Data Processing Agreement.

• You are the data controller — you decide what customer data goes into PaddockPro
• We are the data processor — we only process that data to deliver the PaddockPro service
• All platform data is stored in the EU (servers and databases in Helsinki, Finland; backups in Germany and the Netherlands). Recipients outside the EU are listed in Section 7
• We encrypt data at rest and in transit, with automated backups and 30-day disaster recovery
• We will notify you within 48 hours of discovering any data breach affecting your customers' data
• When you leave, we delete your customers' data within 30 days (or return it to you on request)
• Our subprocessors are listed below — we will notify you before adding new ones

1. Parties

This Data Processing Agreement (“DPA”) is entered into between:

• Data Controller (“You”, “Customer”) — the PaddockPro Workshop subscriber who inputs personal data into PaddockPro
• Data Processor (“We”, “Us”, “PaddockPro”) — Garage Max Software Ltd, Company Number 17001606, registered in England and Wales, registered office Dunston Farm, Dunston, Stafford, ST18 9AB, registered with the ICO as a data controller (ZC097516)

This DPA supplements and forms part of your PaddockPro Workshop subscription agreement, our Terms & Conditions, and our Privacy Policy. It applies for the duration of your PaddockPro Workshop subscription.

2. Scope & Purpose of Processing

We process personal data solely to provide the PaddockPro Workshop service to you. This includes:

Subject Matter

Processing of vehicle and customer data submitted by PaddockPro Workshop customers through the PaddockPro alignment tool and related features.

Nature & Purpose

• Generating AI-powered alignment specifications using vehicle and setup data
• Storing setup history and alignment records against vehicle registrations
• Providing reports and analytics on alignment usage
• Sending transactional emails (reports, confirmations)

Types of Personal Data

• Vehicle registration numbers (VRM)
• Vehicle specifications (make, model, year, modifications)
• Alignment specifications and setup data
• Workshop notes and customer feedback entered into the platform

Categories of Data Subjects

• Your workshop customers whose vehicle data you enter into PaddockPro
• Your staff who use PaddockPro on your behalf

3. Our Obligations as Processor

We will:

• Process personal data only on your documented instructions (i.e., to provide the PaddockPro service) and not for any other purpose
• Ensure all personnel authorised to process personal data are bound by confidentiality obligations
• Implement and maintain appropriate technical and organisational security measures (see Section 5)
• Not engage additional subprocessors without prior notice (see Section 6)
• Assist you in responding to data subject requests (access, rectification, erasure, portability) within 10 business days of your request
• Assist you in meeting your obligations under UK GDPR Articles 32–36 (security, breach notification, impact assessments, prior consultation)
• Delete or return all personal data at the end of the service relationship, at your choice (see Section 8)
• Make available to you all information necessary to demonstrate compliance with this DPA

We will not process personal data outside the scope of this DPA unless required by UK law, in which case we will inform you before processing (unless prohibited from doing so by law).

4. Your Obligations as Controller

You are responsible for:

• Ensuring you have a lawful basis under UK GDPR to share your customers' personal data with us for processing
• Providing appropriate privacy notices to your customers that disclose the use of PaddockPro as a data processor
• Handling data subject requests from your customers in a timely manner (you may request our assistance)
• Ensuring that any instructions you give us regarding data processing comply with applicable law
• Notifying us promptly if you become aware of any circumstance that may affect our ability to process data lawfully

5. Technical & Organisational Security Measures

We implement the following measures to protect personal data:

Encryption

• In transit: TLS 1.2+ on all connections (HTTPS enforced, no plaintext)
• At rest: AES-256 encryption on database storage
• Secrets: API keys and credentials stored in isolated secret mounts, never in source code

Access Control

• Row-Level Security (RLS) enforced on all database tables — each customer can only access their own data
• Role-based access control with principle of least privilege
• Multi-factor authentication required for administrative access
• JWT-based session authentication with automatic expiry

Infrastructure

• Application servers and databases hosted by Hetzner in Helsinki, Finland
• Row-level security on every table in the platform database
• Cloudflare SSL termination and DDoS protection
• IP-restricted access to development environments

Backup & Disaster Recovery

• Automated nightly database backups with 30-day retention
• Encrypted nightly backups to Hetzner storage in Falkenstein, Germany
• An encrypted offsite copy with Backblaze in Amsterdam, Netherlands
• Recovery procedure documented and tested

Monitoring & Logging

• All authentication events logged (login, logout, failures)
• API access logged with timestamps and user identification
• Audit trail for alignment generations and credit usage
• Automated health monitoring with alerting

6. Subprocessors

You authorise us to engage the following subprocessors. We will notify you by email at least 14 days before adding a new subprocessor. If you object, you may terminate your subscription before the subprocessor is engaged.

