Data processing agreement

Parties and roles

The dealership that uses Veturas is the controller: it decides why and how the data of its buyers and customers is processed. Vargu Digital is the processor: it processes that data only to provide the service. The details of the processing are in Annex I.

Relationship to the Terms

This DPA is part of the Terms of service. If they conflict on data protection, this DPA takes precedence. If a Standard Contractual Clause applies and conflicts with this DPA, the clause takes precedence.

Definitions

Terms such as "personal data", "processing", "controller", "processor", "sub-processor" and "personal data breach" have the meaning given in the GDPR.

Our obligations as processor

• (a) We process personal data only on your documented instructions. The Terms, this DPA and your use of the dashboard are those instructions. If we believe an instruction breaks the law, we tell you.
• (b) Everyone with access is bound by confidentiality.
• (c) We apply the security measures in Annex II.
• (d) We use sub-processors only under the rules below.
• (e) We help you respond to requests from data subjects. The dashboard lets you view, correct, export and delete the data yourself.
• (f) We help you with security, breach notification, impact assessments and prior consultation (Articles 32 to 36), taking into account the information we have.
• (g) At the end of the service we return or delete the data, as described below.
• (h) We give you the information needed to show compliance with Article 28 and allow audits under the rules below.

Your obligations as controller

You confirm that you have a legal basis for the data you enter or collect through Veturas, that you inform buyers how you use their data, and that your instructions comply with the law. Veturas generates a privacy page for your website; review it and adapt it to your business.

Support access

We do not look at your data outside support access. It is opened only for a recorded reason, is read-only, expires on its own within 24 hours and is logged. Every access is shown to the dealership owner in the dashboard with its date and reason.

Sub-processors

You give general authorisation for the sub-processors in Annex III. We give at least 30 days' notice by email before adding or replacing one. You may object within that period on reasonable data protection grounds. If we cannot resolve the objection, you may end the service without a cancellation fee and receive a refund for unused months. Each sub-processor is bound by data protection obligations no weaker than these, and we remain fully responsible for its work.

Personal data breaches

We notify you without undue delay, and no later than 48 hours after we become aware of a breach affecting your data. The notice states what happened, the categories and approximate number of people and records affected, the likely consequences, the measures taken or proposed, and a contact. If we do not have everything at once, we send it in stages. This lets you meet the 72-hour deadline towards the authority.

Transfers outside the European Union

The database, sign-in, file storage and application run in the European Union. Where a sub-processor processes data in a country without an adequacy decision, the transfer is protected by the European Commission's Standard Contractual Clauses (Decision 2021/914). For a dealership established in the European Union, our own support access and the backups kept on our own servers in the country where we are established (the Republic of Kosovo) are covered by Module 2 of those clauses (controller to processor), which are incorporated into this DPA by reference.

Audits

We first offer written answers, a completed security questionnaire or existing documentation, which usually satisfies the request faster. If that is not enough, you may carry out an audit once a year, with 30 days' notice, during working hours, with as little disruption as possible and under confidentiality. Each party bears its own costs, unless the audit shows a material breach on our side.

Return and deletion

You can export your data from the dashboard at any time. When the service ends, the data stays available for 90 days so you can export it; after that it is deleted along with existing copies. Data in automatic backups is deleted on the normal rotation and remains under this DPA until then. We keep data only where a law requires it, and only for as long as that law requires. We confirm deletion in writing on request.

Liability and term

This DPA takes effect when the service begins and lasts as long as we process data on your behalf. The provisions on confidentiality, deletion and liability survive it. Liability is subject to the limitations in the Terms of service. Nothing in this DPA limits the rights of data subjects or either party's liability towards a supervisory authority.

Governing law

This DPA is governed by the law of the Republic of Kosovo, without prejudice to the mandatory provisions of the GDPR that apply to you.

Annex I: Description of the processing

• Subject matter: providing Veturas, meaning the dealership website, stock management, buyer enquiries and customer management.
• Duration: the term of the service, plus the 90-day return and deletion period.
• Nature and purpose: storage, display, organisation, sending notifications, backup, support, export and deletion, solely to provide the service; plus anonymised, aggregated statistics as described in the Terms (no personal data).
• Data subjects: buyers and prospects who contact the dealership; the dealership's customers; the dealership's staff, with or without a dashboard login; previous owners or sellers named in vehicle documents; visitors to the dealership's website.
• Types of data: name, phone, email, message and car of interest; notes and status of an enquiry; sale data entered by the dealership; vehicle documents uploaded to private storage; staff records entered by the dealership (position, contact details, contract, pay, commissions, payments, emergency contact and staff documents in private storage); user accounts; technical data such as IP address in logs.
• Special categories: none. Data under GDPR Articles 9 and 10 is not processed. Do not upload it, including medical notes among staff documents.
• Frequency: continuous.

Annex II: Technical and organisational measures

• Encryption in transit: everything is served over HTTPS/TLS.
• Encryption at rest: provided by the infrastructure sub-processors at the storage layer.
• Dealership separation: row-level security rules in the database ensure each dealership sees only its own data. This is enforced in the database, not only in the application.
• Private storage: vehicle and staff documents are kept in private storage that is not publicly accessible.
• Individual accounts: every user has their own account; we do not use shared accounts.
• Limited support access: time-limited, read-only, logged and visible to the owner.
• Administration: the administration console has no public registration and is limited to the named team.
• Backups: daily backups, kept for 30 days, on servers we operate ourselves.
• Data minimisation: we ask only for the data the service needs.
• Incident response: assessment and notification as described in this DPA.
• Deletion: documented export and deletion process.

We keep this annex honest rather than impressive. If a measure is not listed, do not assume it is in place. Ask us and we will tell you plainly.

Annex III: Authorised sub-processors

• Vercel Inc.: hosting of the application and websites. Location: application functions in Dublin, Ireland (European Union); static content through a global network.
• Supabase Inc.: database, sign-in and file storage. Location: Ireland (European Union).
• Vargu Digital, own infrastructure: daily backups on servers we operate ourselves. Location: Prishtina, Kosovo.
• Porkbun LLC: domain registration and DNS, only for domains we register for the dealership. Location: United States; the transfer is protected by the Standard Contractual Clauses.
• Groq, Inc.: the language model behind the Veturas AI features (reading listings, the registration paper and equipment lists; writing descriptions, social media posts and website translations; the dashboard assistant, which answers questions about the dealership's own stock, sales, enquiries and money). Only the car's data and the text the dealership chooses to send are sent; for the assistant, the question typed and the figures needed to answer it (car data, counts, totals and dates). From the registration paper, names, addresses and personal numbers are removed on the dealership's device before sending, and the photo is not sent. Buyers' names, phone numbers, e-mail addresses and messages are not sent, unless the dealership types them into a question itself: the assistant knows a buyer only by a short code, which is turned back into the name on the dealership's own screen. We do not store the assistant's conversations: they stay in the open browser tab and are gone when it is closed. Location: United States; the transfer is protected by the Standard Contractual Clauses.

Veturas AI features added later (e.g. replies to buyers' messages) are not active. Before they process buyers' personal data, this annex is updated with 30 days' notice.

How this DPA is signed

• By reference: it applies automatically when you accept the Terms of service, without a separate signature.
• Signed copy: email info@veturas.com with the subject "DPA" and we send you a PDF to sign.
• Your own agreement: if your organisation uses its own DPA, send it to us. We will review it and in most cases sign it.