Data Processing Agreement

This is a translation of the Portuguese original. In case of any discrepancy, the Portuguese version prevails — myfleet.pt/acordo-de-tratamento-de-dados/.

Version 1.0 · Last updated: 14 October 2026

1. Parties and subject matter

This agreement is entered into between the operating company that subscribes to Myfleet (the “Controller”) and Libelinha Lilaz, Lda., Bigorna.digital brand, company number 519531400, with registered office at Praça Capitão José Santos Leite, Loja 4A, 2615-164 Alverca do Ribatejo, Portugal (the “Processor”).

It governs the processing of personal data that the Processor carries out on behalf of the Controller when providing the Myfleet service, under Article 28 of the General Data Protection Regulation (GDPR). The details of the processing are set out in Annex I.

This agreement forms part of the Myfleet Terms and Conditions. On matters of data protection, it prevails over them.

2. Acceptance, term and version

The agreement is accepted by whoever binds the Controller, at registration and in the app, alongside the Terms and Conditions. The date, the version accepted and the identity of the person who accepted it are kept by the Processor.

It remains in force for as long as the Controller has a Myfleet account and, after that, for the time needed to comply with clause 11.

3. Controller's instructions

The Processor processes the data only on documented instructions from the Controller, including with regard to transfers outside the European Economic Area, unless the law requires other processing; in that case, it informs the Controller beforehand, where the law allows.

This agreement, the Terms and Conditions and the choices the Controller makes in the app, such as the data it uploads, the integrations it connects and the access it grants, constitute documented instructions.

If the Processor considers that an instruction infringes data protection law, it informs the Controller immediately.

4. Controller's obligations

The Controller warrants that it has a lawful basis for the data it processes in Myfleet, that it informs the drivers about that processing, and that the data it uploads or imports is accurate and necessary.

The Controller only uploads drivers' criminal record certificates to Myfleet to verify the good repute required for TVDE activity, and does not upload other data under Article 10 GDPR, nor special categories of data under Article 9, except where a document required for the activity contains them incidentally.

5. Confidentiality

The Processor ensures that the persons authorised to process the data are bound by confidentiality, by contract or by law, and that they access only what is strictly necessary to operate the service and provide support.

6. Security

The Processor applies the technical and organisational measures described in Annex II, appropriate to the risk, and keeps them up to date. It may change them, provided the level of protection does not decrease.

7. Sub-processors

The Controller gives general authorisation for the use of the sub-processors listed in Annex III.

The Processor notifies the Controller, by email or in the app, at least 30 days in advance, of any addition or replacement. The Controller may object on reasonable grounds within that period; if the parties do not reach agreement, the Controller may cancel the subscription at no cost, with a proportional refund of the period paid and not used.

The Processor imposes on each sub-processor, by contract, data protection obligations equivalent to those of this agreement and is liable to the Controller for their fulfilment.

8. International transfers

Where the data is processed outside the European Economic Area, the transfer relies on the adequacy decision for the EU-US Data Privacy Framework, where the recipient is certified, or on standard contractual clauses approved by the European Commission. The Controller may request a copy of the applicable safeguards.

9. Assistance to the Controller

The Processor assists the Controller, insofar as possible and taking into account the nature of the processing:

1. in responding to requests to exercise data subjects' rights, in particular through the app's functions for viewing, correcting, exporting and deleting data; if it receives a request directly, it forwards it to the Controller without delay and does not respond to it itself;
2. in complying with the obligations of security, breach notification, data protection impact assessment and prior consultation under Articles 32 to 36 GDPR, with the information available to it.

10. Personal data breaches

The Processor notifies the Controller without undue delay, and at the latest 48 hours after becoming aware of a personal data breach affecting its data.

The notification describes, insofar as it is known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. Information not yet available is sent as soon as it is.

Notification to the CNPD and to data subjects is the Controller's responsibility.

11. End of processing

When the subscription ends, the Controller may export its data for as long as the account has not been closed. After closure, the Processor deletes the personal data or anonymises it, within the periods in section 7 of the Privacy Policy.

The Controller instructs the Processor to keep, for the legal period, the records with tax relevance (settlements, receipts, payment proofs, trips, expenses and payments), so that the Controller can comply with its obligations. Those records are anonymised whenever their purpose allows.

12. Demonstrating compliance and audits

The Processor makes available to the Controller the information needed to demonstrate compliance with this agreement.

The Controller may, once a year, or after a data breach, carry out or commission an audit, with 30 days' prior notice, by an auditor bound by confidentiality, without disrupting the service and at the Controller's expense. Whenever possible, the audit is carried out by questionnaire and document review.

13. Liability

Each party is liable under Article 82 GDPR. Between the parties, the limitations of liability in the Terms and Conditions apply, to the extent the law allows.

14. Changes, governing law and jurisdiction

The Processor may update this agreement to adapt it to the law, to guidance from the authorities or to changes in the service that do not reduce the protection of the data. The new version is shown in the app, with what has changed, and must be accepted before continuing.

Portuguese law applies. The courts of the district of Lisbon have jurisdiction.

Annex I — Details of the processing

Annex II — Technical and organisational measures

• Separation between companies, enforced by the database itself: each company can access only its own data and each driver only their own.
• Access control: sign-in with a single-use code sent by email or with a Google account; different permissions per role within the company.
• Activity log of access and changes, kept for 3 months.
• Encryption of data in transit.
• Hosting of the database and uploaded files in the EU (Frankfurt, Germany).
• Automatic backups by the database provider.
• Team access limited to what is strictly necessary to operate the service and provide support.
• Minimisation: automatic reading of documents is optional and the weekly summary does not receive tax numbers, contact details or documents.

Annex III — Authorised sub-processors

Stripe processes only the payment data for the Controller's subscription, as an independent controller or on behalf of Libelinha Lilaz, and not drivers' data. The transport platforms that the Controller connects or imports files from, such as Bolt and Uber, are data sources chosen by it and not sub-processors.