Version 1in force since 19 October 2026
Data processing agreement
How Bayloop processes personal data for a workshop, as the GDPR asks of a processor (Article 28).
1. Parties, Subject Matter and Scope
1.1 This Data Processing Agreement ("DPA") is concluded between the Customer, as defined in the Terms of Service, acting as controller (the "Controller"), and to be filled in, registration number to be filled in, registered address to be filled in ("Bayloop"), acting as processor (the "Processor").
1.2 This DPA forms part of the Agreement and governs the processing of personal data by Bayloop on behalf of the Controller in the provision of the Services, in accordance with Article 28 of Regulation (EU) 2016/679 (the "GDPR").
1.3 This DPA does not apply to the processing of personal data for which Bayloop is the controller, as set out in the Privacy Policy, including the processing of the data of the Controller's representatives for the purposes of the Agreement.
1.4 In the event of a conflict between this DPA and the Terms of Service concerning the processing of personal data, this DPA prevails.
2. Definitions
2.1 Capitalised terms not defined in this DPA have the meaning given to them in the Terms of Service. The terms "personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meaning given to them in the GDPR.
2.2 "Controller Personal Data" means the personal data contained in Customer Data that Bayloop processes on behalf of the Controller. "Subprocessor" means any third party engaged by Bayloop to process Controller Personal Data. "Applicable Data Protection Law" means the GDPR and the laws of the Member States of the European Union implementing or supplementing it, in particular the Personal Data Processing Law of the Republic of Latvia.
3. Details of the Processing
3.1 The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1.
3.2 The processing continues for the duration of the Agreement and thereafter until the deletion of the Controller Personal Data in accordance with section 17.
4. Obligations of the Controller
4.1 The Controller is responsible for the lawfulness of the processing of Controller Personal Data, including the existence of a legal basis, the provision of information to data subjects in accordance with Articles 13 and 14 GDPR, and the obtaining of any consent required, including consent for the use of photographs of vehicles in marketing and for the sending of marketing communications.
4.2 The Controller shall ensure that its instructions comply with Applicable Data Protection Law and shall not instruct Bayloop to process special categories of personal data within the meaning of Article 9 GDPR or personal data relating to criminal convictions and offences within the meaning of Article 10 GDPR.
5. Instructions of the Controller
5.1 Bayloop processes Controller Personal Data only on the documented instructions of the Controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law to which Bayloop is subject. In such a case, Bayloop informs the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
5.2 The Agreement, this DPA, the settings selected by the Controller in the Services (including the permissions of the AI Functionality) and the actions taken by the Controller and its Users in the Services constitute the Controller's documented instructions. Further instructions may be given in writing, provided that they are consistent with the Agreement.
5.3 Bayloop shall immediately inform the Controller if, in its opinion, an instruction infringes Applicable Data Protection Law, and may suspend the execution of that instruction until it is confirmed or amended by the Controller.
6. Processing for Authorised Purposes of Bayloop
6.1 The Controller authorises Bayloop to process Controller Personal Data for the following purposes of Bayloop, as described in the Privacy Policy: (a) to compile statistics on the use of the Services, provided that the resulting statistics are anonymised or aggregated so that they do not identify the Controller, any data subject or any other person; and (b) to maintain, troubleshoot and test the Services, including the restoration of backups for testing purposes.
6.2 For the purpose in clause 6.1(b), Bayloop investigates faults in the production environment where possible. Bayloop copies Controller Personal Data to a test environment only where strictly necessary to investigate a specific fault, pseudonymises it where possible, protects it with the same security measures as the production environment, and deletes it as soon as the fault has been resolved.
6.3 To the extent that Bayloop determines the purposes and means of the processing referred to in clause 6.1, Bayloop acts as a controller in accordance with Article 28(10) GDPR and is responsible for that processing under Applicable Data Protection Law. Bayloop does not use Controller Personal Data for any other purpose of its own, and in particular not to train artificial intelligence models.
7. Confidentiality
7.1 Bayloop ensures that the persons authorised to process Controller Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that they access Controller Personal Data only to the extent necessary for their tasks.
7.2 Bayloop staff access the Controller's account in the Services only through support access that is visible to the Controller, recorded, limited in time and, unless changes are required for the task concerned, read-only.
8. Security of Processing
8.1 Bayloop implements the technical and organisational measures set out in Annex 2 to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing.
