Data processing agreement
Version 1.0 of 23 October 2026
How Carmantic processes the personal data in the garage's dossiers: only on the garage's behalf, securely, with fixed suppliers and with help for every request or incident.
1. Parties and roles
This data processing agreement applies between the customer that uses Carmantic ("the controller") and Hebel & Margo BV, Kapellekensweg 32, 3391 Meensel-Kiezegem, company number BE 0794.199.079 ("the processor"). It forms part of the terms of use and applies as long as the processor processes personal data for the customer.
Terms such as personal data, processing, personal data breach and sub-processor have the meaning given in the General Data Protection Regulation (EU) 2016/679 ("GDPR").
2. Subject matter and nature of the processing
| Purpose | Preparing documents for the purchase, brokerage or consignment of vehicles, having them signed, keeping them and sending them to the customer, its customer and its accountant |
|---|---|
| Nature | Collecting, recording, storing, consulting, converting to PDF, sending and erasing |
| Data subjects | Sellers, consignors, principals and other people in the customer's dossiers, and the customer's staff insofar as they appear in a dossier |
| Data | Identity and contact details, copy of the identity document (with photo and possibly national register number), bank account number, vehicle data and vehicle documents, price and payment method, signature, evidence of the signing (time, device, browser, pseudonymised IP address) and the log |
| Duration | For the term of the agreement, and afterwards until the data has been erased under section 9 |
3. Instructions
The processor processes the personal data only on documented instructions from the controller. The terms of use, this agreement and the customer's use of Carmantic's functions (such as having a document signed or sending it to its accountant) count as those instructions.
The processor never uses the data for its own purposes. If it is legally required to process data otherwise, it reports this in advance, unless the law prohibits doing so. If the processor considers that an instruction infringes the GDPR, it reports this immediately.
The controller is responsible for the lawfulness of the processing: a legal basis, informing the data subjects and choosing which data it has processed.
4. Confidentiality
Only people who need the data to provide or support the service have access. They are bound by confidentiality. The processor looks at the content of dossiers only when necessary to solve a problem the customer asks help with, or when the law requires it.
5. Security
The processor takes appropriate technical and organisational measures, including:
- encrypted connections (TLS) and encrypted storage at the suppliers;
- strict separation per customer: every database query is limited to the user's organisation;
- passwords and personal signing links only as a hash, IP addresses in the evidence only pseudonymised; two-step verification available to every user and mandatory for the processor's administrators;
- documents and photos reachable only after signing in or through temporary, signed links;
- a log of the actions in each dossier and a fingerprint (hash) of each signed document;
- error reports filtered so that names, account numbers and photos are not passed on;
- limits on the number of attempts when signing in and for personal links;
- regular backups and the ability to restore a database.
The processor may adapt the measures to the state of the art, as long as the level of security does not decrease.
6. Sub-processors
The controller gives general authorisation to engage these sub-processors:
| Sub-processor | Task | Place of processing |
|---|---|---|
| Vercel Inc. | Hosting of the application | Frankfurt (Germany) |
| Neon Inc. (Databricks) | Database | Frankfurt (Germany) |
| DigitalOcean LLC | Storage of documents and photos | Amsterdam (Netherlands) |
| Resend Inc. | Sending emails with documents and links | US |
| Functional Software Inc. (Sentry) | Error reporting, filtered | US |
The processor imposes on each sub-processor at least the same obligations as in this agreement and remains liable to the customer for them. It announces a new or replacement sub-processor by email at least 30 days in advance. The customer may object on reasonable grounds within that period; if the parties find no solution, the customer may terminate the agreement free of charge.
Recipients the customer chooses itself, such as its accountant, its accounting software or its own customer, are not sub-processors of the processor.
7. Transfers outside the European Economic Area
Data is processed outside the EEA only with appropriate safeguards, such as the EU-US Data Privacy Framework or the European Commission's standard contractual clauses, supplemented by measures such as encryption.
8. Assistance and incidents
The processor helps the controller answer requests from data subjects, among other things through the functions to view and download dossiers; it erases a signed dossier at the customer's request. If the processor receives such a request itself, it forwards it to the customer without delay and does not answer it on the merits itself.
If the processor becomes aware of a personal data breach, it notifies the customer without undue delay and within 48 hours at the latest, with what is known at that moment: the nature of the breach, the data and people concerned, the likely consequences and the measures taken or proposed. The customer decides on notifying the Data Protection Authority and the data subjects.
The processor also helps with a data protection impact assessment or a prior consultation, insofar as it concerns Carmantic.
9. End: return and erasure
During the agreement, the customer can download its dossiers at any time. It erases drafts itself; the processor erases a signed dossier at its request, so that the customer's numbering has no unexplained gaps. After the end, the account stays read-only for 30 days so the customer can download everything. The processor then erases the personal data within 90 days, unless the law requires it to keep them. Backups are overwritten automatically.
The customer decides how long it keeps dossiers and copies of identity documents and remains responsible for the legal retention periods that apply to it.
10. Audits
The processor makes available the information needed to demonstrate compliance with this agreement. The customer may have an audit carried out by an independent auditor bound by confidentiality, at most once a year and with 30 days' notice, unless there is a concrete indication of a breach. The costs are borne by the customer. An audit may not endanger the security or the data of other customers.
11. Liability and precedence
Liability is governed by the terms of use, without prejudice to Article 82 GDPR. In case of conflict between this agreement and the terms of use, this agreement prevails as regards the processing of personal data.
This agreement exists in Dutch, French and English; if the versions differ, the Dutch text prevails. Belgian law applies.