Data Processing Agreement

Parties and scope

This Data Processing Agreement ("DPA") forms part of, and is incorporated into, the Locar Terms of Service available at /legal/terms (the "Terms"). It applies whenever Locar processes personal data on behalf of a customer (a rental company) in connection with the Locar service.

Company name

Locar.ai

Tax ID

000000

Registered address

123, Street

Commercial register

Locar.ai Corporation

Contact

support@locar.ai

For the purposes of Regulation (EU) 2016/679 (the "GDPR"), the customer is the controller of the personal data it submits to, or collects through, the Locar service about its own customers, drivers and other individuals. Locar is the processor, and processes that personal data only on the customer's documented instructions, as described in this DPA and its Annexes.

Subject matter and duration

The subject matter of this DPA is the processing of personal data by Locar on behalf of the customer in the course of providing the Locar service: a car-rental management platform covering bookings, contracts, vehicle hand-overs, payments and related customer communication.

This DPA takes effect on the date the customer accepts the Terms and remains in effect for as long as Locar processes personal data on the customer's behalf, including for the period needed to complete deletion or return of that data under "Deletion and return of data" below.

Nature and purpose of the processing

Locar processes personal data on the customer's behalf only to provide, support and secure the Locar service, and in particular to:

• operate bookings, rental contracts, vehicle hand-overs and returns;
• process payments and deposits taken through the customer's payment provider;
• record vehicle inspections and damage, including photographs;
• send and receive WhatsApp messages with the customer's own customers, including transcribing voice notes and translating messages, where the customer enables those features;
• read identity documents, driving licences, vehicle registration documents and fine notices with AI assistance, where the customer enables that feature, always subject to confirmation by a person before any reading is saved;
• generate the traveller report that Spanish law requires rental companies to file (SES.HOSPEDAJES);
• maintain the audit log, security logs and backups needed to operate the service reliably and securely.

Categories of data subjects and personal data

The personal data processed under this DPA relates to the following categories of data subjects:

• the customer's own customers who rent vehicles;
• additional drivers named on a rental;
• the customer's staff who use the Locar service, to the extent their actions are recorded against a rental or vehicle.

The personal data processed may include the following categories:

• name, contact details, date of birth and nationality;
• identity document and driving licence data and images;
• home address;
• signatures;
• rental booking and contract details;
• payment and deposit records, excluding card numbers, which are held only by the customer's payment provider;
• fines and tolls linked to a rental;
• vehicle inspection and damage photographs;
• WhatsApp messages, including voice notes and their transcripts;
• the hand-over location recorded by the tablet used at vehicle hand-over.

The parties do not intend this processing to include special categories of personal data within the meaning of Article 9 GDPR. Identity document and driving licence data is processed because it is ordinarily required to conclude a vehicle rental, not to reveal a special category; the customer remains responsible for not submitting special category data through the service.

Processing on instructions

Locar processes personal data only on the documented instructions of the customer, including regarding transfers of personal data to a third country, unless required to do so by European Union or member state law to which Locar is subject. In that case, Locar will inform the customer of that legal requirement before processing, unless the law prohibits this on important grounds of public interest.

• this DPA and the Terms, together with the customer's use of the Locar service's configurable features (such as enabling AI reading of documents or the WhatsApp assistant), are the customer's instructions;
• the customer may give further written instructions reasonably related to the processing described in this DPA;
• Locar will inform the customer if, in its opinion, an instruction infringes the GDPR or another EU or member state data protection provision.

Confidentiality

Locar ensures that any person it authorises to process personal data under this DPA, including its own staff and contractors, is subject to a binding duty of confidentiality, whether contractual or statutory, and processes personal data only as instructed.

Security of processing

Locar implements technical and organisational measures appropriate to the risk, taking account of the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing, to ensure a level of security appropriate to the risk, including the measures summarised in Annex 2 (Security measures). Those measures address, among other things, tenant isolation between customers, encryption in transit, access control, and the integrity of audit and evidence records.

Sub-processors

The customer gives Locar a general authorisation to engage sub-processors to provide the Locar service. The sub-processors currently engaged are listed in Annex 3 (Sub-processors), with the processing each one carries out and its location.

