Data Processing Agreement

Version 1.0 — Effective from 1 November 2026

1. Parties, scope and order of precedence

1.1 This Data Processing Agreement (“DPA”) is concluded between you, the customer under the Fleetless Terms of Service (“Terms”), and Dehne Robotik GmbH, Rosentwiete 1, 25355 Groß Offenseth-Aspern, Germany (“Fleetless”, “we”, “us”). It forms part of the contract under the Terms and takes effect when you accept the Terms.

1.2 This DPA applies where we process personal data contained in Customer Data (section 9.1 of the Terms) on your behalf and you are a controller within the meaning of Art. 4(7) of the General Data Protection Regulation (GDPR), or a processor acting for another controller. We then act as your processor, or as your sub-processor, under Art. 28 GDPR. The safeguards in this DPA also apply contractually where an individual uses the Service for purely personal or household purposes and is exempt from the GDPR under Article 2(2)(c). This does not transfer responsibility for purposes independently determined by either party to the other party.

1.3 This DPA does not cover personal data that we process as a controller for our own purposes, such as the e-mail addresses of your members, invoices and payment records. This exclusion covers data we process for our own account administration, billing and support-contact purposes. Customer Data supplied to us for technical support remains subject to this DPA where we process it on your behalf. We also process the security and operational logs of the Service, such as server access logs with IP addresses and request metadata, including the server-log records of support sessions under section 3.4, as a controller for our own purposes of securing and operating our infrastructure. Our Privacy Policy covers the processing that we carry out as a controller, including these logs.

1.4 Terms that are not defined here have the meaning given in the Terms or in the GDPR. If this DPA conflicts with the Terms, this DPA prevails for the processing of personal data.

1.5 For a dedicated instance provided under an Order Form, the Order Form states whether and to what extent this DPA applies and any deviations from it, for example regarding hosting, sub-processors and support access.

2. Subject matter, duration, nature and purpose

2.1 We process personal data only to provide the Service under the Terms: hosting, storage, transmission, display and the other processing that the features you use require, together with backups, monitoring, security and support, including support sessions under section 3.4. Annex 1 describes the processing, the types of personal data and the categories of data subjects.

2.2 This DPA runs for as long as we process personal data on your behalf under the Terms, including the deletion period under section 11.

3. Your instructions

3.1 We process personal data only on your documented instructions, unless Union or Member State law requires us to process it otherwise. In that case we tell you before processing, unless that law prohibits this on important grounds of public interest.

3.2 Your instructions are set out in the Terms and in this DPA, and are given by what you, your members, your apps and your robots configure or trigger through the console, the APIs, the MCP endpoint and the bridge. A support request from you or your members is an instruction to process Customer Data as far as needed to handle it. Further instructions must be given in text form and must be technically feasible within the Service. If they cause us additional effort, we may charge for it after telling you in advance.

3.3 If we consider that an instruction infringes data protection law, we tell you without undue delay. We may suspend carrying out that instruction until you confirm or change it. Confirmation of an instruction does not require us to carry out processing that we know to be unlawful.

3.4 Support sessions. On the cloud plans, administrators whom we have specifically authorised can open a support session in your organisation. We notify the owner of your organisation, by e-mail or in the Service, before we open a support session. Where immediate action is necessary to secure the Service or to prevent harm, we notify the owner without undue delay after opening the session. A support session lasts as long as the support matter requires. In a support session, they see your organisation as its owner sees it and can act with the rights of an owner, which includes changing configuration and sending commands to your robots. In a support session, we send commands to your robots, start jobs or publish configuration to them only on the documented instruction of a member of your organisation who is authorised to operate the robot concerned, and only within the scope of that instruction. You ensure that the robot can be operated safely at that time (section 8.3 of the Terms). We use support sessions only to handle a support request from you or your members, or where this is necessary to provide, secure or restore the Service for you, for example to investigate a fault or a security incident affecting your organisation. A support session starts in a view-only mode; viewing alone is not recorded in your organisation’s audit log. We record the start and end of each support session and any switch to editing in our operator audit log, and the requests made in the session, with the session identifier, in our server logs (Annex 2, Nos. 3, 8 and 11). Actions taken after the switch to editing, including changes to your organisation’s master data, commands sent to your robots and jobs started, appear in your organisation’s audit log and job history as “Fleetless Support”. Support sessions are not available for dedicated instances under an Order Form.