8.2 Bayloop may update the measures in Annex 2 as technology develops, provided that the overall level of protection is not reduced.
9. Engagement of Subprocessors
9.1 The Controller grants Bayloop a general written authorisation to engage Subprocessors. The Subprocessors engaged at the date of this DPA are listed on the Subprocessors page, which forms Annex 3 to this DPA.
9.2 Bayloop informs the Controller of any intended addition or replacement of a Subprocessor at least 30 days in advance, in the Services and on the Subprocessors page, giving the Controller the opportunity to object. If the Controller objects on reasonable grounds relating to data protection within that period, the parties shall discuss the objection in good faith. If no solution is found, the Controller may terminate the Agreement with respect to the Services affected before the change takes effect.
9.3 Bayloop imposes on each Subprocessor, by way of a written contract, data protection obligations that provide at least the same level of protection as this DPA, in particular sufficient guarantees to implement appropriate technical and organisational measures. Bayloop remains fully liable to the Controller for the performance of each Subprocessor's obligations.
10. International Transfers
10.1 Bayloop stores Controller Personal Data in the European Union. Bayloop transfers Controller Personal Data to a third country only where the conditions of Chapter V GDPR are met, in particular on the basis of an adequacy decision of the European Commission, including the EU-US Data Privacy Framework, or of the standard contractual clauses adopted by the European Commission (in particular Module Three, processor to processor), together with any supplementary measures required.
10.2 The Controller authorises the transfers to the Subprocessors listed in Annex 3 on the bases stated there.
11. Assistance with the Rights of Data Subjects
11.1 Taking into account the nature of the processing, Bayloop assists the Controller by appropriate technical and organisational measures, insofar as possible, in fulfilling its obligation to respond to requests from data subjects exercising their rights under Chapter III GDPR, including the rights of access, rectification, erasure, restriction, data portability and objection.
11.2 The Services enable the Controller to find, export, rectify and delete the personal data of a data subject. If Bayloop receives a request directly from a data subject concerning Controller Personal Data, Bayloop forwards it to the Controller without undue delay and does not respond to it itself, except to confirm that it has been forwarded, unless otherwise instructed by the Controller.
12. Assistance with Security, Impact Assessments and Prior Consultation
12.1 Taking into account the nature of the processing and the information available to it, Bayloop assists the Controller in ensuring compliance with its obligations under Articles 32 to 36 GDPR, including by providing the information reasonably necessary for a data protection impact assessment and for any prior consultation of the supervisory authority concerning the processing carried out by means of the Services.
13. Personal Data Breaches
13.1 Bayloop notifies the Controller without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Controller Personal Data.
13.2 The notification describes, to the extent known: (a) the nature of the breach, including the categories and approximate number of data subjects and of personal data records concerned; (b) the name and contact details of the contact point at Bayloop; (c) the likely consequences of the breach; and (d) the measures taken or proposed to address the breach and to mitigate its possible adverse effects. Where the information cannot be provided at the same time, it is provided in phases without undue further delay.
13.3 Bayloop takes the measures necessary to contain the breach and mitigate its effects, documents the breach, and assists the Controller in notifying the supervisory authority and, where required, the data subjects, in accordance with Articles 33 and 34 GDPR.
14. Cooperation with Supervisory Authorities and Requests from Public Authorities
14.1 Bayloop cooperates, on request, with the competent supervisory authority in the performance of its tasks in accordance with Article 31 GDPR, and informs the Controller without undue delay of any inquiry, inspection or request of a supervisory authority concerning Controller Personal Data, unless prohibited by law.
14.2 If Bayloop receives a request from a public authority, including a law enforcement authority, for the disclosure of Controller Personal Data, Bayloop notifies the Controller without undue delay, unless prohibited by law, assesses the legality of the request, challenges it where there are reasonable grounds to consider it unlawful, and discloses only the minimum amount of data permissible on the basis of a reasonable interpretation of the request.
15. Records of Processing Activities
15.1 Bayloop maintains a record of all categories of processing activities carried out on behalf of the Controller in accordance with Article 30(2) GDPR and makes it available to the supervisory authority on request.
16. Information and Audits
16.1 Bayloop makes available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR and this DPA, and responds to the Controller's reasonable written questions.
