This agreement is made under Article 45 of the Serbian Law on Personal Data Protection ("Official Gazette of RS", No. 87/2018, the "Law") between:
- the business using ServisOS, as the controller (the "business"), and
- Milan Milić, the provider of ServisOS, as the processor ("ServisOS").
This agreement is part of the Terms of use and the business accepts it together with them. On request, we also send a copy signed on our side.
1. Subject and duration
ServisOS processes the personal data that the business and its users enter into the app, solely to provide the service. The agreement lasts while the business uses the service, and its obligations remain until the data is deleted (point 4.9).
2. Nature and purpose of processing
Storing, displaying, searching, changing and deleting data; export to Excel; sending emails and reminders to the business's users; AI processing when a user starts it; backups. The types of data and data subjects are described in Annex 1.
3. The business's instructions
ServisOS processes data only on the business's instructions. The instructions are this agreement, the Terms of use, and what the business does in the app (entering, changing, deleting, settings). If we believe an instruction is unlawful, we will inform the business immediately.
4. ServisOS's obligations
- Confidentiality. Only people bound to confidentiality who need it to run the service have access to the data.
- Security. We apply the measures in Annex 2 and keep improving them.
- Sub-processors. The business gives general authorisation for the sub-processors in Annex 3. We inform the business of a new sub-processor at least 30 days in advance; the business may object and, if we cannot agree, terminate the agreement. We have a contract with each sub-processor carrying the same protection obligations.
- Transfers outside Serbia only as listed in Annex 3, with the safeguards required by the Law (Art. 64 and 65).
- Data subject rights. We help the business respond to requests (access, correction, erasure, portability). The business does most of this itself in the app. Requests that reach us directly are forwarded to the business.
- Data breaches. We notify the business of a data breach without undue delay, and no later than 48 hours after becoming aware of it, with the information needed to notify the Commissioner (Art. 52).
- Assistance with data protection impact assessments and prior consultation with the Commissioner, where needed (Art. 54 and 55).
- Audits. On request, we provide the information needed for the business to verify compliance with this agreement and allow inspections with reasonable notice.
- End of processing. When the service ends, the business has 30 days to export its data. We then delete it, and it disappears from backups within the following 30 days, unless the law requires longer retention.
5. The business's obligations
- Has a legal basis for the data it enters and informs data subjects about the processing (Art. 23).
- Enters only the data it needs and decides how long to keep it.
- Gives users only the permissions they need and makes sure they keep their passwords safe.
6. Liability
Liability is governed by the Terms of use, unless the Law provides otherwise.
Annex 1: Data subjects and types of data
| Data subjects | Data |
|---|---|
| Drivers and renters | Name, phone, email, address, date of birth, citizenship, number and expiry of ID document, driving licence and residence permit, images of documents, contracts, payments, damages, fines |
| Partners and contact persons | Name, phone, email, address, company tax ID and registration number |
| Repair shop customers | Name, contact details, vehicles, work orders, estimates and payments |
| The business's users | Name, email, role, change history, access log, voice notes |
| Other people in documents | Data on images and PDFs the business uploads (reports, fines, invoices) |
The app does not ask for special categories of data (Art. 17 of the Law), and the business should not enter them.
Annex 2: Security measures
- HTTPS for all traffic; server in a secured data centre in the EU.
- Each business's data kept separate, enforced at the database level.
- Roles and permissions per user; passwords stored as a secure hash; temporary lockout after 5 wrong attempts.
- Change history and access log visible to the business.
- Uploaded files are checked and hidden data is removed from images.
- Daily backups, also at a second location in the EU; restore tested; database backups kept 14 days, and 30 days at the second location.
- Only the provider (with an SSH key) and the automated release process can access the server; passwords and keys exist only on the server.
- Continuous monitoring of operation and errors; technical logs kept 30 days, without document contents.
Annex 3: Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| netcup GmbH, Karlsruhe | Server, database and files | Germany (EU) |
| Cloudflare, Inc. | Backups (R2), DNS | Backups in the EU; US company |
| Anthropic PBC | AI features, only when a user starts them | USA |
| Sendinblue SAS (Brevo) | Sending emails to the business's users | France (EU) |
| Browser push services | Delivering encrypted reminders | Depends on the user's browser |
Speech-to-text is done by the user's browser (in Chrome, by Google), outside ServisOS, only when the user uses the microphone.