Data Processing Agreement

Effective from: 04.11.2026

In brief. Your company decides what is tracked and why — you are the controller. We store and display the data on your behalf and do not use it for our own purposes. History is visible for 24 months, and for 3 more months after the service ends. Data is stored in Estonia; sub-processors are listed in Annex 3. You inform vehicle users before tracking begins. This summary is informational; the clauses of the Agreement are binding.

1. General provisions and scope

1.1. This data processing agreement (the "Agreement") is an integral part of the terms of sale and use of the gpsauto.ee online store. The Agreement applies where the customer uses the GPS tracking service (the "Service") in the course of its economic or professional activities; in that case the customer determines the purposes and means of processing location data within the meaning of the General Data Protection Regulation (EU) 2016/679 (the "GDPR") and is the controller of that data.

1.2. The Seller makes the Agreement available to the customer at gpsauto.ee before its acceptance and before processing of location data on the customer's behalf begins. The Agreement is concluded in electronic form (GDPR Art. 28(9)) when the customer accepts the terms of sale and use together with this annex when placing an order, or confirms acceptance by e-mail. Taking the Service into use or paying for it expresses acceptance, provided the Agreement was made available to the customer beforehand and the customer had the opportunity to review it. No separate signature is required; on request we will also sign the Agreement on paper or digitally.

1.3. This Agreement and the controller obligations arising from the GDPR do not apply to a natural person who uses the Service exclusively for personal purposes to track their own or their household's vehicle (GDPR Art. 2(2)(c)). This exemption does not release the Seller from its data protection obligations: the Seller's obligations regarding the protection, retention and deletion of data under the Service terms continue to apply; processing for the Seller's own purposes is described in the privacy policy.

2. Parties and roles

2.1. The controller (vastutav töötleja) is the customer, who decides which vehicles are tracked, for what purpose and to what extent (the "Customer").

2.2. The processor (volitatud töötleja) is OÜ Ravolar Grupp (registry code 10224806; Häälinurme tn 1, Peetri alevik, Rae vald, Harju maakond 75312; e-mail klienditugi@mugavauto.ee; trademark Mugav Auto) (the "Seller"), who processes location data on the Customer's behalf to provide the Service.

2.3. The Seller is an independent controller only to the extent that it processes customer and contact data for its own invoicing, customer relationship management, compliance with legal obligations or its own legitimate security purposes (including security logs); that processing is described in the privacy policy.

3. Description of processing

3.1. The subject matter, nature, purpose and duration of processing, the types of personal data and the categories of data subjects are described in Annex 1. In this Agreement, "location data" means the personal data described in Annex 1 that the Seller processes on the Customer's behalf.

3.2. The rights and obligations of the Customer as controller are set out in clause 4, in the other clauses of this Agreement and in the terms of sale and use (GDPR Art. 28(3)).

4. Customer's obligations and instructions

4.1. Before tracking begins, the Customer determines and documents the legal basis (for an employer, as a rule, legitimate interest or performance of the employment contract; GDPR Art. 6(1)) and ensures that tracking is necessary for and proportionate to its purpose. The existence of an employment contract does not in itself entitle the employer to GPS tracking.

4.2. The Customer informs vehicle users of tracking before it begins (GDPR Arts. 13 and 14), respects employees' right to privacy in employment relationships (Employment Contracts Act § 28(2)(11)) and takes into account the guidance of the Estonian Data Protection Inspectorate. Supporting materials (employer checklist and a model employee notice) are available at gpsauto.ee/info.

4.3. The Seller processes location data only on the Customer's documented instructions. Documented instructions are the order, the terms of sale and use together with this Agreement, the Service settings in the Customer's account, and the Customer's written instructions (including by e-mail).

4.4. If, in the Seller's assessment, a Customer instruction infringes the GDPR or other applicable law, the Seller informs the Customer without delay and may suspend execution of the instruction. If the Customer maintains the instruction after being informed, the Seller may terminate the Service for the device concerned.

5. Seller's obligations as processor

The Seller undertakes (GDPR Art. 28(3)):

a) to process location data only on the documented instructions referred to in clause 4.3, including not to use it for its own purposes; where processing is required of the Seller by Union or Member State law, the Seller informs the Customer before processing, unless the law prohibits such information;

b) to ensure that persons with access to location data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that access is limited to what is necessary for their work duties;

c) to implement security measures in accordance with Article 32 GDPR; the measures are described in Annex 2;

d) to engage sub-processors only in accordance with clause 7;

e) to assist the Customer by appropriate technical and organisational measures in responding to data subjects' requests (GDPR Arts. 12–23): to forward any data subject request received by the Seller to the Customer without delay and, at the Customer's request, to provide extracts, make corrections, restrict processing or carry out deletion that the Customer cannot perform in the Service itself — in good time so that the Customer can meet statutory deadlines;

f) to assist the Customer in complying with the obligations under Articles 32–36 GDPR (including providing available information the Customer needs for an impact assessment or for consulting the supervisory authority), taking into account the nature of processing and the information available to the Seller; the Seller notifies the Customer of a personal data breach without undue delay after becoming aware of it, providing the information referred to in Art. 33(3) GDPR; where not all information is initially available, the Seller sends an initial notification with the available information and supplements it without undue delay;

g) at the end of the Service, at the Customer's choice, to return or delete the data in accordance with clause 6;

h) to make available to the Customer the information necessary to demonstrate compliance with the obligations laid down in this Agreement and to allow audits in accordance with clause 9.