Locar will inform the customer of any intended addition or replacement of a sub-processor, giving the customer the opportunity to object on reasonable, data-protection grounds within a reasonable period. If the customer objects and the parties cannot resolve the objection, Locar will, as its sole remedy, either not engage that sub-processor for the customer's data or allow the customer to terminate the affected part of the service.

Locar imposes data protection obligations materially equivalent to those in this DPA on every sub-processor it engages, by contract or another legally binding instrument, and remains fully liable to the customer for a sub-processor's performance of those obligations.

OpenFreeMap, a free public map service, is not a sub-processor under this DPA: the Locar tablet's own browser fetches map tiles directly from it when showing a vehicle hand-over location, and Locar has no contract with it. Annex 3 lists only the sub-processors Locar itself engages.

International transfers

Where a sub-processor listed in Annex 3 processes personal data outside the European Economic Area, Locar ensures the transfer is covered by an adequate safeguard recognised under Chapter V GDPR, in particular the European Commission's Standard Contractual Clauses, or the recipient's certification under the EU–US Data Privacy Framework (DPF) where applicable.

Locar will, on the customer's request, make available the safeguard relied on for a given transfer described in Annex 3.

Assistance to the customer

Taking into account the nature of the processing, Locar assists the customer, by appropriate technical and organisational measures, in fulfilling the customer's obligation to respond to requests from data subjects exercising their rights under the GDPR. The Locar service includes built-in tools that let the customer export a data subject's personal data in one action and erase a data subject's personal files, other than records kept as evidence, directly.

• responding to data subject requests, where the customer cannot do so itself through the built-in tools;
• data protection impact assessments relating to the processing described in this DPA, to the extent the information is in Locar's possession and not otherwise available to the customer;
• prior consultation with a supervisory authority where a data protection impact assessment indicates the processing would result in a high risk absent mitigating measures.

Personal data breaches

Locar notifies the customer without undue delay and, in any case, within 48 hours after becoming aware of a personal data breach affecting personal data processed under this DPA, so that the customer can meet its own 72-hour duty to notify its supervisory authority under Article 33 GDPR.

• the nature of the breach, including, where possible, the categories and approximate number of data subjects and personal data records concerned;
• the likely consequences of the breach;
• the measures taken or proposed to address the breach and mitigate its possible adverse effects;
• the name and contact details of a point of contact for further information.

Locar will update the notice as more information becomes available and will cooperate with the customer's own investigation and notification obligations.

Deletion and return of data

Before the customer's account is closed, the customer can export a data subject's personal data at any time, one data subject at a time, using the Locar service's built-in export tool. There is no tool to export all of the customer's data in a single action, so the customer should use this tool for whatever it needs to keep, such as contracts and invoices, before closing its account.

When the customer's account is closed, Locar deletes all the personal data processed under this DPA, including records kept as evidence such as signed contract PDFs, signatures and inspection photographs, except personal data Locar must itself keep by law, such as its own invoices to the customer.

Information and audits

Locar makes available to the customer all information reasonably necessary to demonstrate compliance with this DPA, and allows for and contributes to audits, including inspections, conducted by the customer or an auditor mandated by the customer, on reasonable notice and during normal business hours, at the customer's expense, without disrupting Locar's ability to serve its other customers. Where the requested information is already available in an audit report, certification or equivalent documentation, Locar may provide that documentation instead of a separate audit.

Liability

Each party's liability arising out of or in connection with this DPA, including the liability of Locar and any sub-processor it engages, is subject to the limitations and exclusions of liability set out in the Terms.

Annex 1: Details of processing

Annex 2: Security measures

• Encryption in transit (TLS) for all connections to the Locar service.
• Tenant isolation enforced at three layers: database keys tying every record to one customer, a query guard that refuses any database statement not bound to the signed-in customer, and branch-level access limits; a record belonging to another customer returns "not found".
• Role-based permissions checked on every request; passwords hashed with scrypt; sign-in tokens stored only as hashes; single-use, rotating sessions.
• An append-only audit log of who did what and when; reads of identity documents logged separately; evidence files (contracts, signatures, inspection photographs) stored immutably.
• Personal data files stored in the European Union; database backups with point-in-time restore.
• AI-assisted readings of documents are always proposals that a person must confirm before anything is saved to a record.

Annex 3: Sub-processors