Data Processing Agreement (DPA) — Tosvi

Version 1.6 · Effective date: 19/08/2026

This Data Processing Agreement ("DPA") forms part of the agreement between the Studio and Tosvi for use of the Service, and reflects the parties' obligations under Article 28 of the GDPR and Moldovan Law 195/2024 (formerly Law 133/2011).

Acceptance

Because the Service is self-service, this DPA is accepted electronically by an authorised representative of the Studio during onboarding (by ticking the acceptance box), which has the same effect as signature. Tosvi records the acceptance (account, accepting user, document version, language, and timestamp) as evidence. A wet-signature version (below) is available on request for studios that require one.

Parties

• Controller ("the Studio"): the car-detailing studio that holds the account. Its legal name, fiscal code, registered address, and authorised contact are provided during onboarding and recorded together with its acceptance of this DPA.

• Processor ("Tosvi"):

Petru Virtos, Antreprenor Independent Cod fiscal: 1026023032469 bd. Moscova 9/5 ap. 300, Chișinău MD-2068, Moldova Contact: [email protected]

Processing details at a glance

1. Subject matter and roles

The Studio is the controller of the personal data it enters into the Service about its customers and staff. Tosvi is the processor, processing that data solely to provide the Service and only on the Studio's documented instructions (these terms, the Service's configuration, and any further written instruction).

2. Duration

This DPA applies for as long as Tosvi processes personal data on the Studio's behalf, i.e. for the duration of the Studio's use of the Service.

3. Nature and purpose of processing

To provide a SaaS platform for managing clients, vehicles, quotes, scheduling, pre-work vehicle inspections, generated documents, and (if enabled) an embeddable price-calculator widget and lead capture.

4. Types of personal data

• Studio staff: name, email, role.
• Studio customers: name, phone, email, notes; vehicle plate, VIN, year, colour;

quote/work history; pre-work inspection photos, customer signature, damage notes, approver name and timestamp; consent records for the optional purposes the Service offers — publication of vehicle photographs and storage of the client's own record — each holding the purpose, the version of the client notice shown, the grant and withdrawal timestamps, and the client's signature image where one was captured; (if messaging is enabled) the content of the studio↔client conversation — both inbound client messages and outbound studio replies — and the Telegram chat and user identifiers used to route them.

• Widget (if enabled): visitor-submitted lead name and phone; a truncated,

irreversibly hashed visitor IP used only for rate limiting.

5. Categories of data subjects

The Studio's staff users; the Studio's customers; (if the widget is enabled) visitors to the Studio's website who submit the contact form.

6. Processor obligations

Tosvi shall:

1. Process only on documented instructions from the Studio, including for

international transfers, unless required by law (in which case Tosvi will inform the Studio, unless legally prohibited). Tosvi will inform the Studio without delay, and in any event no later than one month, if, in its opinion, an instruction infringes the GDPR or other applicable data-protection law.

1. Confidentiality — ensure persons authorised to process the data are bound

by confidentiality.

1. Security — implement appropriate technical and organisational measures

(Annex 2), as required by Article 32 GDPR.

1. Sub-processors — the Studio grants Tosvi general written authorisation to

engage sub-processors. Tosvi will engage only the sub-processors listed in Annex 1; impose equivalent data-protection obligations on them; remain liable for their performance; and give the Studio at least 30 days' notice of any intended addition or replacement, during which the Studio may object on reasonable data-protection grounds (and later, on grounds arising after that period). If the Studio does not object within the period, it is deemed to consent. If the Studio objects and the parties cannot in good faith resolve it, the Studio may terminate the part of the Service affected by the change; where that sub-processor is essential to the Service (for example, the database), the Studio may instead terminate the whole subscription and receive a pro-rata refund of pre-paid fees. Pending termination, Tosvi will not transfer the objecting Studio's data to the objected-to sub-processor. No other remedy or damages arise from a permitted sub-processor change.

1. Assist the Studio — taking into account the nature of processing, assist

with responding to data-subject requests (the Service provides per-account and per-client export and erasure), and with the Studio's obligations on security, breach notification, data-protection impact assessments, and prior consultation with the supervisory authority under Article 36. Assistance beyond the self-service export/erasure and the information the Service already provides — including assistance with data-subject requests, DPIAs, prior consultation, the Studio's own breach-notification obligations, and transfer-adequacy assessments, and the cost of any on-site audit under clause 6.8 — is furnished at the Studio's reasonable cost. Tosvi's own notification to the Studio of a personal-data breach (clause 6.6, Article 33(2) GDPR) is provided at no charge, as is the baseline information Tosvi makes available under clause 6.8.

1. Personal-data breach — notify the Studio without undue delay after becoming

aware of a breach affecting the Studio's data, with the information the Studio needs to meet its own notification duties. Such notification is not an acknowledgement of fault or liability. Unsuccessful attempts that do not compromise the security of personal data — such as pings, port scans, denial-of-service attempts, or failed login attempts — are not personal-data breaches.

