Customer Sharing Addendum

This addendum is made between GarageFlow Systems OÜ, registry code 17601459, of Sepapaja tn 6, 15551 Tallinn, Harju maakond, Estonia (“GarageFlow”, “we”, “us”) and an organization that runs several locations in GarageFlow under one account (the “organization”, “you”). It adds to our Data Processing Agreement (the “DPA”), whose terms and definitions apply to it.

It applies from the moment an administrator at your headquarters switches on “Share customers between locations” and accepts this addendum in the app. We record their name, email address, the time, the IP address the request came from and the version accepted. Until then each location's customers are kept apart from the others', and this addendum has no effect.

While sharing is switched on:

• Staff at a location who may look up customers can also find the customers of your other locations, by name, company, email address, phone number, account or tax number, or a vehicle’s plate, VIN or unit number. Search results show the customer’s name, contact details, location and vehicles
• Staff who may add customers can choose “Use here”. That creates a linked copy of the customer at their location, with the customer’s vehicles and, for a fleet account, its contacts. Choosing a fleet’s contact brings the fleet account with it. Nothing is copied until someone chooses “Use here”
• Each linked copy keeps the customer’s identity in step with the others: name, company, whether they are a business or a fleet account, email address, phone number, language, postal address, tax number and e-invoicing routing ID. A vehicle’s identity (plate, VIN, make, model and the other details describing it) stays in step the same way, and its odometer reading follows the highest one recorded. Whichever location changes these details, the change reaches every location that uses the customer
• A vehicle added for a shared customer, and a new contact added to a shared fleet account, are added at every location that uses that customer
• An opt-out (from email, from WhatsApp or from marketing) recorded at one location is applied at every location that uses the customer. An opt-in is never copied: consent is given to the location it was given to
• Staff at a location who may look up customers can see, read-only, the other locations’ orders and coming appointments for a shared customer, with the amounts hidden from anyone not allowed to see amounts at their own location
• Everything else stays each location’s own: internal notes, tags, account numbers, payment terms, prices, orders, invoices, payments, messages and files

Each of your locations remains the controller of the personal data of its own customers. Where your locations are separate businesses (franchisees, for example), switching sharing on means that customer data passes between controllers, or that your locations decide together how a shared customer's data is used. How that relationship is arranged between your locations is for you and them to decide and record.

We remain a processor for every location under the DPA. Switching sharing on is your documented instruction to process customer data in the ways described in section 2, and switching it off withdraws that instruction.

By accepting this addendum, you confirm and undertake that:

• The person accepting it is authorised to do so for the organization, and every location has agreed to share its customers on these terms. Where a location is a separate legal entity, you have its agreement in writing
• Your locations have an arrangement between them that covers the sharing (for example a joint controller arrangement under Article 26 GDPR, or a data sharing agreement between controllers) and a lawful basis for it
• Your customers are told, as Articles 13 and 14 GDPR require, that their details may be used by the organization’s other locations
• Each location answers data subject requests for the data it holds. Erasing or correcting a customer at one location changes only what section 2 says is kept in step; the other locations must deal with their own copies, and you will coordinate requests between your locations
• Each location still obtains its own consent for marketing before sending any

Headquarters' read-only customer search, which lets the organization's headquarters users find a customer at any location, is part of the multi-location service whether or not sharing is on. The undertakings in this section apply to it as well.

• We process shared customer data only as section 2 describes, and otherwise exactly as the DPA provides, including its security measures and sub-processors
• We keep the record of each acceptance described in section 1 for as long as the organization exists, and make it available to you on request
• We do not merge, combine or delete customer records across locations of our own accord. A linked copy is a record of the location that made it
• If a location leaves the organization, its copies stop being linked to the other locations and stay with it as its own records

An administrator at your headquarters can switch sharing off at any time. From that moment locations no longer find each other's customers, linked copies stop being kept in step, and nobody sees another location's history. Nothing is deleted: each location keeps the customers it uses as its own records, under the DPA. Switching sharing on again needs this addendum to be accepted at its version at the time, and copies made earlier are kept in step again from their next change.

If we change this addendum in a way that materially affects your rights, we will give at least 30 days' notice, as section 12 of the DPA provides. If this addendum conflicts with the DPA on the sharing of customers between your locations, this addendum prevails; otherwise the DPA governs.

Questions about this addendum go to [email protected].

This addendum is published in English. Translations are provided for convenience only; in the event of any discrepancy, the English text governs.