4. Your responsibilities

4.1 You are responsible for the lawfulness of the processing, in particular for having a legal basis, for informing data subjects – including your App Users, your employees and people in view of a robot’s camera – and for the content of Customer Data.

4.2 You do not put special categories of personal data (Art. 9 GDPR) or personal data relating to criminal convictions and offences (Art. 10 GDPR) into the Service unless the processing is lawful and you have taken the protective measures it requires.

4.3 You tell us without undue delay if you notice errors or irregularities in our processing that concern data protection.

5. Confidentiality

5.1 We ensure that everyone authorised to process personal data on our behalf has committed themselves to confidentiality or is under an appropriate statutory obligation of confidentiality, and processes it only on our instructions.

5.2 Only administrators whom we have specifically authorised for this purpose can open support sessions under section 3.4. They use what they see or do in a support session only for the purpose for which the session was opened.

6. Security of processing

6.1 We take the technical and organisational measures required by Art. 32 GDPR, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing and the risks for data subjects. Annex 2 describes them.

6.2 We may adapt these measures to technical progress, provided that the overall level of protection does not fall below that described in Annex 2. We document material changes.

7. Sub-processors

7.1 You give us general authorisation to engage sub-processors. The sub-processors engaged when this DPA takes effect are listed in Annex 3; you approve them.

7.2 We tell you about any intended addition or replacement of a sub-processor at least 30 days in advance, by e-mail to the owner of your organisation and on our sub-processor page at https://fleetless.dev/subprocessors/. You may object within that period on reasonable data protection grounds. If we cannot resolve the objection, either party may terminate the affected Service, including a Basic plan, with effect from the date of the change; section 6.5 of the Terms applies to fees you have paid in advance.

7.3 We impose on each sub-processor, by contract, data protection obligations that are no less protective than those in this DPA, in particular sufficient guarantees that appropriate technical and organisational measures are in place. We remain liable to you for our sub-processors as for ourselves.

7.4 A supplier is not a sub-processor under this DPA solely because it provides an ancillary service. We assess whether that supplier processes Customer Data on our behalf. Our current Cloudflare configuration uses authoritative DNS without proxying Service traffic. Cloudflare is not listed as a sub-processor for Customer Data on that basis; any processing of DNS-related personal data is addressed separately in our privacy information. A change that makes a supplier a sub-processor is subject to section 7.2.

8. Location and transfers

8.1 We host Customer Data in data centres in Germany. We transfer Customer Data to a country outside the European Union or the European Economic Area, including by allowing access to it from such a country, only in accordance with section 8.2, and we tell you in advance as in section 7.2.

8.2 Where a transfer of personal data, including access from a third country, requires safeguards under Chapter V GDPR and is not covered by an applicable adequacy decision, the parties will put a valid transfer mechanism in place before the transfer begins. Where the standard contractual clauses adopted by Decision (EU) 2021/914 are applicable, the parties will agree the module and options matching their actual roles and complete the required annexes. No transfer requiring those safeguards will begin before they are in place. A UK Addendum or other UK transfer instrument will be used only where required for the relevant transfer under UK data protection law. Mandatory transfer clauses prevail over conflicting provisions of this DPA and the Terms.

9. Assistance

9.1 Taking into account the nature of the processing, we support you with appropriate technical and organisational measures in fulfilling your obligations towards data subjects under Chapter III GDPR. The console and the APIs let you access, correct, export and delete Customer Data yourself. Records that we keep for our own purposes under section 1.3, such as server logs and our operator audit records, are not part of the export (Annex 1 to the Terms, A1.5(f)). If a data subject contacts us directly about Customer Data, we forward the request to you without undue delay, as far as we can identify you, and do not answer it ourselves unless you instruct us to.

9.2 We support you, as far as the information available to us allows, in meeting your obligations under Art. 32 to 36 GDPR, in particular with data protection impact assessments and prior consultations.

9.3 We may charge for support under this section at reasonable rates if it goes beyond what the Service provides as standard. We tell you the cost beforehand. Statutorily required assistance will not be withheld or delayed pending agreement or payment of additional fees. We do not charge for assistance required because of our own breach.

10. Personal data breaches

10.1 We notify you of a personal data breach affecting Customer Data without undue delay after becoming aware of it, by e-mail to the owner of your organisation. The notification is made at the latest 48 hours after we become aware of the breach; this is an upper limit and does not allow us to wait until it has passed. We do not delay the first notification until our investigation is complete.

10.2 The notification contains, as far as available, the information listed in Art. 33(3) GDPR. Where not all information is available at once, we provide it in phases without further undue delay.

10.3 We take the measures necessary to secure the data and to mitigate possible adverse effects, document the breach, and support you in notifying the supervisory authority and the data subjects. Whether to notify them is your decision and your responsibility.

11. Deletion and return

11.1 During the term you can export and delete Customer Data yourself at any time through the console and the APIs.

11.2 When the contract ends, you choose whether we return Customer Data to you or delete it:

(a) We return Customer Data by keeping it available for export during the retrieval period under sections 6.6 and 11 of the Terms. When that period ends, we delete it.

(b) If you delete your organisation or otherwise expressly instruct us to delete Customer Data, we delete it without a retrieval period.

(c) Deletion covers Customer Data in the active systems of the Service, including stored files, logs and export files relating to your organisation.

(d) Residual backup copies are deleted no later than 35 days after deletion from the active systems; this period applies to the last remaining copy. Until expiry, they are protected and not used for ordinary processing.

(e) If we restore a backup, we apply again, without undue delay, the deletions made after that backup was created, so that a restore does not undo a deletion.

11.3 We keep personal data beyond that only where Union or Member State law requires us to store it. We keep such data separately, with restricted access, and delete it when the retention period ends. We confirm the deletion in text form on request.

11.4 Customer Data that you or your members send us with a support request is kept with the support correspondence. Routine support correspondence is deleted 180 days after the support matter is closed; section 11.3 applies to records that we must retain by law.

12. Information and audits

12.1 We make available to you the information necessary to demonstrate compliance with Art. 28 GDPR, in particular this DPA with its annexes, the current list of sub-processors and, where available, certificates and audit reports of our sub-processors.

12.2 If this information is not sufficient, you may audit our compliance yourself or have it audited by an independent auditor who is bound to confidentiality and is not our competitor. Routine audits take place at most once per calendar year, and you announce them at least 30 days in advance. The annual limit and notice period do not apply where a competent authority requires an audit or a substantiated concern or urgent incident requires earlier or additional verification. Audit arrangements must enable effective verification while protecting other customers and avoiding unreasonable disruption. Audits take place during business hours where possible and give no access to the data of other customers. Each party bears its own costs.

12.3 We tell you without undue delay about inspections or measures of a supervisory authority that concern the processing under this DPA, as far as the law allows.

13. Liability, term and applicable law

13.1 Liability is governed by section 15 of the Terms. Nothing in this DPA or the Terms limits data subjects’ rights or any liability or contribution right that cannot lawfully be limited under Article 82 GDPR. Applicable standard contractual clauses prevail.

13.2 This DPA ends when the contract under the Terms ends. The obligations under sections 5, 10, 11 and 12 continue for as long as we hold personal data processed on your behalf.

13.3 This DPA is subject to the law and the jurisdiction set out in section 21 of the Terms.

Annex 1 – Description of the processing

Data subjects. Depending on how you use the Service: your members and the other users of your organisation; the App Users of your apps; persons who appear in camera images, live video or files from your robots; persons whose data you put into configuration, files, notes or job data; persons whose data you or your members send us with a support request.

Types of personal data.

• Identification and contact data of App Users: e-mail address, display name, role in an app, a password hash where the App User has a password, and the identifier asserted by an identity provider that you connect.
• Data from your robots, such as telemetry, status, positions and logs, where it relates to an identifiable person.
• Camera images and live video, which the Service relays but does not record.
• Job history with the acting user’s e-mail address, the target and the outcome.
• The audit log of your organisation, with the acting user, the action and the time.
• Files and assets that you upload.
• Customer Data contained in support requests.

Special categories. Not intended. Camera images can show health data or allow inferences about, for example, religious beliefs or ethnic origin; section 4.2 applies.

Nature and purpose. Hosting, storage, transmission (including the relay of live video), display and deletion of Customer Data to provide the Service. Where you configure it, this includes sending your apps’ e-mails to App Users, such as sign-up, verification, invitation and password-reset e-mails. It also includes backups, monitoring, security and support, including support sessions under section 3.4.

Duration. For the term of the contract and the deletion periods under section 11.

Annex 2 – Technical and organisational measures

1. Physical access. The servers, object storage and backups of the Service are located in data centres of Hetzner Online GmbH in Germany. Physical access control in those data centres is provided by Hetzner, whose data centres are certified to ISO/IEC 27001.
2. System access. Administrative access to the servers of the Service goes through a private WireGuard-based network and an access gateway with named accounts, SSH keys and session logging. Staff sign in to our administrative tools with single sign-on and a second factor.
3. Data access. Access rights within the Service are role-based, and organisations are logically separated from each other. Our staff access Customer Data only as far as their tasks require. Administrators use an internal administration tool (the operator) with named accounts, roles and a second factor.
   • Support sessions (section 3.4) can be opened only by administrators with the corresponding role. A session lasts as long as the support matter requires and starts in a view-only mode; changes require a separate switch. The owner of the organisation is notified before a session is opened, or, where immediate action is necessary, without undue delay afterwards (section 3.4); the operator administrator records the notice in the support case. While a session is active, the operator shows it for the organisation concerned.
   • Direct access to servers and databases is limited to operation, maintenance and incident handling and is subject to No. 2.
4. Transmission. Connections over public networks between the Service and browsers, apps, API clients and the robot bridge are encrypted with TLS; live video is encrypted with DTLS-SRTP. Connections between our servers run over private networks.
5. Storage. Database backups are encrypted before they leave the server. Secrets used to operate the Service are stored encrypted and are not contained in plain text in the source code.
6. Separation. Production and staging run on separate systems. A recovery drill may temporarily restore a production database backup on a production operations node.
7. Availability and resilience. The servers are backed up daily and the database is backed up regularly. Residual backup copies are deleted as set out in section 11.2. The Service is monitored, and alerts reach the persons responsible.
8. Input control.
   • Our administrators’ changes to customer organisations through the operator are recorded in the operator audit log with the acting person.
   • The start and end of each support session, and any switch to making changes, are recorded in the same way.
   • Requests made in a support session are recorded in the server logs with the session identifier and follow the separate retrieval and physical deletion deadlines in No. 11.
   • Viewing in a support session is not recorded in your organisation’s audit log. Actions taken after the switch to editing, including changes to your organisation’s master data, also appear in your organisation’s audit log and job history as “Fleetless Support”.
   • Changes made by your members are recorded in the audit log of your organisation.
   • Operator audit entries for ordinary access are kept for 180 days. Records needed for a specific incident or legal claim are kept separately for as long as necessary.
9. Order control. Sub-processors only under contracts that meet Art. 28 GDPR (section 7 and Annex 3).
10. Incident handling. A procedure for security incidents and personal data breaches with assigned responsibilities, including a deputy, and with deadlines that run from the moment we become aware of an incident (section 10).
11. Deletion.
    • Deletion functions in the console and the APIs.
    • At the end of the contract, deletion as set out in section 11: in the active systems, in stored files, logs and export files, and in backups, with re-application of deletions after a restore.
    • For each routine server access log entry, including a request made in a support session, T is its event time plus 30 × 24 hours. The entry can be retrieved while the current time is before T and cannot be retrieved from T onward. If the organisation to which an entry relates is deleted earlier, the entry is deleted together with it. Active copies, including database files, write-ahead logs and source buffers, are physically erased no later than T + 24 hours. Exceeding that deadline triggers an alarm and is handled as an incident. Backup copies are deleted no later than 35 days after active deletion, and expired entries are removed from the restore input before every restore starts. Extracts needed for a specific security incident or legal claim are kept separately for as long as necessary.
12. Change management. Changes to the Service are reviewed before release, tested automatically and accepted on staging before they reach production.

Annex 3 – Sub-processors

No other sub-processor processes Customer Data. Providers of AI models do not receive Customer Data, including through support requests, logs or administrative tools. Any future use of such providers to process Customer Data on your behalf is subject to the safeguards and prior notice in our DPA.

Providers that we use only for our own purposes do not process Customer Data on your behalf and are not sub-processors under this DPA. Our Privacy Policy describes them. They include:

• Cloudflare, Inc. — authoritative DNS for the fleetless.dev zone (section 7.4).
• Mollie B.V. — payment processing for paid plans, as an independent controller.
• Haufe Service Center GmbH, Munzinger Straße 9, 79111 Freiburg, Germany — Lexware Office, for our invoicing and accounting, as our processor.
• NetConnections GmbH, Jesinger Straße 52, 73230 Kirchheim unter Teck, Germany — PayJoe, matching payments to invoices, as our processor.

Any change to the sub-processors follows section 7.2.

Permanent version 1.0

last updated 2026-11-05