← Back to Repatrack PRO

Data Processing Agreement

Version 1.0 — effective 20 October 2026

1. Parties

• Controller — the carrier or dispatcher registered on the platform (the "Client").
• Processor — Kaloian Kantchev, owner of the Repatrack PRO platform, email: [email protected] (the "Processor").

For data Repatrack PRO processes for its own purposes (accounts, listings, payments, the shared live map, etc.), Repatrack PRO is the controller and the Privacy Policy applies, not this agreement.

2. Subject matter and duration

The Processor processes personal data on behalf of the Client to provide the platform features described in section 3. This agreement applies for as long as the Client uses the platform and until the data is deleted under section 6.8.

3. Nature and purposes of the processing

• tracking the location of the Client's drivers and vehicles — from the driver's phone or from a GPS tracker fitted in the vehicle;
• showing those positions in the Client's own view, in the tracking links the Client sends to its customers, and in the map the Client may embed in its own website;
• managing the accounts of the Client's drivers;
• receiving and handling requests from end customers through the dispatcher's website, QR code or embedded form (Dispatcher PRO);
• drawing up and storing transport documents for the Client's jobs.

4. Categories of data subjects

• drivers and other employees or contractors of the Client;
• end customers who submitted a request through a dispatcher's channel;
• people the Client sends a tracking link to.

5. Types of personal data

• names, phone, email;
• location: coordinates, speed, heading, accuracy and time of the position; the GPS tracker's identifier;
• vehicle data: registration number, VIN, make, model;
• request data: addresses, coordinates, description of the need;
• data entered in transport documents.

Special categories of data (GDPR Art. 9) are not processed.

6. Obligations of the Processor

6.1. Processing on instructions only

The Processor processes the data only on documented instructions from the Client. The instructions are the Client's settings and actions on the platform (e.g. assigning a driver, switching tracking on, issuing a link, publishing a map). If the Processor considers that an instruction infringes the GDPR, it informs the Client immediately. The Processor does not use the data for its own purposes beyond what is described in the Privacy Policy.

6.2. Confidentiality

Only the people who run the platform (the administrator and the partner) have access to the data, and only as far as necessary. They are bound by confidentiality. Their opening of carriers' original documents is logged.

6.3. Security

The Processor applies the measures described in Annex 1.

6.4. Sub-processors

The Client gives a general authorisation for the sub-processors listed in Annex 2. Before adding or replacing a sub-processor, the Processor publishes the change on this page and informs the Client by email at least 30 days in advance. The Client may object within that period with reasons; if no solution is found, the Client may stop using the feature concerned or the platform. The Processor imposes on each sub-processor data protection obligations no less protective than those in this agreement and remains liable for its actions.

6.5. Data subject rights

The platform gives the Client the means to fulfil data subjects' requests: correcting and deleting data of drivers and requests, stopping tracking, downloading data. If a data subject sends a request directly to the Processor about data for which the Client is the controller, the Processor forwards it to the Client within 5 working days and tells the data subject it has done so.

6.6. Assistance

The Processor assists the Client with data protection impact assessments, consultations with a supervisory authority and the Client's obligations under GDPR Articles 32–36, by providing the necessary information about the processing.

6.7. Personal data breaches

If a personal data breach affects the Client's data, the Processor informs the Client without undue delay and no later than 48 hours after becoming aware of it. The notice contains what is known at the time: what happened, which data and how many people are affected, the likely consequences and the measures taken. Missing information is provided as soon as it becomes known.

6.8. Deletion and return of the data

When the Client stops using the platform, it may download its data from the platform. The Processor then deletes or anonymises the data processed on the Client's behalf, unless the law requires it to be kept. Last known positions are deleted automatically within 90 days of their last update, and tracking links 30 days after they expire.

6.9. Information and audits

The Processor provides the Client with the information needed to demonstrate compliance with this agreement. The Client may carry out an audit once a year (or more often after a breach) with 30 days' notice, at its own cost and without access to other clients' data.

7. Obligations of the Client

• to have a legal basis for processing the data of its drivers and end customers;
• to inform its drivers about tracking before switching it on (sample text — Annex 3), and its end customers about the processing of their requests;
• to link a GPS tracker only to a vehicle it operates, and not to use tracking for purposes unrelated to work;
• to embed the map of its vehicles in its own website only if it has a basis for doing so;
• not to enter data on the platform that is not needed for the service.

8. Transfers outside the EEA

The platform and its database are hosted in the EU. Where a sub-processor is outside the EEA, the transfer relies on a European Commission adequacy decision (including the EU–US Data Privacy Framework) or on standard contractual clauses, as shown in Annex 2.

9. Liability and precedence

The parties' liability is governed by GDPR Article 82 and the Terms of Use. In case of conflict between the Terms and this agreement on matters of personal data protection, this agreement prevails.

10. Changes and governing law

A new version is published on this page. The Client is informed of material changes by email at least 30 days in advance. This agreement is governed by the law of the Republic of Bulgaria.

Annex 1 — Technical and organisational measures

• hosting of the platform and its database in the EU (Hetzner — Germany and Finland);
• encrypted connection (HTTPS/TLS) for all traffic;
• passwords stored only in hashed form; account lockout after a series of failed attempts; passkey sign-in;
• two-factor authentication for every administrator account;
• roles and access rights; the partner has read-only access except for explicitly allowed actions;
• logging of administrators' actions and of the opening of original documents;
• the live map is available to signed-in users only; a GPS tracker's position is shown on the shared map only while the driver is marked as on duty;
• carriers' documents are stored with restricted access and opened only through the platform; customers see only a copy in which sensitive data is covered;
• automatic deletion: last known position — 90 days; tracking links — 30 days after expiry; offers not accepted — 90 days; notifications — 60 days; logs — 30 days;
• logs contain no plain email addresses or phone numbers;
• bot and attack protection (Cloudflare) and request rate limits.

Annex 2 — Sub-processors

Annex 3 — Sample notice for drivers

The Client may hand this text to its drivers (e.g. as an annex to the employment contract or by email), filling in its own details.

---

Questions about this agreement: [email protected]