Parties and subject
This agreement under GDPR Article 28 forms part of the MyDiagnostics terms. The customer named in the company account is controller of data about people whose devices it tests; myrepair s.r.o., registration number 23521414, is processor. The provider’s own account and payment data are governed separately by the privacy policy.
Purpose, nature and data categories
Processing includes receiving, storing, organising, making available to authorised users, exporting and deleting diagnostic data to provide MyDiagnostics during the contract and return or deletion settlement. Data subjects include repair shop customers, device owners or users and customer staff. Data include device identifiers, technical parameters, battery and parts data, results, times and necessary notes. The service is not intended for special categories of data or criminal-conviction data.
Customer instructions and duties
Documented instructions comprise service use, settings and verified requests from an authorised customer, including export or deletion. The customer ensures lawful purpose, minimisation, notices and device authorisation. The processor will not use data for its own advertising, sale or model training. It will flag unlawful instructions and may proportionately suspend them. Legally required disclosure is notified in advance where permitted.
Confidentiality and security
The processor grants access only to people bound by confidentiality and implements risk-appropriate measures under GDPR Article 32: HTTPS in transit, access control, customer separation, authentication protection and minimisation of unnecessary records. Effectiveness is assessed regularly. Specific security secrets and access to other customers are not disclosed.
Subprocessors and storage countries
The customer generally authorises in writing Váš Hosting s.r.o., registration number 24742252, for server and database hosting in the Czech Republic. Providers of account or payment services are listed in the privacy policy and do not automatically gain rights to diagnostic data. The processor imposes equivalent contractual duties on subprocessors and remains responsible as required by GDPR.
The processor notifies customers of intended additions or replacements of diagnostic-data subprocessors at least 30 days in advance. Customers may object on documented data-protection grounds; parties seek a remedy, otherwise the affected processing can end before the change with unused prepaid amounts settled. Transfers outside the EEA require documented instructions and GDPR Chapter V safeguards.
Assistance and incidents
The processor reasonably assists with data-subject rights, security, impact assessments, authority consultation and compliance evidence. It forwards customer-data requests to the controller and does not act without instructions unless required by law. On discovering a personal-data breach, it notifies the customer without undue delay, providing known scope, likely effects and measures and updating information as available. This does not transfer the controller’s statutory duties to the processor.
Information and audits
On reasonable request, the processor supplies information needed to demonstrate compliance and allows and contributes to audits, including inspections by the controller or its appointed auditor. Parties agree reasonable timing, confidentiality and protection of other customers without effectively preventing the audit. Charges for exceptional additional assistance must be agreed in advance and must not limit mandatory duties.
Return, deletion and duration
After the relevant service ends, the processor returns data in an available common export format or deletes data and copies at the controller’s choice, unless law requires retention. Backups expire in the appropriate cycle without further active processing. On request, the processor confirms completion and explains exceptions. Protection duties continue until processing ends; this agreement prevails over general terms for processor obligations.