1. Deletion or return — at the Studio's choice, delete or return all personal

data at the end of the provision of services — within 30 days of closure, with return available via the Service's export functionality — and delete existing copies unless legally required to retain them.

1. Audits — make available the information necessary to demonstrate compliance

with Article 28. On-site inspection is available only where the information Tosvi makes available is insufficient to demonstrate compliance, on 30 days' notice, no more than once per year (save where a regulator or a material breach requires otherwise), during business hours, at the Studio's cost, subject to confidentiality, and conducted so as not to disrupt the Service. An audit does not extend to access to Tosvi's hosting sites, underlying systems, or infrastructure, or to any personal data of Tosvi's other customers.

1. Restrictions — Tosvi shall not: (a) sell the Studio's personal data or

make it available to a third party for valuable consideration; (b) share it for cross-context behavioural advertising; (c) retain, use, or disclose it for any purpose other than providing the Service or as permitted by applicable law; (d) use it outside the direct business relationship with the Studio; or (e) combine it with personal data from other sources, except as necessary to provide the Service or as permitted by applicable law.

7. International transfers

All application data — including message content stored for the messaging feature — is stored in the EU (Supabase, Frankfurt, Germany). Tosvi is operated from Moldova, but the operator's location does not localize the data to Moldova: the data remains stored in the EU.

Which law applies, and whether any Chapter V (or equivalent) transfer safeguard is required, depends on where the Studio and its clients are located. For a Moldovan studio serving Moldovan clients, Moldovan law applies and EU storage is a transfer to an adequate destination — routine, requiring no Standard Contractual Clauses. For an EU (e.g. Romanian) studio and its EU clients, the GDPR applies. Although the data is stored within the EU (Supabase, Frankfurt), Tosvi operates from Moldova — a country without an EU adequacy decision — and its remote access to that data is a restricted transfer under Chapter V GDPR. That transfer is made under the Standard Contractual Clauses in Annex 3 (the Annex to Commission Implementing Decision (EU) 2021/914, Module Two). Separately, where a sub-processor genuinely processes data outside the EU/EEA, that transfer relies on Standard Contractual Clauses or an equivalent safeguard (see Annex 1).

The messaging feature relies on Telegram, which is the client's own chosen messaging channel and an independent recipient, not a Tosvi sub-processor. Only the content of a message the Studio sends, and the Telegram chat identifier used to address the recipient, are sent to Telegram; no CRM data (client name, phone, vehicle, history, quotes) is sent to Telegram — it stays in the EU. The client's phone number is received from Telegram at connection and stored, never sent back. Where message content is transmitted to Telegram outside the EEA, that transfer is made under Article 49(1)(b) and (c) GDPR — necessary for the performance of the contract with, or in the interest of, the data subject, the client having chosen Telegram as the channel — and is subject to Telegram's own privacy policy; Tosvi does not enter Standard Contractual Clauses with Telegram. The copy Tosvi stores on the Studio's behalf remains in the EU (Supabase, Frankfurt).

8. Controller obligations and representations

The Studio warrants and represents that:

1. it has a lawful basis to collect and process the personal data it enters, and

has provided its data subjects with the privacy information the law requires;

1. its instructions to Tosvi comply with applicable law;
2. it will relay to Tosvi, without undue delay, any data-subject request or

regulator communication that requires Tosvi's assistance;

1. it is responsible for determining whether the GDPR applies to its processing

(e.g. because it is established in the EU/EEA or processes EU/EEA residents' data) and for informing Tosvi where it does, so the parties can put in place any additional GDPR measures required (including, where applicable, an EU representative under Article 27 GDPR);

1. it is responsible for choosing, in the Service, retention periods for the data

it controls that are lawful under the law applicable to it — including where it chooses no automatic deletion, or exempts particular records from automatic deletion — and for erasing data it no longer needs. Tosvi provides the retention controls and the erasure tools; it does not determine how long the Studio's data is kept and does not delete the Studio's data on its own initiative.

The Studio is solely responsible for the lawful basis and for satisfying any Article 9 GDPR condition for any special-category or otherwise unlawful data that it or its clients submit through the Service, including via the free-text messaging feature, and must not solicit or deliberately store such data. This does not limit Tosvi's obligations as processor; Tosvi continues to apply the Annex 2 measures and all its clause 6 duties to all personal data it processes, including such data.

The Studio indemnifies, defends and holds Tosvi harmless against any claim, fine, penalty, damage, loss or reasonable cost (including legal fees) arising from the Studio's breach of its controller obligations — including any absence of a lawful basis or required consent, unlawful processing instructions, or special-category or otherwise prohibited data the Studio or its clients solicited or submitted — except to the extent the claim arises from Tosvi's own breach of this DPA, negligence, or wilful misconduct. This restates, and does not duplicate, the indemnity in the Terms of Service; Tosvi recovers only once. Tosvi reciprocally indemnifies the Studio for claims arising from Tosvi's breach of this DPA.

