Personal Data Processing Agreement

This Personal Data Processing Agreement, hereinafter the “Processing Agreement” or “DPA”, constitutes an appendix to the Terms and Conditions for the provision of the Multiflota service and a part of the Agreement concluded between the Customer and the Service Provider.

1. Parties to the Processing Agreement

1.1. Controller

The controller of the personal data entrusted for processing is the Customer using the Multiflota service, i.e. the entity that has concluded an agreement for the provision of the service with the Service Provider, hereinafter the “Controller” or the “Customer”.

The Controller's data are specified in the organisation account, order, offer, registration form, main agreement or other document confirming the conclusion of the Agreement.

1.2. Processor

The entity processing personal data on behalf of the Controller is:

Aurea Enterprises sp. z o.o., with its registered office at ul. Plac Bankowy 2, 00-095 Warszawa, NIP: 9591956107, KRS: 0000510950, REGON: 260773108, hereinafter the “Processor” or the “Service Provider”.

1.3. Collective designation of the Parties

The Controller and the Processor are hereinafter jointly referred to as the “Parties”, and each individually as a “Party”.

2. Manner of concluding the Processing Agreement

The Processing Agreement may be concluded in electronic form, in particular by accepting its content in the Application, ticking the appropriate checkbox, accepting the Terms and Conditions containing a reference to this Processing Agreement, electronic signature, qualified signature, signing a PDF document or signing a paper document.

The person accepting the Processing Agreement on behalf of the Customer represents that he or she is authorised to represent the Customer or to perform this act on its behalf.

The Service Provider may record evidence of acceptance of the Processing Agreement, in particular: organisation identifier, user identifier, first name and surname, e-mail address, date and time of acceptance, IP address, user-agent, document version, document hash and the content of the accepted version.

3. Definitions

For the purposes of the Processing Agreement, the following terms have the following meanings:

Application - the Multiflota IT system made available by the Service Provider, including through a web browser and the Mobile Application.

Mobile Application - the Multiflota application for a phone, connected to the User account by pairing the phone.

Multiflota - the SaaS service provided by the Service Provider to the Customer, used for managing a vehicle fleet and company.

Vehicle - a vehicle entered by the Controller into Multiflota.

Device - a telematics device installed in a Vehicle, which transmits Readings to Multiflota.

Readings - data transmitted by Devices, in particular reading time, location, speed, ignition status, odometer readings, engine revolutions, fuel level, temperatures, driver media identifiers and other Vehicle signals, as well as data calculated from them, such as fuel events.

Personal Data - personal data within the meaning of the GDPR, entrusted to the Processor by the Controller or processed on behalf of the Controller as part of the use of Multiflota.

Customer Data - Readings, data on Vehicles, Devices, drivers and other persons, documents, files, scans, invoices, calendar data, the content of notifications, conversations with the AI assistant, data from integrations and other content entered, transmitted, stored or generated in Multiflota by the Controller, its Users or its Devices.

GDPR - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.

Sub-processor - a further processor used by the Processor in the provision of Multiflota.

Terms and Conditions - the terms and conditions for the provision of the Multiflota service.

Main Agreement - an agreement, terms and conditions, order, offer, price list or other document specifying the rules for the provision of Multiflota to the Customer.

User - a person using Multiflota on behalf of or at the invitation of the Controller.

4. Subject matter of the Processing Agreement

The Controller entrusts the Processor with the processing of Personal Data to the extent necessary to provide, maintain, secure, develop and support the Multiflota service.

The Processor undertakes to process Personal Data exclusively on the terms set out in this Processing Agreement, the Main Agreement, the Terms and Conditions, the Multiflota documentation and in accordance with the documented instructions of the Controller.

The Processing Agreement does not transfer to the Processor the role of data controller with respect to Customer Data. The Customer remains the controller of Customer Data.

5. Nature and purpose of processing

Personal Data are processed for the purpose of providing the Multiflota service, in particular for the purpose of:

• maintaining the Customer's organisation account,
• supporting User accounts,
• recording Vehicles and Devices,
• receiving, recording and presenting Readings, including the location of Vehicles on a map,
• calculating fuel events and preparing reports,
• handling cost invoices,
• storing files and scans and recognising text in them (OCR),
• supporting calendars and integration with external calendars,
• sending notifications by e-mail, SMS, WhatsApp and to the mailbox in the Application,
• supporting the AI assistant,
• supporting connections with ChatGPT and Claude assistants, if the Controller enables them,
• supporting the Mobile Application,
• ensuring security,
• maintaining technical and audit logs and the log of views of Readings,
• diagnosing errors,
• handling technical requests,
• performing other functions launched by the Controller or the User.

