Data Processing Agreement
Version 1, published October 28, 2026
This Data Processing Agreement ("DPA") is part of the Terms of Service between the Workshop (the "Controller") and Lessora sp. z o.o., ul. Stanisławowska 47, 54-611 Wrocław, Poland, KRS 0001273600, Sąd Rejonowy dla Wrocławia-Fabrycznej we Wrocławiu, VI Wydział Gospodarczy KRS (the "Processor"). It meets the requirements of Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR"). The owner accepts it on behalf of the Workshop when creating the account.
1. Subject and duration
1.1. The Processor provides Lessora Auto, an online service for running car repair workshops and tyre shops, and processes personal data on behalf of the Controller to do so.
1.2. This DPA applies for as long as the Processor processes personal data for the Controller, including during deletion at the end of the service.
2. What is processed
Nature and purpose: storing, organising, displaying and sending data, on the web and in the mobile app, so the Controller can manage customers and their vehicles, bookings (including its public booking page), job orders, vehicle intake with photos and signatures, estimates and the customers' approvals, the bay board, staff shifts, parts and stock, tyre storage, service reminders, payments, invoices and their sending to KSeF, mechanic settlements, messages to customers (text messages and email), notifications to staff (email, in-app and push) and reports; importing the Controller's data when it asks; supporting the Controller; keeping the service secure.
Categories of data subjects: the Controller's customers (drivers, people acting for companies and fleets) and other people linked to a vehicle, people who book on the Controller's booking page, the Controller's owners, managers, desk staff and mechanics, and other people the Controller records.
Categories of personal data: names, phone numbers, email addresses, postal addresses, company names and tax IDs (NIP), language, vehicle data linked to a person (registration number, VIN, make, model, mileage readings, inspection and insurance dates), bookings, job orders and their history, complaints and notes written by the Workshop, intake protocols, photos of vehicles (which may show people or registration numbers) and signatures, estimates and decisions on them with time, channel, IP address and browser, payment records, invoices and receipts, stored tyre sets, reminders, consents and their source, messages sent and their delivery status, staff schedules, labour on jobs and settlements, sign-in and security data, mobile devices registered for push notifications (push token, platform, app version), audit log entries, files sent for a data import, and any other data the Controller chooses to enter.
Special categories: not intended. The Controller should not enter special categories of personal data (Art. 9 GDPR) or data about criminal offences (Art. 10 GDPR), for example in notes or photos, unless it is necessary and lawful, and must tell the Processor before it does.
3. Instructions
3.1. The Processor processes personal data only on documented instructions from the Controller. These Terms, this DPA and the Controller's use and settings of the service are the Controller's instructions. Sending an invoice to KSeF when the Controller has turned this on, and sending a text message or email the Controller has set up, are processing on the Controller's instructions. Further instructions must be given in writing (email is enough).
3.2. The Processor tells the Controller if it thinks an instruction breaks data protection law.
3.3. If EU or member state law requires other processing, the Processor tells the Controller first, unless that law forbids it.
4. Confidentiality
Everyone at the Processor who can access the personal data is bound to confidentiality and has access only as far as their work needs it.
5. Security
5.1. The Processor takes the technical and organisational measures in the Annex to protect the personal data, taking into account the state of the art, costs and the risks to data subjects (Art. 32 GDPR).
5.2. The Processor may update these measures, provided the level of protection doesn't go down.
6. Sub-processors
6.1. The Controller gives general authorisation for the Processor to use sub-processors. The current sub-processors are:
| Company | What for | Where |
|---|---|---|
| Webdock | Servers, database and backups | European Union |
| Hetzner Online GmbH | Encrypted off-site copy of the backups | European Union |
| Cloudflare | DNS, encryption in transit and protection from attacks | Worldwide network |
| Stripe | Subscriptions and online payments | European Union and United States |
| ImprovMX | Sending email | European Union and United States |
| LINK Mobility Poland (SMSAPI) | Sending text messages to workshops' customers | European Union |
| Google (Firebase Cloud Messaging) | Push notifications to the mobile app | European Union and United States |
| Apple (Push Notification service) | Push notifications to the mobile app | European Union and United States |
| Sentry | Error and crash reports from the web and mobile app | European Union |
6.2. The Processor tells the Controller (by email to the owner or in the app) at least 30 days before adding or replacing a sub-processor. The Controller may object on reasonable data protection grounds within that time. If the parties can't resolve the objection, the Controller may end the affected service before the change, with a pro-rata refund of prepaid fees.
