Data Processing Agreement

Last updated: May 29, 2026

This Data Processing Agreement ("DPA") forms part of the agreement between BK Garage Pro ("Processor") and the subscribing business ("Controller") and governs how BK Garage Pro processes personal data on behalf of the Controller in connection with the BK Garage Pro platform ("Service"). This DPA supplements the Terms of Service and Privacy Policy.

1. Definitions

• Controller: The automotive repair shop or business that determines the purposes and means of processing personal data (the subscribing customer).
• Processor: BK Garage Pro, which processes personal data on behalf of and under the instructions of the Controller.
• Data Subject: An identified or identifiable natural person whose personal data is processed — primarily the Controller's customers and employees.
• Personal Data: Any information relating to an identified or identifiable natural person.
• Processing: Any operation performed on personal data, including collection, storage, use, disclosure, or deletion.
• Sub-processor: A third party engaged by BK Garage Pro to process personal data in connection with the Service.
• Applicable Data Protection Law: All applicable laws and regulations governing the processing of personal data, including the GDPR (EU 2016/679), the California Consumer Privacy Act (CCPA), and any successor or equivalent legislation.

2. Roles and Responsibilities

The Controller is responsible for:

• Ensuring a lawful basis exists for collecting and inputting personal data into the Service.
• Providing required notices and obtaining necessary consents from data subjects.
• Ensuring that any instructions given to BK Garage Pro comply with Applicable Data Protection Law.

BK Garage Pro, as Processor, will process personal data only on documented instructions from the Controller, except where required to do so by law.

3. Nature and Purpose of Processing

BK Garage Pro processes personal data solely to provide and support the Service, including:

• Creating and managing work orders, repair tickets, and service history
• Storing customer contact information and vehicle records
• Generating invoices and estimates
• Scheduling appointments
• Sending service notifications (including SMS and email, where enabled)
• Processing payments through integrated payment providers
• Maintaining employee time records
• Generating shop performance reports

4. Categories of Personal Data Processed

Category	Examples
Customer contact data	Name, phone number, email address, billing address
Vehicle data	VIN, make, model, year, mileage, license plate
Service records	Repair history, inspection notes, technician notes
Financial data	Invoice amounts, payment status (payment card data is handled directly by the payment processor and not stored by BK Garage Pro)
Employee data	Technician names, time clock records, assigned jobs

5. Duration of Processing

BK Garage Pro will process personal data for the duration of the active subscription. Upon termination or expiration of the subscription:

• Export window: the Controller's data remains accessible for export for 90 days following cancellation.
• General data deletion: account and operational data is securely deleted after the 90-day export window unless the Controller requests earlier deletion.
• Repair order and financial records: repair orders, invoices, and associated financial records may be retained for up to 7 years to comply with applicable state automotive repair regulations, tax law, and warranty obligations. This data is retained on behalf of the Controller as required by law and is available for export on request during the retention period.
• Legal holds: data subject to a legal hold, court order, or regulatory requirement will be retained for the duration of that obligation.

6. Confidentiality

BK Garage Pro ensures that all personnel authorized to process personal data are bound by appropriate confidentiality obligations and receive training on data protection requirements.

7. Security Measures

BK Garage Pro implements and maintains appropriate technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, or destruction, including:

• Encryption of data in transit (TLS) and at rest
• Access controls and role-based permissions
• Multi-tenant data isolation — each shop's data is logically separated and inaccessible to other shops
• Regular security reviews and vulnerability assessments
• Secure credential management (passwords are hashed and never stored in plaintext)

8. Sub-processors

BK Garage Pro uses the following sub-processors to deliver the Service. All sub-processors are bound by data processing agreements consistent with this DPA.

Sub-processor	Purpose	Location
Vercel	Application hosting and delivery	United States
Neon (or current database provider)	Database storage and management	United States
Twilio (when SMS is enabled)	SMS message delivery	United States
Stripe (when payments are enabled)	Payment processing	United States
Anthropic (website chat only)	AI support assistant on public website — does not process shop or customer data	United States
Resend	Transactional email delivery — invoices, estimates, account notifications, service communications	United States

BK Garage Pro will provide reasonable advance notice of any material changes to sub-processors. The Controller may object to a new sub-processor within 14 days of notice; if the objection cannot be resolved, either party may terminate the agreement.

9. Data Breach Notification

BK Garage Pro will notify the Controller without undue delay — and no later than 72 hours after becoming aware — of any personal data breach that is reasonably likely to result in a risk to the rights and freedoms of data subjects. Notification will include, to the extent known: the nature of the breach, categories and approximate number of data subjects and records affected, likely consequences, and measures taken or proposed to address the breach.

10. Data Subject Rights

BK Garage Pro will assist the Controller in fulfilling its obligations to respond to data subject requests — including requests for access, rectification, erasure, restriction, portability, and objection — by providing appropriate technical means within the Service. BK Garage Pro will forward any direct data subject requests it receives to the Controller without undue delay.

11. Data Deletion and Return

Upon written request from the Controller, or upon termination of the subscription, BK Garage Pro will:

• Provide an export of the Controller's data in a standard format upon request
• Securely delete all personal data within 90 days of subscription end, except where retention is required by applicable law
• Confirm in writing when deletion is complete upon request

12. Audit Rights

Upon reasonable written request (no more than once per year, with at least 30 days' notice), BK Garage Pro will provide the Controller with information reasonably necessary to demonstrate compliance with this DPA. This may include documentation, security policies, or a summary audit report. On-site audits are available at the Controller's expense and subject to scheduling.

13. International Data Transfers

All data is processed and stored within the United States. If the Controller or any of its data subjects are located in the European Economic Area (EEA) or the United Kingdom, BK Garage Pro will ensure that appropriate transfer mechanisms are in place (such as Standard Contractual Clauses) to the extent required by applicable law.

14. California Residents (CCPA)

BK Garage Pro does not sell personal data. In its role as a Service Provider under the CCPA, BK Garage Pro will process personal data only for the business purposes described in this DPA and will not retain, use, or disclose personal data outside of the direct business relationship with the Controller.

15. Liability

Each party's liability under this DPA is subject to the limitations set out in the Terms of Service. BK Garage Pro's liability to the Controller for any claims arising under this DPA shall not exceed the total fees paid by the Controller in the twelve months preceding the event giving rise to the claim.

16. Term and Termination

This DPA remains in effect for the duration of the active subscription and terminates automatically upon expiration or termination of the subscription, except that obligations relating to data deletion and confidentiality survive termination.

17. Governing Law

This DPA shall be governed by the same governing law as the Terms of Service, unless otherwise required by Applicable Data Protection Law.

18. Amendments

BK Garage Pro may update this DPA from time to time to reflect changes in law, sub-processors, or business operations. Material changes will be communicated with at least 30 days' notice. Continued use of the Service after the effective date constitutes acceptance.