Annex E — Data Processing Agreement & SLA

Article 28 GDPR data processing agreement and service level agreement for ViTrack, governing how Gaman Endeavours SL processes personal data for the Customer.

Effective: November 2026

This Annex forms part of the ViTrack Master Services Agreement (the "Agreement") and applies only where an Order expressly incorporates it. It is the Data Processing Agreement required under Article 28 of Regulation (EU) 2016/679 (GDPR) and also includes the Service Level Agreement (SLA). In the event of any conflict concerning the processing of personal data, the terms of this Annex prevail over the rest of the Agreement.

1. Roles and object

For the personal data processed under the Services, the Customer acts as controller and ViTrack acts as processor. ViTrack processes personal data only on the Customer's documented instructions and solely to provide the contracted Services. The Agreement, this Annex and the applicable Order constitute the Customer's documented instructions.

2. Object, duration, nature and purpose

The subject matter of the processing is the provision of the Platform and the associated Services. The duration matches the term of the Agreement and the relevant Order. The nature and purpose of the processing is the monitoring and traceability of shipments and assets and the operational activities necessary to deliver the Services through the Platform and the Devices.

3. Categories of data and data subjects

The processing concerns the following data subjects and categories of personal data:

Data subjects

  • The Customer's users of the Platform and Services.
  • Where applicable, logistics and transport personnel involved in the Customer's shipments.

Categories of data

  • Contact and identification data.
  • Access credentials.
  • Location and telemetry data linked to identifiable individuals.
No special categories of personal data (Article 9 GDPR) are envisaged.

4. Processor obligations

  • Process personal data only on the Customer's documented instructions, including on international transfers, unless required to do otherwise by law.
  • Ensure that personnel authorised to process the data are bound by an appropriate duty of confidentiality.
  • Implement the technical and organisational security measures required under Article 32 GDPR.
  • Assist the Customer, taking into account the nature of the processing, in meeting its own obligations under the GDPR and Spanish Organic Law 3/2018 (LOPDGDD).

5. Subprocessors

The Customer grants ViTrack general authorisation to engage subprocessors (such as hosting and connectivity providers) to deliver the Services. Each subprocessor is bound by data protection obligations equivalent to those in this Annex. ViTrack informs the Customer of any addition or replacement of subprocessors, and the Customer may object on reasonable, documented data protection grounds.

6. Security measures

ViTrack applies appropriate technical and organisational measures, including:

  • Encryption of personal data in transit.
  • Access controls and authentication for the Platform.
  • Logging of relevant activity.
  • Backups and business continuity arrangements.
  • Periodic testing and review of the measures in place.

7. Personal data breach

ViTrack notifies the Customer without undue delay, and in any event within 48 hours of becoming aware of a personal data breach affecting Customer Data, providing the information the Customer reasonably needs to comply with its own notification duties towards the supervisory authority and affected data subjects.

8. International transfers

ViTrack does not transfer Customer personal data outside the European Economic Area unless the transfer is supported by an adequacy decision or by Standard Contractual Clauses or another valid transfer mechanism under the GDPR.

9. Data-subject rights

Taking into account the nature of the processing, ViTrack assists the Customer by appropriate technical and organisational measures in responding to requests from data subjects to exercise their rights of access, rectification, erasure, restriction, portability and objection.

10. Return and deletion

On termination of the Services, ViTrack, at the Customer's choice, returns or securely deletes the Customer personal data and existing copies, unless retention is required by applicable law.

11. Audits

ViTrack makes available to the Customer the information necessary to demonstrate compliance with this Annex and allows for and contributes to reasonable audits, including inspections, on prior notice, provided they do not compromise the security or privacy of other customers.

12. SLA — Availability

ViTrack targets a monthly Platform availability of 99.5%. Scheduled maintenance windows and events of force majeure or attributable to third parties beyond ViTrack's reasonable control are excluded from the availability calculation.

13. SLA — Support and response times

Support is provided by email during business hours (9:00–18:00 CET) at support@vitrack.me. ViTrack targets the following response times by severity:

  • Critical: within 4 hours.
  • High: within one business day.
  • Normal: within three business days.

14. SLA — Maintenance and service credits

Planned maintenance is announced with reasonable notice and carried out, where possible, outside business hours. Repeated failure to meet the availability target may entitle the Customer to service credits as set out in the applicable Order.

Contact

Gaman Endeavours SL
Data protection: legal@vitrack.me
Supervisory authority: Agencia Española de Protección de Datos (AEPD, www.aepd.es)