Processing is automated and partly manual in nature, to the extent necessary to provide Multiflota, maintain the system, provide technical support and ensure security.

6. Duration of processing

The entrustment of processing shall continue for the term of the Main Agreement.

After termination of the Main Agreement, Personal Data are processed exclusively to the extent and for the time necessary to:

• enable the Controller to download the data,
• perform the service termination procedure,
• delete, return or anonymise the data,
• perform obligations arising from law,
• pursue or defend against claims, if this concerns data for which the Processor is a separate controller.

Detailed retention periods may be specified in the Main Agreement, the Terms and Conditions, the Privacy Policy, the Multiflota documentation or the configuration of the Customer's account.

7. Types of personal data

Depending on the manner in which the Controller uses Multiflota, the entrusted Personal Data may include in particular:

• identification and contact details of Users and other persons: first name and surname, e-mail address, telephone number, function in the organization,
• data concerning Vehicles: name, registration number, VIN number, make, model and other technical data, service dates,
• data of Devices: device number, board identifier, IMEI number, SIM card serial number (ICCID), IP addresses and connection log,
• Readings: time, location and routes, speed, direction of travel, ignition status, odometer readings, engine revolutions, fuel level, temperatures, supply voltage, identifiers of driver and trailer media, tachograph work statuses, dashboard alarms, driving style summaries (distribution of revolutions, speeds, accelerations and braking) and other data transmitted by Devices,
• fuel events with the quantity, time and place of the event and fuel reports,
• data from cost invoices, including data of sellers conducting business activity,
• data contained in document files and scans and the text recognized in them (OCR),
• data from calendars: events, places, organizers and participants,
• content of notifications, telephone numbers and e-mail addresses of their recipients and information on consents to notifications via WhatsApp,
• content of conversations with the AI assistant,
• view log: who, when, for which Vehicles and for what period viewed Readings,
• technical data related to the use of Multiflota: IP addresses, session identifiers, device names, activity and security logs,
• other data entered by the Controller or Users into Multiflota.

8. Special categories of data and data concerning violations of law

Multiflota is not intended for the processing of special categories of personal data. However, they may be included in files and scans stored by the Controller, for example in medical certificates of drivers. Files may also contain data concerning offences or violations of law, for example fines.

The Controller is responsible for the existence of the proper legal basis for processing such data and for fulfilling information obligations towards data subjects.

The Processor processes such data solely to the extent resulting from the Data Processing Agreement, the Main Agreement and the Controller's instructions.

9. Categories of data subjects

The entrusted Personal Data may concern in particular: Users, employees and associates of the Controller, drivers and other persons using Vehicles, recipients of notifications, contractors and sellers indicated on invoices, persons indicated in documents, calendars or correspondence, as well as other persons whose data the Controller or Users enter into Multiflota.

10. Documented instructions of the Controller

The Processor processes Personal Data solely on documented instructions from the Controller.

Documented instructions of the Controller are deemed to include in particular:

• conclusion of the Main Agreement,
• acceptance of the Terms and Conditions,
• acceptance of the Data Processing Agreement,
• configuration of the organization account,
• introduction of Vehicles and Devices into Multiflota,
• actions of the Controller or Users in the Application,
• entering, transmitting, modifying, deleting or downloading data in Multiflota,
• activating or deactivating functions,
• activating or deactivating integrations, including connections with ChatGPT and Claude assistants,
• granting and revoking permissions,
• ordering the deletion of Device data,
• support requests,
• written or electronic instructions of the Controller.

If the Processor considers that an instruction of the Controller violates the GDPR or other data protection regulations, it shall inform the Controller thereof, unless provisions of law prohibit such information.

