Data Processing Agreement (DPA)

1. Parties, scope and duration

The business customer identified in the accepted Netfleet order is the controller and JOPA Studio, identified above, is the processor. This DPA is incorporated into the service agreement when accepted with it or agreed separately in writing, including electronically. It covers service delivery and the return/deletion period below. The customer’s authorised account or order contact and contact@jopa.studio are the parties’ operational contacts. JOPA Studio’s own controller activities are described separately in the privacy policy.

2. Processing description

Purpose and operations: hosting, organising, retrieving, updating, exporting and deleting data to provide quoting, fleet and driver management, dispatch, booking, invoicing and document delivery. Data subjects include the customer’s users, staff, drivers, business contacts, passengers and booking contacts.

Data may include names and contact details, company roles, journey and booking information, assignments, professional qualification dates, financial records and uploaded files. The customer must minimise data and document any lawful basis and safeguards for health information or other special categories. Such processing requires an expressly agreed scope and safeguards; it is not authorised merely by the ability to upload a file.

3. Instructions and confidentiality

The processor shall process data only on documented instructions, including the agreement, authorised use of the service and written support instructions, including instructions about transfers. If law requires other processing, it shall inform the controller before processing unless prohibited by law. It shall immediately inform the controller if it considers an instruction infringes applicable data protection law.

Persons authorised to process data shall be bound by confidentiality and have access limited to their duties. The controller remains responsible for lawful collection, notices, instructions and access granted to its users.

4. Security measures

JOPA Studio shall maintain risk-appropriate technical and organisational measures under Article 32 GDPR. These include separation of customer workspaces through tenant-scoped database access, role-based access checks, authenticated sessions, audit trails for application changes, controlled document access and encrypted storage of reusable integration credentials. Production connections must use TLS. Personnel access is limited to duties, subject to confidentiality and revoked when no longer needed.

The production hosting region is the EU on OVHcloud infrastructure. JOPA Studio shall maintain protected database and document backups, restrict backup access, review security events, apply risk-prioritised security updates, test recovery and assess measures regularly and after material changes. Backups must observe the 35-day residual retention ceiling. Measures may evolve without reducing the agreed overall protection. No particular certification or uninterrupted availability is warranted unless expressly agreed in writing.

5. Subprocessors and transfers

The controller grants general written authorisation for OVHcloud as the infrastructure subprocessor listed below and for additional subprocessors expressly identified in its accepted order or an approved update. JOPA Studio shall notify the controller by email at least 30 days before adding or replacing another subprocessor, specifying its identity, task, data, processing locations and transfer safeguards. The controller may object on reasonable data-protection grounds during that period.

The parties shall seek an alternative or effective safeguards before the new subprocessor receives the affected data. If no reasonable solution is available, the controller may terminate the affected service before the change and receive a refund for its unused prepaid period. Every subprocessor must be bound to equivalent obligations, and JOPA Studio remains responsible to the controller for its performance.

Customer-selected mailbox, routing or payment connections are used only on documented instructions and subject to the applicable provider information and role. A provider acting independently, such as for its own regulated payment duties, is not made a subprocessor for those activities by this DPA. An unlisted optional tool is not automatically authorised to receive customer data. Transfers outside the EEA require documented instructions and a valid Chapter V GDPR mechanism; this DPA alone is not an international-transfer instrument.

OVHcloud — GDPR / RGPD

6. Rights requests, incidents and assessments

Taking account of the processing, the processor shall assist with requests to exercise data-subject rights and shall forward requests concerning controller data without responding on the controller’s behalf unless instructed or required by law.

The processor shall notify the controller without undue delay after becoming aware of a personal-data breach, sharing known nature, affected data and people, likely consequences, mitigation and a contact point, with updates as facts become available. The controller decides on notifications to authorities and individuals. The processor shall assist with security duties, impact assessments and prior consultation, taking account of the information available to it.

7. Evidence and audits

The processor shall make available information needed to demonstrate compliance with Article 28 GDPR and allow and contribute to audits and inspections by the controller or its appointed auditor. Practical confidentiality and scheduling arrangements must not prevent effective oversight or urgent investigations.

8. Return and deletion

At the controller’s choice, JOPA Studio shall return or delete personal data after service provision ends and delete existing copies unless Union or Member State law requires retention. A standard export includes workspace records and stored documents. The controller has 30 days after the effective service end or confirmed deletion request to retrieve its export; JOPA Studio completes the retention review and active-system deletion by day 60. Earlier action required by applicable rights or an agreed lawful instruction takes precedence.

Backup copies are unavailable for ordinary processing and expire within a further 35 days. Completed deletions are reapplied before a restored backup is put back into ordinary use. If law requires retention, JOPA Studio identifies the basis, affected data and duration to the controller, limits access and deletes at the end of that requirement. Retention of JOPA Studio’s own accounting evidence does not justify retaining all customer records. On request, JOPA Studio confirms completion of the deletion process.

The application provides a 30-day grace period and a reviewed purge, not automatic deletion on day 30. JOPA Studio coordinates subscription closure where necessary to complete a requested purge. Shared identities and subscriptions are retained only to serve other active companies or a separate lawful purpose; customer-scoped records still follow the agreed deletion schedule.

9. Processing schedule and precedence

The processing description, security measures, subprocessor table and return/deletion clauses above form the processing schedule to this DPA. Additional customer-specific instructions must be recorded in the order or an agreed written amendment. They may not reduce mandatory GDPR protections. The DPA takes precedence over conflicting service terms on personal-data processing; its publication alone does not prove acceptance by a particular customer.

European Commission: controller–processor standard contractual clauses