We process data only on your documented instructions, which include your normal use of the platform, unless the law requires otherwise. If such an obligation arises we tell you first, unless we are forbidden to.
Everyone on our side with access to personal data is bound by confidentiality, and we apply the technical and organisational measures required by art. 32, including access control and encryption in transit.
We help you answer requests from vehicle owners exercising their rights under art. 15 to 22, and we support you on security, incident notification and impact assessment under art. 32 to 36.
We notify you without undue delay of any breach affecting your data, as required by art. 33(2), so you can meet your own 72-hour deadline towards the Centre.
On termination we return or delete your data at your choice, except what the law requires us to keep, and we give you the information needed to demonstrate compliance, including reasonable audits.