16.2 Where the information provided is not sufficient, Bayloop allows for and contributes to audits, including inspections, conducted by the Controller or an independent auditor mandated by the Controller and bound by an obligation of confidentiality, not more than once per calendar year (except following a personal data breach or at the request of a supervisory authority), on at least 30 days' written notice, during Working Days, and without disproportionate disruption to Bayloop's business or access to the data of other customers. Each party bears its own costs, unless the audit reveals a material breach of this DPA by Bayloop.
17. End of Personal Data Processing and Data Deletion
17.1 Upon termination of the Agreement, Bayloop ceases to process Controller Personal Data, save as required for the steps in this section 17.
17.2 For 30 days after termination, the Controller may export Controller Personal Data by means of the export functions of the Services, which constitutes the return of the data in accordance with Article 28(3)(g) GDPR. At the Controller's request, Bayloop deletes the data earlier.
17.3 Bayloop deletes Controller Personal Data within 180 days after the termination of the Agreement, and from its backups within a further 14 days as the backups expire, unless Union or Member State law requires its retention. Bayloop confirms the deletion in writing at the Controller's request.
18. Liability
18.1 The liability of each party under this DPA is subject to the limitations of liability in the Terms of Service, except where such limitation is not permitted by Applicable Data Protection Law. Nothing in this DPA limits the rights of data subjects under Article 82 GDPR.
19. Term, Amendments and Governing Law
19.1 This DPA enters into force upon the conclusion of the Agreement and remains in force for as long as Bayloop processes Controller Personal Data.
19.2 Bayloop may amend this DPA in accordance with the procedure for amendments to the Terms of Service, provided that the amendment does not reduce the level of protection of Controller Personal Data, unless required by Applicable Data Protection Law.
19.3 This DPA is governed by the laws of the Republic of Latvia. The provisions on jurisdiction in the Terms of Service apply.
Annex 1. Description of the Processing
Subject matter: the provision of the Services to the Controller, as described in the Terms of Service.
Duration: for the term of the Agreement and until deletion in accordance with section 17.
Nature of the processing: collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure by transmission, alignment, combination, restriction, erasure and destruction, by automated means, including the processing of Inputs and Outputs by the AI Functionality within the permissions set by the Controller.
Purposes: to enable the Controller to manage its customers, vehicles, enquiries, bookings, quotes, orders, insurance claims, invoices and payments, to communicate with its customers, partners and suppliers, to operate its booking form, gallery and chat, to document vehicles with photographs and videos and use them in marketing with consent, to plan work and manage its Staff Members, and to use the AI Functionality for these purposes; and the purposes in clause 6.1.
- Categories of data subjects: the Controller's customers and their contact persons; vehicle owners and drivers; the Controller's Staff Members; the contact persons of the Controller's partners, suppliers and insurers; and persons who contact the Controller or visit its pages hosted by Bayloop.
- Types of personal data: identification and contact details (names, telephone numbers, email addresses, postal addresses, company details); vehicle data (make, model, registration number, VIN, condition); orders, quotes, invoices and payment records; communications and their attachments; photographs and videos of vehicles; working hours, tasks, roles and other work records of Staff Members; records of use of the Services; and the Inputs and Outputs of the AI Functionality.
- Special categories of personal data: none are intended. Should a communication received by the Controller contain such data, it is stored solely as part of that communication.
Annex 2. Technical and Organisational Measures
- Separation of data: the data of each customer is separated from that of all other customers at database level by row-level security, enforced on every request.
- Encryption: all data is transmitted encrypted (TLS). Passwords are stored only as one-way hashes. Stored credentials for connected services are encrypted.
- Access control: sign-in requires a one-time code on a new device or a passkey. Users have role-based permissions set by the Controller. Bayloop staff sign in to the administration portal with a one-time code or a passkey, and access a customer's account only through visible, recorded and time-limited support access.
- Infrastructure: servers located in Germany behind a firewall with only the necessary ports open. The database is not reachable from the internet.
- Availability and resilience: daily backups stored in a separate location in Finland, kept for 14 days, and regularly restored for testing to verify that they can be recovered.
- Logging: changes of status, settings and permissions are recorded. Administrators can see sign-ins and the devices used. Security records are kept for 12 months.
- Development and maintenance: security updates are applied without undue delay. Test environments use synthetic or pseudonymised data, and real data only as provided in clause 6.2.
- Incident management: personal data breaches are handled and notified as provided in section 13.
Annex 3. Subprocessors
The Subprocessors engaged by Bayloop, the services they provide, the location of the processing and the transfer basis are listed on the Subprocessors page, which forms part of this Annex.