11. Obligations of the Processor

The Processor undertakes to:

• process Personal Data solely on documented instructions from the Controller,
• ensure that persons authorized to process data have undertaken to maintain confidentiality or are subject to a statutory obligation of secrecy,
• apply appropriate technical and organizational measures for data protection,
• assist the Controller in fulfilling the obligations arising from the GDPR within the scope specified in the Data Processing Agreement,
• use Sub-processors solely in accordance with the rules specified in the Data Processing Agreement,
• make available to the Controller the information necessary to demonstrate compliance with the obligations arising from Article 28 of the GDPR,
• enable audits under the rules specified in the Data Processing Agreement,
• after the end of the provision of services, delete or return Personal Data in accordance with the Controller's decision, subject to legal obligations,
• not use Customer Data for its own purposes unrelated to the provision of Multiflota,
• not sell Customer Data,
• not use Customer Data to train AI models for general purposes or for other customers without a separate, explicit legal basis or the Controller's consent.

12. Obligations of the Controller

The Controller undertakes to:

• process Personal Data in accordance with the law,
• have the proper legal basis for processing Personal Data in Multiflota, including Readings concerning Vehicles used by specific persons,
• fulfil information obligations towards data subjects, in particular towards drivers and other persons using Vehicles,
• ensure the compliance of the use of Multiflota with regulations on employee monitoring,
• ensure that persons entering data into Multiflota are authorized to do so,
• manage Users' permissions, including access to Vehicles,
• not enter into Multiflota data whose processing in Multiflota would violate provisions of law or the rights of third parties,
• use AI Functions and connections with ChatGPT and Claude assistants in a lawful manner,
• not issue instructions to the Processor that are contrary to law,
• cooperate with the Processor to the extent necessary to perform the Data Processing Agreement.

13. Confidentiality

The Processor ensures that persons authorized to process Personal Data are obliged to maintain confidentiality or are subject to an appropriate statutory obligation of secrecy.

The confidentiality obligation includes in particular Customer Data, Readings, including data on the location of Vehicles, documents, technical data and information concerning the Controller's Organization.

The confidentiality obligation shall also apply after the end of cooperation with a given person and after the end of the Data Processing Agreement.

14. Technical and organizational measures

The Processor applies appropriate technical and organizational measures to ensure a level of security appropriate to the risk of infringement of the rights or freedoms of natural persons.

These measures include in particular: transmission encryption, encryption of files and stored access data, access control, permissions to functions and Vehicles, separation of Customers' data, authentication of Users, event logs and view log, technical monitoring, restriction of administrative access, incident management, security updates and data deletion procedures.

A detailed description of the technical and organizational measures constitutes Appendix No. 2 to the Data Processing Agreement.

The Controller acknowledges that the effectiveness of certain safeguards also depends on the actions of the Controller and Users, in particular on the protection of passwords and telephones with the paired mobile Application, configuration of permissions, use of up-to-date devices and browsers and compliance with security rules.

15. Encryption and access to Customer Data

The Customer's files and scans are encrypted before being saved, with a separate key for each version of the file. Stored access data, in particular for external calendars and Devices, are encrypted, and each decryption thereof is logged. Other Customer Data, including Readings, are protected by access control and separation of Organization data.

The Processor does not request Users to provide a password, key or other authentication data.

The Processor's personnel acting as the platform administrator have access to Customer Data to the extent necessary to maintain, verify and service Multiflota. The platform administrator's access to the Organization's Vehicle and fuel data is recorded in a log: who viewed whose data and when.

To the extent necessary for the operation of selected functions, such as text recognition, AI assistant, sending notifications, integrations or technical support, data may be processed in a form enabling the performance of a given function, solely upon the instruction of the Controller or User and in accordance with the Data Processing Agreement.

16. Subprocessors

The Controller gives general consent for the Processor to use Subprocessors to the extent necessary to provide Multiflota.

The Processor uses only such Subprocessors who ensure an appropriate level of data protection and undertake to process data on terms no less protective than those resulting from this Data Processing Agreement.

The current list of Subprocessors constitutes Appendix No. 3 to the Data Processing Agreement.

The list of Subprocessors includes at least: the name of the Subprocessor, the category of service, the location of processing, information on transfer outside the EEA, if any, and a description of the type of processing.

The Processor shall inform the Controller of a planned change consisting in the addition or replacement of a Subprocessor by publishing an update of the list, by e-mail, by a notice in the Application or through another agreed channel.