7. International Data Transfers

Your data is primarily stored and processed within the EU/EEA:

• Application servers and database: Hetzner — Helsinki, Finland
• Backups: Hetzner — Falkenstein, Germany; encrypted offsite copy with Backblaze — Amsterdam, Netherlands

Data sent outside the EU/EEA goes to these recipients only:

• OpenAI (USA) — AI processing of anonymised vehicle specifications only (no VRMs or customer identifiers), under Standard Contractual Clauses as approved under UK GDPR and OpenAI's data processing terms. OpenAI keeps request logs for up to 30 days for abuse monitoring.
• UK Vehicle Data (United Kingdom) — vehicle registration numbers, for vehicle lookups. UK Vehicle Data is a UK company and UK GDPR applies.
• Stripe, SMTP2GO and Cloudflare — billing, email and website delivery, as listed in Section 6, under each provider's data processing terms.

GPS data and session telemetry are never transferred outside the EU. Vehicle registration numbers leave the EU only for the UK Vehicle Data lookup above.

8. Data Retention & Deletion

During Your Subscription

Personal data is retained for the duration of your PaddockPro Workshop subscription. Alignment records and vehicle setup history are retained for 24 months in active storage, then moved to cold storage. Payment records are retained for 7 years as required by law.

On Termination

When your PaddockPro Workshop subscription ends, you may choose:

• Data return: We will export and provide your customers' data in a structured, machine-readable format (JSON/CSV) within 30 days of your request
• Data deletion: We will delete all your customers' personal data from our active systems within 30 days of termination

In both cases, data will persist in our automated backup rotation for up to 30 days after deletion from active systems. After that period, it is permanently removed. Payment records are retained for 7 years regardless, as required by law.

9. Data Breach Notification

In the event of a personal data breach affecting your customers' data, we will:

• Notify you by email within 48 hours of becoming aware of the breach
• Provide a description of the nature of the breach, including the categories and approximate number of data subjects affected
• Describe the likely consequences of the breach
• Describe the measures taken or proposed to address the breach and mitigate its effects
• Provide ongoing updates as the situation develops

As data controller, you are responsible for determining whether to notify the ICO (within 72 hours under UK GDPR Article 33) and/or affected data subjects (under Article 34). We will assist you with this process.

Our breach response procedure includes: immediate containment, forensic investigation, root cause analysis, remediation, and post-incident review.

10. Data Subject Requests

If you receive a data subject request from one of your customers relating to data held in PaddockPro, we will assist you in fulfilling it. This includes:

• Right of access: We can provide all data held against a specific VRM or customer identifier within 10 business days
• Right to rectification: We can correct or update records on your instruction
• Right to erasure: We can delete all records associated with a specific VRM or customer on your instruction
• Right to portability: We can export data in structured JSON or CSV format
• Right to restrict processing: We can suspend processing of specific records on your instruction

To submit a data subject assistance request, email hello@paddock-pro.com with the subject line “DSR Assistance” and include the relevant customer identifier.

11. Audit Rights

You have the right to audit our compliance with this DPA. This may be exercised by:

• Requesting written evidence of our security measures and compliance practices
• Requesting summaries of any third-party security assessments or certifications
• Conducting an on-site or remote audit with reasonable notice (minimum 30 days) and during normal business hours

We will cooperate with reasonable audit requests at no additional charge, provided they do not unreasonably disrupt our operations. Audits are limited to once per 12-month period unless a data breach has occurred.

12. Liability

Each party's liability under this DPA is subject to the limitations and exclusions set out in the Terms & Conditions.

Nothing in this DPA limits either party's liability for breaches of UK GDPR, death or personal injury caused by negligence, or fraud.

13. Term & Termination

This DPA takes effect when you begin your PaddockPro Workshop subscription and continues until the subscription ends. The data retention and deletion obligations in Section 8 survive termination.

If we materially breach this DPA and fail to remedy the breach within 30 days of written notice, you may terminate your PaddockPro Workshop subscription immediately.

14. Amendments

We may update this DPA to reflect changes in law, our subprocessors, or our processing practices. For material changes, we will notify you by email at least 30 days before the changes take effect. If you do not agree to updated terms, you may terminate your subscription before they take effect.

15. Governing Law

This DPA is governed by the laws of England and Wales and subject to the exclusive jurisdiction of the courts of England and Wales.

For data protection matters, the supervisory authority is the Information Commissioner's Office (ICO):

16. Contact

For questions about this DPA, data processing, or to exercise any rights under this agreement: