Data Processing Agreement (DPA)

Version 1.0 · Effective November 02, 2026

This Data Processing Agreement ("DPA") is part of the biela Terms of Service between Biela Technologies, Inc. ("biela", the processor) and the shop using biela ("Customer", the controller). It applies when biela processes personal information on the Customer's behalf ("Customer Personal Data").

1. Scope and roles. The Customer is the controller of Customer Personal Data. This means its own customers' and staff's information entered in biela, such as names, contact details, vehicles, plates, VINs, repair records, documents and payments. biela is the processor and acts only on the Customer's documented instructions. These Terms, the Customer's settings in the app and the actions the Customer takes in the Service are those instructions.
2. Purpose and duration. biela processes Customer Personal Data only to provide, secure and support the Service. It does so for as long as the Customer's account is active, and then as described in section 9.
3. Confidentiality. Personnel with access to Customer Personal Data are bound by confidentiality obligations, and access is limited to what their job requires.
4. Security. biela maintains appropriate technical and organizational measures. These include encryption in transit and at rest, logical separation of each shop's data with row-level access controls, role-based access, two-step verification, logging and monitoring, rate limiting, backups and incident response procedures.
5. Subprocessors. The Customer authorizes biela to use the subprocessors listed at hellobiela.com/legal/subprocessors. biela will:
   • impose data protection obligations on each subprocessor that are no less protective than this DPA;
   • notify the Customer of new subprocessors at least 15 days in advance by email or in the app. The Customer may object on reasonable data protection grounds. If the parties cannot resolve the objection, the Customer may terminate the affected Service and receive a prorated refund of prepaid fees.
6. International transfers. Customer Personal Data is processed in the United States. biela will put in place the transfer mechanisms that applicable law requires.
7. Assistance. biela will assist the Customer, through the tools in the app and otherwise as reasonably needed, to respond to requests from individuals (access, correction, deletion, portability, opposition) and to meet its security, breach-notification and impact-assessment obligations.
8. Breach notification. biela will notify the Customer without undue delay, and within 72 hours, after becoming aware of a security breach affecting Customer Personal Data. The notice will include the information reasonably available to help the Customer meet its obligations.
9. Return and deletion. The Customer can export its data at any time. After the account is closed, biela deletes Customer Personal Data within 30 days, and backups expire automatically on our hosting provider's backup cycle, unless the law requires longer retention.
10. Audits. On written request, no more than once a year, biela will provide information reasonably necessary to demonstrate compliance with this DPA, such as security documentation and answers to a reasonable questionnaire.
11. US state privacy laws. Where these laws apply, biela acts as a "service provider" or "processor". biela will not sell or share Customer Personal Data, or retain, use or disclose it outside the direct business relationship with the Customer or for any purpose other than providing the Service, except as the law permits.
12. Order of precedence. If this DPA conflicts with the Terms on data protection, this DPA controls.