Courtesy translation. In the event of any discrepancy, the Spanish version shall prevail.

Data Processing Agreement

Article 28 of Regulation (EU) 2016/679 (GDPR)

Last updated: September 2026

This agreement governs the relationship between CamperTech (processor) and each client workshop that subscribes to the platform (controller), with regard to the personal data of end customers that the workshop enters into the platform.

If you are a CamperTech client workshop, this agreement forms part of the terms of service. By using the platform and registering your own customers, you accept the terms set out herein.

1. Parties

Controller:

The client workshop that enters into the service agreement with CamperTech and enters personal data of its own end customers into the platform.

Processor:

Adrià Marfil Pérez (CamperTech), NIF 77923946S, Carrer Hort Nou, 10, 2º-2ª, 17403 Sant Hilari Sacalm (Girona), Spain. Email: campertech.solutions@gmail.com.

2. Subject matter

CamperTech, in its capacity as processor, will process personal data on behalf of the client workshop (controller) exclusively to provide the camper conversion workshop management service described in the service agreement, and under no circumstances for its own purposes or for purposes other than those set out therein.

3. Nature and purpose of the processing

Categories of data subjects: The workshop's end customers (natural persons).

Categories of data: First name, surname, email address, phone number, vehicle data (registration number, make, model), and any other data that the workshop chooses to enter into the platform.

Processing operations: Storage, consultation, updating and erasure of data for the management of the workshop's quotes, orders, customers and internal analytics.

4. Obligations of the processor (CamperTech)

To process the data only on the documented instructions of the controller. If it considers that an instruction infringes the GDPR, it will report this immediately.
To ensure that persons authorised to process the data are subject to an obligation of confidentiality.
To implement appropriate technical and organisational measures to ensure the security of the data (encryption in transit, access control, backups).
To comply with the conditions for engaging another processor (sub-processor) and to inform the controller in advance of any intended change affecting it, giving it the opportunity to object.
To assist the controller in fulfilling its obligations to respond to requests for the exercise of data subjects' rights.
To assist the controller in complying with the obligations regarding security (Art. 32-36 GDPR), breach notification and impact assessments.
To delete or return all data to the controller at the end of the contract, as instructed by the controller, and to delete existing copies unless there is a legal obligation to retain them.
To make available to the controller all information necessary to demonstrate compliance with the obligations of this agreement.

5. Sub-processors

The controller authorises CamperTech to engage the following sub-processors, which are necessary for the provision of the service:

Supabase Inc. — database and authentication (Ireland region, EU)
Hetzner Online GmbH — application server (Nuremberg, Germany)
Stripe Inc. — payment gateway (USA, with standard contractual clauses)
Resend — sending of the emails that the Platform sends on the workshop's behalf, such as quotes and reminders (USA, with standard contractual clauses)

In addition, CamperTech uses Google Analytics (Google Ireland Limited) to obtain usage statistics for the Platform, only if the user consents in the cookie banner. For this processing CamperTech acts on its own behalf and not as a sub-processor: Google Analytics does not receive the data that the controller enters in the Platform (customers, vehicles, quotes) and is not loaded on the public quote or customer portal pages.

CamperTech will inform the controller sufficiently in advance of any intended change to the list of sub-processors, giving it a reasonable period to object.

6. International transfers

The data is stored mainly on servers located in the EU/EEA (Supabase Ireland, Hetzner Germany). The use of Stripe involves a transfer to the USA, covered by standard contractual clauses approved by the European Commission in accordance with Art. 46 GDPR. Sending emails through Resend likewise involves a transfer to the USA, covered by the same safeguards.

7. Duration

This agreement shall remain in force for as long as the service agreement between the workshop and CamperTech is in force. Upon termination, CamperTech will delete or return the data as set out in clause 4.

8. Responsibilities

The controller warrants that it has a lawful basis for processing the data of its end customers and that it has fulfilled its own information and transparency obligations. CamperTech assumes no liability whatsoever for processing carried out outside the scope of the contracted service, nor for data entered by the controller without the appropriate legal basis. Nothing in the foregoing limits either party's liability towards data subjects under Article 82 GDPR, nor liability for wilful misconduct or gross negligence.

9. Applicable law

This agreement is governed by Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD). For any dispute, the parties submit to the courts and tribunals of Girona, without prejudice to complaints before the Agencia Española de Protección de Datos (the Spanish data protection authority, www.aepd.es).

Do you have questions about this agreement? Write to us at campertech.solutions@gmail.com.