Data processing agreement

This agreement is between the garage using Historiku (the Controller) and Naim Reçica B.I., trade name POS Kosova, Rr. Enver Gjerqeku nr. 9, Prishtinë, business number [NUI] (the Processor). It is accepted by the garage at signup together with the terms of use. It is based on Law No. 06/L-082 on the Protection of Personal Data.

1. Roles

The garage is the controller of the customer and vehicle data it enters into Historiku (names, phones, emails, plates, VINs, service history, reminders, estimates). POS Kosova processes it only on the garage's behalf and on its instructions. For staff accounts and the marketing site POS Kosova is the controller, under the privacy policy.

2. Subject matter and duration

Processing covers storing, displaying, searching, exporting and deleting data to provide the Historiku service, for as long as the garage has an account and during the retention period after cancellation.

3. Processor's obligations

• Processes the data only on the garage's instructions and to provide the service.
• Ensures persons with access are bound by confidentiality.
• Applies security measures: TLS, passwords and tokens stored as hashes, strict per-garage data separation, audit log, backups.
• Helps the garage answer data subject requests (access, correction, deletion) by providing export and customer anonymisation.
• Notifies the garage without undue delay on learning of a personal data breach.
• At the end of the service deletes or returns the data according to the retention rules in the privacy policy.
• Makes available to the garage the reasonable information needed to show compliance with this agreement.

4. Garage's obligations

The garage ensures a legal basis for the data it enters, informs its customers and keeps the data accurate.

5. Sub-processors

The garage authorises the sub-processors below. POS Kosova will notify the garage of changes.

Provider	Purpose	Location
Hetzner Online GmbH	Server (application and database)	Nuremberg, Germany (EU)
Cloudflare, Inc.	DNS, proxy/TLS, email routing, backups (R2)	US company; storage location to be confirmed in the legal review
Brevo (Sendinblue SAS)	Transactional email	France (EU)

6. Law, court and language

The laws of the Republic of Kosovo apply. Disputes are resolved by the Basic Court of Prishtina. If the language versions differ, the Albanian version prevails. Contact: info@historiku.com.