Data Processing Agreement (DPA) – Racapp Platform

This Data Processing Agreement (the “DPA”) is entered into between Split Second Connect Limited, a limited liability company incorporated under the laws of the Republic of Cyprus, with its registered office at 192 Ledras Street, 3rd Floor, 1011, Nicosia, Cyprus (“SSC” or “Processor”), and each client entity using the Racapp Platform (“Client” or “Controller”), collectively referred to as the “Parties.”

This DPA forms part of the Terms of Service or other agreement between SSC and the Client governing the Client’s use of the Racapp Platform (“Principal Agreement”). These Agreements can be found here Terms of Service .

1. SUBJECT MATTER AND DURATION

This DPA sets out the terms and conditions governing SSC’s processing of personal data on behalf of the Client in connection with the provision of the Racapp Platform and related services. The processing shall commence on the Effective Date of the Principal Agreement and continue for as long as SSC provides services to the Client.

2. DEFINITIONS

For the purposes of this Agreement, the following terms shall have the meanings assigned below. All other terms shall have the meanings given to them in the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

  • “Personal Data” means any information relating to an identified or identifiable natural person processed by SSC on behalf of the Client.
  • “Processing” means any operation or set of operations performed on Personal Data, whether or not by automated means, as defined in Article 4(2) of the GDPR.
  • “Data Subject” means the individual to whom the Personal Data relates.
  • “Sub-Processor” means any third party engaged by SSC to process Personal Data on behalf of the Client.
  • “Services” shall have the meaning indicated in clause 1 of the SLA.

3. ROLE OF THE PARTIES

The Client acts as the Data Controller in relation to the Personal Data entered or uploaded into the Racapp Platform. SSC acts as the Data Processor, processing such Personal Data on behalf of the Client and in accordance with the Client’s documented instructions. For the avoidance of doubt, SSC shall act as an independent Controller only with respect to data relating to its own business operations, such as vendor account management and billing.

The Client is responsible for ensuring that Personal Data entered, uploaded, or otherwise submitted by the Client, its authorized users, or its end customers through the Platform is collected on a valid legal basis, including any required consent for identity documents, driving documents, images, or other verification materials. SSC processes such Personal Data only as necessary to provide the Platform and related services on behalf of the Client, except where SSC processes data as an independent Controller for its own legal, security, billing, or business administration purposes.

4. NATURE AND PURPOSE OF PROCESSING

SSC processes Personal Data solely for the following purposes:

  • Providing and maintaining access to the Racapp Platform for the Client and its authorized users;
  • Authenticating users and managing access credentials via external authentication providers;
  • Generating and delivering rental agreements and other business documents on behalf of the Client;
  • Facilitating customer-facing reservation checkout, reservation confirmation, and related customer communications;
  • Supporting Customer identity verification, driver eligibility checks, fraud prevention, misuse prevention, and verification of ID/passport, driving license, date of birth, contact, address, nationality, and related reservation information;
  • Processing images or copies of identity documents, passports, driving licenses, or related photographic data where uploaded, provided, or otherwise made available through the Platform for reservation, verification, rental agreement, insurance, or compliance purposes;
  • Initiating payments, redirecting Customers to payment provider pages, storing payment references, and checking payment authorization or status through third-party payment integrations, without collecting, storing, processing, or accessing full credit card numbers, card security codes (CVV/CVC), bank account credentials, or payment account login details;
  • Receiving and processing limited payment-related metadata, such as payment identifiers, transaction status, reservation references, payment method type, billing or reconciliation information, and payment provider response metadata, as necessary to operate the Platform and confirm payment status;
  • Facilitating email communications between the Client and its end customers;
  • Providing technical support, including, where necessary, limited access to Client databases to investigate and resolve issues;
  • Complying with legal obligations under EU and Cyprus law.

5. CLIENT INSTRUCTIONS

SSC shall process Personal Data only on documented instructions from the Client, including as set out in this Agreement and the Principal Agreement. If SSC believes that an instruction infringes the GDPR or other applicable law, it shall promptly notify the Client. SSC shall not be obliged to act on any instruction that would result in unlawful processing.

6. CONFIDENTIALITY

SSC shall ensure that all persons authorized to process Personal Data under its responsibility are bound by an appropriate duty of confidentiality, whether contractual or statutory, and shall only access the data to the extent required for performance of their duties.

7. SECURITY OF PROCESSING

SSC shall implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including, as applicable:

  • Pseudonymization and encryption of Personal Data;
  • Measures to ensure ongoing confidentiality, integrity, availability, and resilience of processing systems and services;
  • Measures for timely restoration of data availability and access in the event of an incident;
  • Procedures for regular testing, assessment, and evaluation of the effectiveness of security measures.

8. SUB-PROCESSORS

SSC may engage Sub-Processors to process Personal Data on behalf of the Client. A current list of authorized Sub-Processors is maintained at Subprocessors . SSC shall ensure that any Sub-Processor is bound by written obligations no less protective than those set forth in this Agreement.

SSC shall notify the Client in advance of any intended changes concerning the addition or replacement of Sub-Processors, thereby giving the Client the opportunity to object to such changes on reasonable grounds.

9. DATA SUBJECT RIGHTS

SSC shall assist the Client, to the extent possible, in fulfilling its obligation to respond to requests from Data Subjects exercising their rights under the GDPR, including rights of access, rectification, erasure, restriction, portability, and objection. Where such a request is received directly by SSC, it shall promptly forward it to the Client without undue delay.

10. DATA BREACH NOTIFICATION

In the event of a personal data breach, SSC shall notify the Client without undue delay after becoming aware of the breach. Such notification shall include all available information necessary for the Client to meet its reporting obligations under Articles 33 and 34 of the GDPR, including the nature of the breach, likely consequences, and remedial actions taken or proposed.

11. Miscellaneous

To the extent any matter is not regulated by the present DPA, the terms of the Principal Agreement shall apply.

End of Data Processing Agreement

Last updated: 27 May 2026