The Controller may lodge a justified objection to a new Subprocessor within 14 days of receiving information about the change, if it demonstrates that the use of the given Subprocessor may pose a material risk to the protection of Personal Data.

In the event of a justified objection, the Parties shall enter into discussions in order to find a solution, in particular disabling the given function, using an alternative provider, limiting the scope of processing or terminating the Main Agreement to the extent provided for in its provisions.

The Processor shall be liable to the Controller for the acts and omissions of Subprocessors as for its own acts and omissions, to the extent required by the GDPR.

17. Transfer of data outside the EEA

The Processor strives to ensure that Personal Data are processed within the European Economic Area.

If, in connection with the use of specific Subprocessors or functions, Personal Data are transferred outside the EEA, the Processor shall ensure the application of mechanisms provided for by the GDPR, in particular a European Commission adequacy decision, standard contractual clauses or other required safeguards.

Information on transfers outside the EEA is indicated in the list of Subprocessors.

The Controller acknowledges that the use of certain functions, in particular the AI assistant, notifications via WhatsApp, maps or support chat, may require the processing of data by providers indicated in the list of Subprocessors.

18. Assistance in the exercise of the rights of data subjects

The Processor, insofar as technically and organisationally possible, assists the Controller in fulfilling obligations concerning the rights of persons to whom the Personal Data relate.

The assistance may include in particular: searching for data in Multiflota, providing data, deleting data, including data of a selected Device, restricting processing, rectifying data, providing information from the access log as to who viewed the Vehicle Readings and when, and technical support in handling a request of a data subject.

If a data subject addresses the Processor directly with a request concerning Customer Data, the Processor, provided that it is able to identify the relevant Controller, shall forward the request to the Controller or inform the person that they should contact the relevant Controller.

The Processor does not independently consider requests concerning Customer Data, unless it acts upon the instruction of the Controller or is obliged to do so by provisions of law.

19. Assistance with security obligations, DPIA and consultations

The Processor, taking into account the nature of the processing and the information available to it, assists the Controller in fulfilling the obligations arising from Articles 32-36 of the GDPR, in particular in the scope of: security of processing, assessment of a personal data breach, notification of a breach to the supervisory authority, notification of the data subject, data protection impact assessment and prior consultations with the supervisory authority.

This assistance is provided to the extent relating to Multiflota and the information available to the Processor.

If the assistance goes beyond the standard technical support provided for in the Main Agreement, the Parties may agree on separate organisational or financial terms of such assistance, unless mandatory provisions of law provide otherwise.

20. Personal data breaches

The Processor shall inform the Controller without undue delay after becoming aware of a breach of the protection of Personal Data processed on behalf of the Controller.

The breach notification should contain, insofar as the information is available: a description of the nature of the breach, the categories and approximate number of data subjects, the categories and approximate number of data records concerned by the breach, the possible consequences of the breach, the measures taken or proposed to address the breach, and the contact details of the person or team responsible for communication regarding the breach.

If complete information is not available immediately, the Processor may provide it successively.

The Processor shall take measures aimed at limiting the effects of the breach, securing the data and preventing similar breaches in the future.

Notification of a breach by the Processor does not constitute an admission of liability for the breach.

The Controller is responsible for assessing whether the breach requires notification to the supervisory authority or notification of the data subjects, unless provisions of law provide otherwise.

21. Audit and compliance information

The Processor makes available to the Controller information necessary to demonstrate compliance with the obligations arising from Article 28 GDPR.

In the first instance, the audit is carried out by: making security documentation available, making a description of technical and organizational measures available, providing answers to a security questionnaire, presenting information on Subprocessors, presenting information on procedures and safeguards, and making reports, certificates or attestations available, if such exist and may be provided.

The Controller may conduct an audit or inspection concerning the processing of Personal Data by the Processor, provided that: the audit is justified by the scope of the entrustment, does not compromise the security of other customers' data, does not lead to the disclosure of trade secrets or confidential information of the Processor, does not excessively disrupt the operation of Multiflota, is announced at least 30 days in advance, is conducted during the Processor's working hours, the auditor is bound by confidentiality, and the scope of the audit has been agreed in advance by the Parties.

An audit at the Processor's registered office or within the Processor's infrastructure may be limited for security, organizational or technical reasons. In such a case, the Parties should apply an alternative verification method, e.g. a remote audit, document-based audit or technical meeting.