9. Liability and governing law

Each party's total aggregate liability under this DPA (including under any Standard Contractual Clauses entered into under it) is subject to, counts towards, and is governed by the limitation of liability and its carve-outs in the Terms of Service — except that Tosvi's liability for its own breach of its security obligations under clause 6.3 / Article 32 GDPR is capped at a separate higher amount equal to the greater of three (3) times the total fees the Studio paid in the twelve (12) months before the event giving rise to liability, or EUR 5,000, not the general cap. Nothing in this DPA or the Terms of Service limits either party's liability owed directly to a data subject or to a supervisory authority (including under Clause 12 of the SCCs), or any liability that cannot be limited under applicable data-protection law.

This DPA is governed by the laws of the Republic of Moldova and, where applicable, the GDPR.

This DPA is provided in English, Russian, and Romanian; in the event of conflict, the Romanian version prevails.

Annex 1 — Sub-processors

Annex 2 — Technical and organisational measures

• Encryption in transit (TLS) and at rest.
• Tenant isolation enforced by database row-level security; one studio cannot

access another's data.

• Inspection media held in a private storage bucket, served only via short-lived

signed URLs.

• Authentication hardening: bot protection (Turnstile), leaked-password

screening, email confirmation.

• Input validation on all inbound data; secrets held in a managed secrets vault or

in environment configuration, never in source code.

• Pseudonymisation: website-visitor IP addresses are truncated and irreversibly

hashed with a rotating daily salt and used only for rate limiting — a raw IP address is never stored; error reports are scrubbed of personal data before transmission to the monitoring sub-processor.

• Automated tests covering tenant-isolation and access-control rules, run before

every deployment, together with a periodic security review and daily automated monitoring of the audit log for anomalous access.

• Append-only audit log of account actions (no customer PII).
• Production access restricted to the operator.
• All personal data is stored at rest in the EU (Frankfurt); no copies are cached,

downloaded, or backed up to Moldova. The operator's access from outside the EU is remote, credentialed, over TLS, and limited to what is necessary to provide the Service.

• Tosvi will notify the Studio of any binding government or law-enforcement request

for the Studio's personal data, and will challenge any request that appears unlawful, to the extent legally permitted (consistent with Clause 15 of the SCCs).

• Regular encrypted backups with restore capability (via the hosting sub-processor).
• Periodic access and security review.
• Personal-data breach notification to the controller without undue delay.

Tosvi may update these measures from time to time provided the update does not materially reduce the overall level of security of the Studio's personal data, and in any event remains no less protective than Article 32 GDPR requires.

Annex 3 — Standard Contractual Clauses (EU, Module Two)

Where the Studio is established in the EU/EEA, or its processing is otherwise subject to the GDPR, and Tosvi processes the Studio's data from outside the EU/EEA, the parties enter into the Standard Contractual Clauses in the Annex to Commission Implementing Decision (EU) 2021/914, Module Two (Controller → Processor), incorporated here by reference. The official clause text is the Annex to Commission Implementing Decision (EU) 2021/914, published by the EU as the official Standard Contractual Clauses; it applies verbatim, without alteration, and is presented to the Studio in full at onboarding. The Clauses are completed as follows:

• Clause 9 (Sub-processors): Option 2, general written authorisation; 30 days'

prior notice of changes.

• Clause 11: the optional independent-dispute-resolution limb does not apply.
• Clause 17 (Governing law) & Clause 18 (Choice of forum and jurisdiction): the

law and courts of the EU/EEA Member State in which the Studio (data exporter) is established.

• Annex I.A (Parties): _Data exporter_ — the Studio (controller), whose identity

and contact details are recorded with its acceptance of this DPA. _Data importer_ — Petru Virtos, Antreprenor Independent, Cod fiscal 1026023032469, bd. Moscova 9/5 ap. 300, Chișinău MD-2068, Moldova; [email protected] (processor).

• Annex I.B (Description of transfer): the categories of data subjects, personal

data, frequency, nature, purpose, and retention set out in the "Processing details at a glance" table of this DPA. Special-category data is not intended but may incidentally arise in the messaging feature, subject to the minimisation, short retention, and deletion safeguards stated in that table.

• Annex I.C (Competent supervisory authority): the supervisory authority of the

Member State in which the Studio (data exporter) is established.

• Annex II (Technical and organisational measures): Annex 2 of this DPA.
• Annex III (Sub-processors): Annex 1 of this DPA.

In any conflict between these Clauses and the rest of this DPA in respect of a restricted transfer, these Clauses prevail. The parties enter into the completed Clauses (with Clause 17/18 and Annexes I–III filled in) at onboarding, and Tosvi's acceptance record captures the Studio's assent to that completed text.

The Clause 14 transfer-impact assessment supporting these Clauses (Moldova has no EU adequacy decision; data is EU-stored with encrypted remote access only; supplementary measures in Annex 2) is recorded and maintained by Tosvi and available to the Studio on request. Tosvi will re-assess it if Moldovan law materially changes or an EU adequacy decision for Moldova is adopted.

Signatures

The Studio accepts this DPA electronically during onboarding, recorded as evidence (see "Acceptance" above); a wet-signature copy is available on request at [email protected].