6. Retention and deletion

6.1. Trip and location history is available in the Service on a rolling basis for the last 24 months; older data is deleted on an ongoing basis. The device's last known location is retained after that until the device is deleted, so that the device remains visible on the map.

6.2. At the end of the Service (including an unrenewed service period), the Seller, at the Customer's choice, returns all personal data processed on the Customer's behalf or deletes it. Unless the Customer instructs otherwise, access and the existing data remain available for a further 3 months without new location updates; during this time the Customer can download the data (reports) or renew the service. If the web account reports do not contain all the data to be returned, the Seller hands over the remaining data at the Customer's request in a commonly used electronic format. After the three months have passed, the Seller deletes the device and its entire history; the user account is deleted if it has no other devices. At the Customer's request, the Seller confirms deletion in a form enabling written reproduction.

6.3. On the Customer's written instruction, the Seller deletes the data of a specific device earlier.

6.3.1. Deleted data may remain in backups, in accordance with the backup rotation, for up to 12 months, after which it is permanently erased. Backups are used solely for system recovery and are not processed for any other purpose; the same access restrictions apply to backups as to the production environment. If the system is restored from a backup, the Seller re-deletes the previously deleted data without undue delay. The stated period is an upper limit for the final erasure of backups, not a right to retain data longer than necessary; at the Customer's request the Seller explains the backup retention arrangements.

6.4. Clauses 6.1–6.3 constitute the Customer's instruction within the meaning of GDPR Art. 28(3)(g). If the law requires the Seller to retain data longer, the Seller informs the Customer.

7. Sub-processors

7.1. The Customer gives the Seller general authorisation to engage sub-processors. The sub-processors used at the time of conclusion of the Agreement are listed in Annex 3.

7.2. The Seller gives notice of the addition or replacement of sub-processors on gpsauto.ee/andmetootlusleping and by e-mail to the Customer's tracking system account address at least 14 days in advance (GDPR Art. 28(2)). The notice names the sub-processor, its location and the processing entrusted to it. The Customer may raise a reasoned objection within the same period; until the objection is resolved, the Customer's data is not transferred to the new sub-processor. If no solution is found, the Customer may terminate the Service for the device concerned; in that case the prepayment for the unused period is refunded proportionately.

7.3. The Seller concludes a contract with the sub-processor imposing on it in substance the same data protection obligations as this Agreement, and remains fully liable to the Customer for the sub-processor's performance.

8. Data location and transfers

8.1. Service data is stored on servers in the Seller's possession in Estonia (European Union); no hosting sub-processor is used. Outside the Seller's servers, only encrypted backups are stored with the custodian named in Annex 3 within the European Union. The connection between the web account and the Seller's server is encrypted (HTTPS); the devices transmit location data via the mobile network directly to the Seller's server. No data is stored outside the EEA.

8.2. The Seller transfers location data outside the EEA only on the Customer's documented instruction or where required by Union or Member State law applicable to the Seller, and only on the basis of a Chapter V GDPR safeguard (e.g. the European Commission's standard contractual clauses). The Seller gives notice of engaging a sub-processor located outside the EEA in accordance with clause 7.2; if the Customer does not object within the time limit, this is deemed an instruction permitting the transfer.

9. Audits and information

9.1. At the Customer's request, the Seller provides the information reasonably necessary to demonstrate compliance with the obligations under Art. 28 GDPR.

9.2. The Customer may audit compliance with this Agreement itself or through an auditor mandated by it (GDPR Art. 28(3)(h)). A regular audit takes place up to once a year with at least 30 days' notice, at a time agreed by the parties; in addition, an audit is allowed after a personal data breach, in the event of a reasoned suspicion of a breach of the Agreement, or at the demand of the competent supervisory authority, with notice appropriate to the circumstances. The audit takes place at the Customer's expense, during working hours and in a manner that does not endanger other customers' data or the Seller's trade secrets; the auditor assumes a confidentiality obligation. The Seller may raise a reasoned objection to the auditor's identity (e.g. a competitor of the Seller); in that case the parties agree on an independent auditor. At the demand of the competent supervisory authority, the parties make the information referred to in this clause, including audit results, available to it.

10. Liability and final provisions

10.1. The parties' liability towards data subjects is determined under Article 82 GDPR; this Agreement does not limit data subjects' rights.