If the audit exceeds the standard scope of information made available to customers or requires significant involvement of the Processor's personnel, the Parties may agree on remuneration for such audit, unless the audit is necessary due to a personal data breach attributable to the Processor.

22. Deletion or return of data after termination of the Agreement

After the end of the provision of Multiflota, the Processor, in accordance with the Controller's decision, deletes or returns the Personal Data processed on behalf of the Controller, unless European Union law or the law of a Member State requires further storage of the data.

The Controller should download the Customer Data that it wishes to retain before the termination of the Main Agreement or within the period indicated in the Main Agreement, the Terms and Conditions or the Multiflota documentation.

After the expiry of the period provided for downloading the data, the Processor deletes the Customer Data from the systems, subject to data whose storage is required by law or which is necessary for the defense against claims.

23. Logs and technical data

The Processor may process technical logs, security logs, metadata, session identifiers, IP addresses and information on Users' activity to the extent necessary to: ensure the security of Multiflota, detect abuse, audit activities, diagnose errors, handle incidents, ensure system integrity and pursue or defend against claims.

Depending on the purpose and scope of processing, the Processor may process some of such data as a processor or as a separate controller, if the processing serves its own legitimate purposes, such as infrastructure security, accountability or protection against abuse.

24. AI Functions and connections with assistants

The AI Assistant processes the User's questions, previous messages in the conversation and fragments of documents and calendar events, always within the scope available to the User who asks the question. The AI Assistant does not have access to Readings, data on Vehicles or fuel data. Text recognition (OCR) processes scanned pages and images without a text layer. These functions may require data to be provided to the Subprocessors indicated in the list of Subprocessors.

The Processor does not use Customer Data to train AI models for general purposes or for the benefit of other customers without a separate, explicit legal basis or the Controller's consent.

The connection with the ChatGPT or Claude assistant operates only when the Controller enables it in the Organization settings, accepting the declaration concerning the recipient of data on the location of Vehicles, and grants permission to connect assistants to a specific User. The assistant then receives, at the User's request and within the scope of the User's permissions, the last known status of the Vehicles: name and registration number, last location and country, fuel, temperatures, odometer reading and supply voltage, with the reading time. These data are provided to OpenAI or Anthropic as recipients indicated by the Controller and the User and are processed in accordance with the rules of those services. Each retrieval is recorded in the access log. Disabling the connection by the Controller immediately terminates all connections of the given service in the Organization.

The Controller is responsible for assessing whether the use of AI Functions and connections with assistants complies with the Controller's obligations, in particular with information obligations towards drivers and employees.

25. Location data and monitoring of persons using Vehicles

The Processor acknowledges that the Readings make it possible to determine the location, routes and driving manner of persons using Vehicles, and therefore may be used to monitor employees.

Multiflota records the Readings in full. Who in the Organization sees them results from the permissions granted by the Controller, including access to specific Vehicles. Multiflota records in the access log who, when, for which Vehicles and for what period viewed the Readings, and records the generation and viewing of fuel reports.

The Controller is responsible for the purpose and legal basis of processing the Readings, for informing drivers and other persons using Vehicles, and for the compliance of the monitoring with provisions of law, including provisions on employee monitoring.

26. Amendments to the Data Processing Agreement

The Processor may amend the Data Processing Agreement for valid reasons, in particular in the event of: a change in provisions of law, a change in Multiflota functions, a change in safeguards, a change in the system architecture, a change in Subprocessors, a change in the service provision model or the need to clarify the Parties' obligations.

The Processor will inform the Controller of material amendments to the Data Processing Agreement with appropriate advance notice, in particular by e-mail, a notice in the Application or publication of a new version of the document.

If the Controller does not accept the amendments, it may terminate the Main Agreement on the terms specified therein.

27. Priority of documents

In the event of a conflict between the Data Processing Agreement and the Main Agreement in the scope of personal data protection, the Data Processing Agreement shall prevail, unless the Main Agreement provides for a higher level of data protection or the Parties have expressly agreed otherwise.

In the event of a conflict between the Data Processing Agreement and mandatory provisions of law, the provisions of law shall prevail.

28. Liability

The liability of the Parties for breach of the Data Processing Agreement, the GDPR or other data protection provisions is determined by the Main Agreement, the GDPR and applicable provisions of law.

