Data Processing Agreement (DPA)
Last updated: 2026-10-20.1 · Version 2026-10-20.1
This is a translation. If it differs from the Bulgarian text, the Bulgarian text prevails.
This Agreement is part of the Terms and applies when we process personal data on your behalf in using Pintle TMS. You are the “Controller” and Pintle is the “Processor” within the meaning of Art. 28 of Regulation (EU) 2016/679 (GDPR). It is accepted together with the Terms.
1. Subject matter, duration, nature and purpose
Subject matter: processing personal data contained in the data the Controller enters or uploads into the Service. Duration: while the contract is in force and until deletion under section 10. Nature: storing, organising, displaying, calculating, passing between the Controller’s users, recognising documents at its request. Purpose: providing the Service — managing a transport business.
2. Types of data and categories of people
| Category of people | Types of data |
|---|---|
| The Controller’s users (owners, dispatchers, accountants) | Name, e-mail, role, actions in the Service, online presence |
| Drivers | Name, phone number, assigned courses, documents (for example CMR, licence), photos of documents, the vehicle’s position and mileage where a tracking system is connected, tachograph data if uploaded |
| Contacts of the Controller’s customers and counterparties | Name, company, e-mail, phone, address, data in invoices and orders |
The Controller must not enter special categories of data (Art. 9 GDPR) or data about convictions unless necessary and lawful. The Service is not intended for such data.
3. The Controller’s instructions
We process the data only on the Controller’s documented instructions — these terms, the settings and the Controller’s use of the Service. If we think an instruction infringes data-protection law we will tell the Controller.
The Controller is responsible for having a legal basis for the processing, for informing the people concerned (including drivers about tracking) and for meeting its obligations towards them.
Exception: for the “Payment reminder” function (/payment-reminder) we use the status, due date and buyer’s company ID/VAT number from invoices as an independent controller for our own purpose, not on your instructions; see the privacy policy. You can keep your invoices out of it at any time.
4. Confidentiality
People on our side who have access to the data are bound by a duty of confidentiality and have access only as far as necessary.
5. Security measures
We apply appropriate technical and organisational measures under Art. 32 GDPR. At the date of the version they include the measures on the Security page, which forms part of this Agreement. We may improve them without lowering the level of protection.
6. Sub-processors
The Controller gives a general authorisation to use the sub-processors on the Sub-processors page. We impose on them data-protection obligations no less strict than these and remain responsible for them.
When we add or replace a sub-processor we will update the list and notify the Controller by e-mail or in the Service at least 30 days in advance. In that time the Controller may object on reasonable grounds; if no solution is found it may terminate the contract.
7. Transfers outside the EEA
We transfer data outside the EEA only to the sub-processors on the list and only on the basis of an adequacy decision or standard contractual clauses, with additional measures where needed.
8. Assistance
We assist the Controller, as far as reasonable and given the nature of the processing, with: answering requests from people exercising their rights; impact assessments and prior consultations; meeting the security and breach obligations. Direct requests to [e-mail]. If a person contacts us directly about data for which you are the Controller we will refer them to you.
9. Personal data breaches
We will notify the Controller without undue delay after we become aware of a personal data breach that affects it — aiming to do so within 48 hours — and give it the information needed to notify the supervisory authority and the people concerned.
10. Return and deletion
When the contract ends the Controller may ask for an export of the data within 30 days. After that we delete or anonymise the data unless the law requires it to be kept. Backups containing the data are overwritten within 14 days.
Vehicle positions received from a tracking system are kept for up to 14 months by default (older months are deleted automatically every day).
11. Audit
On written request we provide the information needed to show compliance with this Agreement. The Controller may carry out, or have carried out, an audit once a year (and after a breach), on at least 30 days’ notice, in working hours, without disturbing our operations and subject to confidentiality; the costs are for its account.
12. Liability and law
Liability is subject to the limits in the Terms, to the extent the law allows. Bulgarian law applies. In case of conflict on data-protection matters this Agreement prevails.
13. Contact
Questions about this Agreement: [e-mail]. Version: 2026-10-20.1.