Data Processing Agreement (DPA)

1. Scope and Relationship

This DPA applies to personal data processed by ToCar as processor for customer-controlled data in connection with the service. The customer is controller and remains responsible for lawful instructions and legal basis.

2. Processing Instructions

ToCar processes personal data only on documented instructions from the customer, including as necessary to provide and secure the service. Where required by applicable law to process otherwise, ToCar will inform the customer before such processing begins, unless the law prohibits such notification.

3. Confidentiality

ToCar ensures that authorized personnel processing personal data are bound by confidentiality obligations and receive data protection awareness appropriate to their role.

4. Security Measures

ToCar implements technical and organizational measures appropriate to the risk, including access controls, logging, integrity protection, and incident response capabilities.

5. Subprocessors

ToCar may engage subprocessors to support service delivery. Subprocessors are bound by written data protection obligations that are no less protective than this DPA.

6. Data Subject Rights and Assistance

ToCar provides reasonable assistance to enable the customer to fulfill obligations related to data subject requests, security, breach management, and data protection impact assessments.

7. Personal Data Breaches

ToCar will notify the customer without undue delay after becoming aware of a personal data breach affecting customer-controlled data, and provide available information needed for legal compliance.

8. Return and Deletion

Upon termination of the service, ToCar will return or delete personal data as agreed, unless storage is required by applicable law. Backup lifecycle handling follows operational retention and security controls.