No provision of the Data Processing Agreement excludes or limits liability to the extent to which this would be impermissible under mandatory provisions of law.

29. Final provisions

The Data Processing Agreement remains in force for the term of the Main Agreement, and after its termination to the extent necessary to perform the obligations concerning deletion, return, security or accountability of data.

In matters not regulated by the Data Processing Agreement, the GDPR, other applicable provisions of law, the Main Agreement, the Terms and Conditions and the Multiflota documentation shall apply.

Annex No. 1 - Scope of processing

Subject matter of processing: processing of personal data as part of the provision of the Multiflota service, a SaaS system for managing a vehicle fleet and a company.

Duration: for the term of the Main Agreement and for the period necessary to perform the procedure for termination of the service, downloading and deletion of data, securing claims or performance of legal obligations.

Nature of processing: automated and partially manual processing, including in particular collection (including receipt of Readings from Devices), recording, organisation, structuring, storage, adaptation, modification, retrieval, consultation, use, calculation of derived data, disclosure by transmission within the functions of the system, alignment, combination, restriction, erasure, destruction, encryption and decryption to the extent necessary to perform the functions.

Purpose of processing: provision, maintenance, security and development of the Multiflota service and performance of functions launched by the Controller or Users.

Categories of data subjects: Users, employees and collaborators of the Controller, drivers and other persons using the Vehicles, recipients of notifications, contractors and sellers indicated on invoices and persons indicated in documents, calendars or correspondence.

Categories of data: identification and contact data, data on Vehicles and Devices, Readings (including location and routes, speed, fuel, temperatures, driver carrier identifiers, operating states from the tachograph and driving style summaries), fuel events and reports, data from cost invoices, data contained in files, scans and OCR-recognised text, data from calendars, content of notifications, conversations with the AI assistant, access log, technical data, IP addresses, session identifiers, activity logs and other data entered by the Controller or Users.

Special categories of data: Multiflota is not intended for their processing; they may be included in files and scans entered by the Controller, for example in medical certificates of drivers, as may data concerning offences, for example fines.

Annex No. 2 - Technical and organisational measures

The Processor applies in particular the following technical and organisational measures.

Access control: individual User accounts, permissions to functions and to specific Vehicles granted by the Controller, principle of least privilege, possibility of revoking access, access log for Readings and fuel reports, logging of administrative actions.

Authentication: logging in with individual access credentials, passwords stored only in the form of hashes, one-time codes, additional verification after unsuccessful login attempts, possibility of enabling two-factor authentication, sessions with a limited validity period, separate sessions for paired phones, unlocking the Mobile Application with the phone mechanism.

Encryption: encryption of transmission, encryption of files and scans before saving with a separate key for each file version, encryption of stored access credentials with logging of each decryption, encrypted database and files in the Mobile Application.

Data separation: logical separation of Clients' data, limitation of each data query to the Organization to which it relates, verified by automated tests, separation of organization accounts.

Monitoring and logging: technical logs, security logs, monitoring of errors and availability, detection of anomalies and abuse, removal of e-mail addresses and tokens from server logs, analysis of incidents.

Personnel access: access to Organization data only for personnel performing the role of platform administrator, logging of access by such personnel to Vehicle and fuel data, service access to Devices only through an encrypted tunnel on the basis of named and revocable permissions.

Organisational security: granting access to personnel on a need-to-know basis, obligation of personnel to maintain confidentiality, incident response procedures, request handling procedures, rules for updating and maintaining the system, restriction of access to production environments.

Software development security: change control, test and production environments, automated tests, including tests of company data separation and access denial, security updates, removal of detected vulnerabilities according to risk priority.

Minimisation and retention: transfer of data to providers only to the extent necessary for the operation of a given function, limited retention period for selected technical data, possibility of deleting data of a selected Device, data deletion procedures after termination of the Agreement.

Incidents: procedure for identifying and classifying incidents, actions mitigating the effects of an incident, communication with the Controller, root cause analysis, corrective actions.

Annex No. 3 - List of Subprocessors

The list may be updated in accordance with the “Subprocessors” section of the Data Processing Agreement.

Language

This document is available in Polish and English. The Polish version is the source text; in case of any discrepancy between the versions, the Polish version prevails. The English version is a translation provided for convenience only.