6.3. The Processor imposes the same data protection obligations on each sub-processor by contract and remains responsible to the Controller for them.
6.4. The National e-Invoicing System (KSeF), run by the Polish tax administration, is not a sub-processor: invoices sent there go to a public authority under the Controller's own legal obligation. Stripe processes payments between the Controller and its customers under the Controller's own agreement with Stripe.
7. Transfers outside the EEA
The Processor hosts the service in the European Union. A transfer to a third country happens only through sub-processors listed in section 6 and only with appropriate safeguards under Chapter V GDPR, such as an adequacy decision or the European Commission's Standard Contractual Clauses.
8. Helping the Controller
8.1. Data subject requests. The service lets the Controller access, correct, export and erase personal data itself. If the Processor receives a request directly, it passes it to the Controller without answering it, unless the Controller agrees otherwise.
8.2. The Processor helps the Controller, as far as reasonable, with security, breach notifications, data protection impact assessments and consultations with authorities (Art. 32 to 36 GDPR).
9. Personal data breaches
The Processor tells the Controller without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting the Controller's data. The notice describes, as far as known, what happened, the data and people concerned, the likely consequences and the measures taken or proposed.
10. Deletion and return
10.1. During the service the Controller can export all its data at any time.
10.2. The service deletes some data on its own: uploaded import files after 30 days and data export files after 7 days.
10.3. When the Controller deletes its Workshop, the data can be restored for 30 days and is then deleted. A Workshop closed for non-payment is deleted as described in section 7.2 of the Terms. Copies in encrypted backups are deleted when those backups expire, within 30 days. Data the Processor must keep by law (for example its own invoices to the Controller) is kept only for that purpose. The Controller keeps its own copies of records it must keep by law, such as its invoices.
11. Audits
The Processor makes available the information needed to show compliance with this DPA. The Controller may audit compliance, including inspections, by itself or an independent auditor bound to confidentiality, with at least 30 days' notice, during business hours, and not more than once a year unless a breach or an authority requires it. Each party bears its own costs.
12. Access by the Processor's staff
Support staff can sign in to the Controller's account only with a stated reason, for support or security. Each such access is recorded in the Workshop's audit log, and staff can't change passwords, two-factor settings or billing while signed in this way.
When the Controller asks the Processor to import its data (a data migration), it attaches the files to a support request in the app. The files stay on the Processor's servers, are not sent by email, can be opened only by support staff, and each download is recorded in the Workshop's audit log. They are used only for that import and deleted once it is done: at the latest 30 days after they were sent, or 7 days after the request is closed. The Controller can delete them earlier in the app.
13. Liability and order of precedence
Liability under this DPA follows the Terms and Article 82 GDPR. If this DPA and the Terms conflict on data protection, this DPA applies.
Annex: technical and organisational measures
- Hosting: servers and database in the European Union.
- Encryption: HTTPS (TLS) for all traffic with HSTS; daily backups encrypted and kept for 30 days, with an encrypted copy in a second EU location; passwords stored only as strong hashes; the Workshop's KSeF token stored encrypted and never shown again.
- Separation: each Workshop's data is kept apart in the application; every query is limited to the current Workshop, and access to another Workshop's records is refused. Uploaded files, such as intake photos and invoices, are stored privately per Workshop and served only to users allowed to see them.
- Customer links: estimate, job and booking pages sent to customers use long random links that work only for that job or booking; the link to an estimate expires.
- Access control: roles and permissions inside each Workshop (owner, manager, desk, mechanic); two-factor authentication for the Workshop's staff, and passkeys; the platform admin requires an authenticator app for every staff account.
- Mobile app: a separate sign-in token per device, kept in the phone's secure storage and revocable at any time; crash reports are stripped of personal data.
- Traceability: an audit log of changes to customers, roles, settings, money, invoices, stock and approvals, and of every support sign-in, kept for 730 days.
- Application security: security headers and a content security policy, protection against cross-site request forgery, rate limits on sign-in and forms, dependencies kept up to date.
- Availability: monitoring of failed background jobs and errors; tested restore from backups.
- Data subject rights: built-in export of a customer's data and of a whole Workshop, and erasure of a customer.
- Staff: confidentiality obligations; access only as needed for the task.