data.
1.3. In data protection matters, this Agreement takes precedence over the Terms of Use.
2. Controller's instructions
2.1. The processor processes data only on documented instructions from the controller. Instructions are this Agreement, the Terms of Use and actions the controller or its users take in the app. Additional instructions are given in writing or by email.
2.2. The processor promptly informs the controller if it believes an instruction infringes the GDPR or other data protection law.
2.3. If EU or Croatian law requires the processor to process data beyond the instructions, it informs the controller before processing, unless that law prohibits it.
2.4. The controller is responsible for the lawfulness of processing, in particular for the legal basis and for informing its customers under Art. 13 GDPR.
3. Confidentiality
The processor grants access to data only to persons who need it to provide the service and who have committed to confidentiality or are under a statutory duty of confidentiality. At signing, this is only the owner of the obrt.
4. Security of processing
The processor implements the technical and organisational measures in Annex 2 (Art. 32 GDPR). It may improve the measures but must not lower the overall level of protection.
5. Sub-processors
5.1. The controller gives general authorisation to engage the sub-processors listed in Annex 3.
5.2. The processor informs the controller of any added or replaced sub-processor at least 30 days in advance, by email or in the app. Within that period the controller may raise a reasoned objection. If the parties cannot agree, the controller may terminate the contract before the change takes effect and receive a refund of any prepaid amount for the unused period.
5.3. The processor concludes a contract with each sub-processor with the same data protection obligations and is liable to the controller for its performance.
6. Transfers outside the EEA
Data is stored in the EU. Transfer to or access from a country outside the European Economic Area is allowed only with the safeguards of Chapter V GDPR: an adequacy decision (including the EU-U.S. Data Privacy Framework) or the European Commission's standard contractual clauses.
7. Assisting the controller
7.1. The controller can handle most data subject requests (access, rectification, erasure) itself in the app. Where that is not possible, the processor assists at the controller's request.
7.2. If a data subject contacts the processor directly, the processor forwards the request to the controller without delay and does not reply to the data subject itself, unless instructed by the controller.
7.3. The processor reasonably assists the controller with its obligations under Art. 32 to 36 GDPR (security, data breaches, impact assessment, prior consultation), taking into account the nature of processing and the information available to it.
8. Personal data breach
8.1. The processor notifies the controller of a personal data breach without undue delay, and at the latest 48 hours after becoming aware of it.
8.2. The notice contains, as far as known at the time: a description of the breach, the categories and approximate number of data subjects and records, likely consequences, measures taken and proposed, and a contact for more information. What is not yet known is provided later without delay.
8.3. The controller notifies AZOP and the data subjects. The processor does not disclose a breach of the controller's data without the controller's consent, unless required by law.
9. Deletion and return of data
9.1. During the contract, the controller can delete data in the app itself and export it in CSV format under Settings in the app.
9.2. After the contract ends, the processor keeps the data available for export for 30 days. After that it deletes it within 30 days, and from backups within 7 days after that. On request it confirms the deletion in writing. The processor keeps no copies unless EU or Croatian law requires it.
10. Demonstrating compliance and audits
10.1. On request, the processor gives the controller the information needed to demonstrate compliance with this Agreement, including an up-to-date description of measures and the list of sub-processors.
10.2. If that information is not enough, the controller or an independent auditor bound by confidentiality may carry out an audit once a year, with at least 30 days' notice, during working hours and without disrupting the service. The controller bears the cost of the audit unless it finds a material breach of this Agreement. An audit after a data breach or at the request of a supervisory authority is possible outside these limits.
11. Requests from public authorities
If a public authority requests the controller's data, the processor refers it to the controller, informs the controller (unless prohibited) and discloses only the data it must disclose under a valid legal basis. It refuses requests from authorities outside the EU that have no valid legal basis in EU or Croatian law.
12. Liability
The parties are liable to data subjects under Art. 82 GDPR. Between the parties, the limitation of liability in section 9 of the Terms of Use applies, except where the law does not allow it.
Annex 1: Description of processing
| Item | Description |
|---|---|
| Purpose | Keeping records of stored tyre sets for the controller: intake, placement in storage, release, appointments and status overview |
| Nature of processing | Storage, organisation, viewing, modification, printing (QR labels and receipts), display, export, deletion |
| Data subjects | The controller's customers (vehicle owners or users); the controller's workers as authors of set movement records |
| Categories of data | Full name, phone, email, language, notes; licence plates, vehicle make and model; tyre data (brand, model, size, DOT, number of tyres, with or without rims); storage location and branch; appointments; agreed storage price; set movement history |
| Special categories (Art. 9) | Not processed. The controller must not enter them in notes |
| Public access | A customer with a receipt QR code can view their set's details without signing in. Access is protected by a long random code |
| Frequency | Continuous, for the duration of the contract |
| Place of processing | Storage in the EU (Frankfurt, Germany); requests are handled by the Cloudflare data centre closest to the user |
| Duration | For the duration of the contract, with the deletion periods in section 9 |
Annex 2: Technical and organisational measures
| Area | Measure |
|---|---|
| Encryption | All traffic over HTTPS (TLS) with HSTS; database encrypted at rest by the provider; database connection over TLS with certificate verification |
| Sign-in | Passwords stored only hashed; sign-in attempts limited per email and IP address; changing a password signs the person out on all devices |
| Access control | Two roles (owner and worker); only the owner manages accounts and exports data; a worker sees only assigned locations; permissions checked on the server for every action |
| Data separation | Each shop's data separated by shop identifier in every query; no access to other shops' data |
| Application security | Security HTTP headers (CSP, Permissions-Policy); public sign-up API disabled; secret keys kept outside the code repository |
| Administrative access | Only the processor has access to the production database and hosting, with two-factor sign-in to the provider accounts |
| Backups | Neon automatically keeps a short history of database changes, so the database can be restored to its state from a few hours earlier |
| Traceability | Every change of a set's location or status is recorded with time and worker |
| Incident response | Procedure: assessment, containment, notice to the controller within 48 hours, fixing the cause, incident record |
| Minimisation | The app does not ask for customers' OIB, address or other data beyond what storage requires |
Annex 3: Sub-processors
| Sub-processor | Service | Data location | Transfer safeguard |
|---|---|---|---|
| Databricks, Inc. (Neon), USA | Database (PostgreSQL) | AWS eu-central-1, Frankfurt, Germany | Stored in the EU; for any access from the USA, the EU-U.S. Data Privacy Framework or standard contractual clauses |
| Cloudflare, Inc., USA | Hosting of the app and website (Workers), database connection (Hyperdrive) | Requests handled in the data centre closest to the user, inside or outside the EU; permanent storage only in the database in Frankfurt | EU-U.S. Data Privacy Framework and standard contractual clauses in the provider's DPA |
| Google LLC (Gmail), USA | Support email (hello@gumoteka.app), when a shop sends its customers' data in a message | Google data centres, including the USA | EU-U.S. Data Privacy Framework |
When we introduce sending email from the app (e.g. password reset) or error monitoring, that provider will be added here with the notice in section 5.2.
This is a translation. If it differs from the Croatian version, the Croatian version prevails.