10.1.1. As between the parties, each party is liable for breach of its own obligations. The Seller's aggregate liability to the Customer under this Agreement (including recourse claims under GDPR Art. 82(5)) is limited to the total amount the Customer has paid the Seller for the devices affected by the breach and their Service, but not less than EUR 500. The limitation does not apply in the case of intentional breach, gross negligence, or causing death or damage to health (Law of Obligations Act § 106(2), § 42(3)(1) and § 44).

10.1.2. The Customer compensates the Seller for damage and costs (including compensation paid to data subjects and reasonable legal costs) incurred by the Seller because the Customer tracked vehicles without a legal basis, failed to inform vehicle users, or gave the Seller an unlawful instruction. If a party has compensated a data subject for damage for which the other party is liable under GDPR Art. 82(5), it may claim back from the other party that part of the compensation corresponding to the other party's share of responsibility.

10.2. This Agreement is governed by Estonian law. Disputes are resolved by negotiation, failing which in Harju County Court.

10.3. The Seller gives notice of planned amendments to the Agreement on the website and by e-mail at least 30 days in advance, stating the content of and reason for the amendments. Material changes to the purposes of processing, the scope of data or the Customer's rights take effect for the Customer only with the Customer's documented consent; for other amendments, continued use of the Service after entry into force is deemed acceptance. Changes of sub-processors are governed by clause 7.2. If the Customer does not agree to a material amendment, the existing processing continues on the existing terms or the affected part of the Service is terminated with a proportionate settlement of the unused prepayment. In matters of personal data processing, this Agreement prevails in the event of a conflict with the terms of sale and use.

10.4. The Agreement remains in force for the duration of the Service and until the data is deleted in accordance with clause 6.

10.5. Notices relating to the Agreement are given in a form enabling written reproduction: to the Seller at klienditugi@mugavauto.ee, to the Customer at the e-mail address of its tracking system user account. The Customer keeps that address up to date.

10.6. The Estonian text of the Agreement prevails; translations are provided for information.

Annex 1. Description of processing

Subject matter. GPS tracking service: collection, recording and display of the location and trip data of the Customer's vehicles in the Customer's web account.

Nature of processing. Collection, recording, storage, structuring, display, preparation of reports, deletion.

Purpose. Purposes determined by the Customer, such as fleet management, recording of work trips (including a trip log), protection of property and logistics management.

Types of personal data. Vehicle location and movement routes, speed, trip and stop times; the vehicle registration number and other vehicle identifiers where contained in the device name or in data provided by the Customer; technical identifiers of the device and SIM card; the device name (usually the vehicle registration number or make/model) and the contact details provided by the Customer for the device (contact person, telephone) — at the Customer's choice these may contain data of natural persons, for the lawfulness of which the Customer is responsible; notifications configured by the Customer. Special categories of personal data (Art. 9 GDPR) are not deliberately processed.

Categories of data subjects. Users of the Customer's vehicles (including employees) and other persons about whom the data configured by the Customer may contain information.

Duration. The period of validity of the Service and 3 months after its end; history on a rolling basis for the last 24 months; in backups for up to 12 months after deletion (clause 6 of the Agreement).

Annex 2. Technical and organisational security measures

• Access to the Customer's web account is via personal user accounts; passwords are stored hashed with salt; the Customer manages its own users' access itself.
• The web account connection is encrypted (HTTPS); the devices transmit data via the mobile network directly to the Seller's server.
• The servers are located in Estonia on premises in the Seller's possession; physical access to the servers is restricted to persons authorised by the Seller.
• Access to the server and data is restricted to persons authorised by the Seller; the tracking system administrator account is personal, and administrator rights are not granted to customers.
• Regular backups are made; the same access restrictions apply to backups, they are retained for up to 12 months and used solely for system recovery; outside the Seller's servers, backups are stored only in encrypted form.
• System and login logs are kept; technical server logs (including device traffic) are retained for up to 7 days; the software is updated regularly.
• The Seller may supplement or replace the measures described in Annex 2 with at least equivalent measures without the notice referred to in clause 10.3; a reduction in the level of protection constitutes an amendment of the Agreement within the meaning of clause 10.3.

Annex 3. Sub-processors

The Seller provides the Service on its own server infrastructure in Estonia; no hosting sub-processors are used.

System e-mails (notifications, password reset) are sent by the Seller's own mail server in Estonia; no external e-mail service is used. Geocoding (displaying an address based on coordinates) is performed on the Seller's servers. To display the map, the Customer's browser connects to the map service provider (Google) and transmits to it at least the user's IP address and the requested map area; the map service provider receives no personal data from the Seller, and its processing is described in the privacy policy.

The mobile network operator in whose network the device's SIM card operates transmits data as a communications service provider and acts as an independent controller under the Electronic Communications Act.