Data Processing Agreement
Last updated: October 9, 2026
This Data Processing Agreement (“DPA”) is part of the Pit Box Terms of Use. It applies when a garage (“Customer”) stores personal data of its clients, such as names, phone numbers, cars, VINs, plates and photos, in Pit Box, and Pit Box processes that data on the Customer's behalf. It is written to meet Article 28 of the EU General Data Protection Regulation (GDPR).
1. Parties and roles
The Customer is the controller of its clients' personal data. Mykhailo Dudar, an individual developer based in Ukraine, contact hello@pit-box.app (“Pit Box”), is the processor. For data about the Customer's own account and team members, Pit Box is a controller, as described in the Privacy Policy.
2. What is processed
- Subject matter and purpose: providing the Pit Box service, which is storing, syncing, displaying and exporting the Customer's garage data.
- Categories of data subjects: the Customer's clients, and the Customer's team members.
- Types of personal data: names, phone numbers and messenger contacts, notes, car make, model, plate, VIN and mileage, photos of cars, order, payment and debt records, and service history.
- Special categories: none are intended. The Customer should not store special categories of data, such as health data, in Pit Box.
- Duration: for as long as the Customer uses Pit Box, and until the data is deleted under section 9.
3. Instructions
Pit Box processes the data only on the Customer's documented instructions. The Terms of Use, this DPA and the Customer's use of the app's features count as those instructions. Pit Box does not use the data for its own purposes, does not sell it, and does not use it for advertising or for training models. If Pit Box believes an instruction breaks the law, it will tell the Customer.
4. Confidentiality
Anyone at Pit Box who can access the data is bound by confidentiality. Pit Box accesses a garage's data only when the Customer asks for support, or when it is necessary to investigate abuse or keep the service secure.
5. Security
Pit Box takes appropriate technical and organisational measures to protect the data, including:
- encryption in transit (HTTPS/TLS) and at rest by the hosting provider;
- access control enforced on the server (row-level security), so each garage sees only its own data and members see only what their role allows;
- secret keys for third-party services kept on the server, never in the app;
- regular backups;
- limiting access to what is necessary.
6. Sub-processors
The Customer authorises Pit Box to use these sub-processors:
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase Inc. | Database, authentication, file storage, server functions | EU (Ireland) |
| Google LLC (Cloud Vision) | Reading text from VIN photos, not stored | USA |
| 650 Industries Inc. (Expo) | Delivering push notifications | USA |
| Apple Inc. | Push notifications, Sign in with Apple | USA |
| Resend Inc. | Sending account emails | USA |
Pit Box binds each sub-processor to data protection obligations at least as strong as this DPA. It will announce any new sub-processor on this page at least 14 days before using it. The Customer can object by writing to hello@pit-box.app. If the objection can't be resolved, the Customer may stop using Pit Box and delete its account.
7. Transfers outside the EU
Customer data is stored in the EU. Where a sub-processor processes data outside the EEA, the transfer is protected by the EU-US Data Privacy Framework where the sub-processor is certified, or by the European Commission's Standard Contractual Clauses.
8. Help with requests and breaches
- Data subject requests. If a client of the Customer contacts Pit Box directly, Pit Box will forward the request to the Customer and will not answer it itself, unless required by law. The app lets the Customer find, correct, export and delete client data. Pit Box will help where the app is not enough.
- Personal data breaches. Pit Box will notify the Customer without undue delay, and in any case within 48 hours of becoming aware of a breach affecting the Customer's data. The notice will say what happened, what data is affected and what is being done.
- Other assistance. Pit Box will give reasonable help with data protection impact assessments and with questions from supervisory authorities, as far as they concern Pit Box's processing.
9. Deletion at the end
When the Customer deletes its garage or account, Pit Box deletes the Customer's data from the live service right away and from backups within 30 days, unless the law requires keeping it. Before deleting, the Customer can export its data from the app.
10. Audits
On request, Pit Box will provide the information needed to show that it complies with this DPA. Customers can send written questions to hello@pit-box.app. Where the law requires an audit or inspection, it will be agreed in advance, at reasonable times, with reasonable notice, and at the Customer's cost.
11. Liability and order of precedence
Liability under this DPA follows the Liability section of the Terms of Use, as far as the law allows. If this DPA and the Terms of Use conflict on data protection, this DPA prevails.