Data Processing Agreement
Effective date: [EFFECTIVE_DATE — set before publishing]
This Data Processing Agreement (“DPA”) forms part of the agreement between a dealership (“Controller”) and [LEGAL_ENTITY_NAME] (“Processor”, “Tervano”) for use of the Tervano platform. It reflects the requirements of Article 28 GDPR at a summary level and is intended for legal review before being relied on as a final, signed agreement.
1. Subject matter and duration
Tervano processes personal data on the Controller's behalf for the duration of the Controller's subscription to Tervano, for the purpose of providing the lead management, AI-assisted response, appointment, and related features of the platform.
2. Nature and purpose of processing
Processing consists of storing, organising, and enabling communication about the Controller's own vehicle enquiries and customers, including generating AI-assisted draft or sent replies using Controller-supplied dealership and vehicle information.
3. Categories of data subjects
The Controller's prospective and existing customers who submit a vehicle enquiry, and the Controller's own team members who use the platform.
4. Categories of personal data
Name, email address, phone number, vehicle enquiry details, conversation content, and appointment information.
5. Processor obligations
- Process personal data only on the Controller's documented instructions, as reflected in the platform's configuration
- Ensure personnel with access are bound by confidentiality obligations
- Implement appropriate technical and organisational security measures, including per-dealership data isolation
- Assist the Controller in responding to data subject rights requests, to the extent reasonably possible
- Notify the Controller without undue delay upon becoming aware of a personal data breach affecting the Controller's data
- Only engage a subprocessor with the Controller's general authorisation (see our Subprocessors page) and impose equivalent data protection obligations on any subprocessor
- Delete or return personal data at the end of the engagement, at the Controller's choice, subject to any legal retention requirement
6. Controller obligations
The Controller is responsible for the accuracy and lawfulness of the personal data it enters into Tervano, for having an appropriate legal basis to collect and process its own customers’ data, and for providing its own customers with appropriate privacy information.
7. International transfers
Where a subprocessor is located outside the EU/EEA, appropriate safeguards (such as the EU Standard Contractual Clauses) are relied upon, as described on our Subprocessors page.
8. Audit
Tervano will make available information reasonably necessary to demonstrate compliance with this DPA on reasonable request.
Contact
For a signed copy of this DPA or questions about it, contact privacy@tervano.ie.