Legal

Data Processing Agreement

Version v1 · 4 September 2026 · The Albanian version is binding; this translation is for understanding.

1. Parties and subject matter

This agreement is concluded between the dealer using the cockpit (controller) and the operator of the MerrVetura platform, Berat Murati (processor). It governs the processing of personal data the controller keeps in the cockpit, under Article 32 of Law No. 06/L-082.

It applies alongside the Terms of Use and only to cockpit data. For account and listing data MerrVetura is itself the controller — see the Privacy Policy.

2. Duration, nature and purpose

Processing lasts as long as the controller uses the cockpit. Nature: storing, organising, displaying and deleting by automated means. Purpose: managing the dealer’s customers, enquiries, appointments and offers.

3. Types of data and categories of data subjects

  • Data: name, phone number, free-text notes up to 2000 characters, search profile, appointments, offers and trade-in requests.
  • Data subjects: the dealer’s prospects and customers — including people without a MerrVetura account.

The controller enters no special categories (health, religion, ethnic origin, sexual orientation, criminal matters). The cockpit is not built for them.

4. Obligations of the processor

  • Processes the data only on the controller’s instructions and not for its own purposes. The only exception is a legal obligation; the controller is told beforehand where the law permits.
  • Maintains confidentiality: people with access are bound in writing or by law.
  • Applies technical and organisational measures under Article 31: row level security, column-level rights, encrypted transport, secrets in the vault, automated tests of the access rules, backups.
  • Sub-processors: storage and operation use Supabase Inc. (servers in Frankfurt, EU) and Vercel Inc. (European infrastructure). The controller gives general consent to these. Any further one is announced in advance and may be objected to; on objection, use of the cockpit may be ended without disadvantage.
  • Assists the controller with data subject requests (access, rectification, erasure) and with the duties under Articles 31 to 34.
  • Reports without delay any security breach affecting its data, with what the controller needs to notify the AIP within 72 hours.
  • Deletion at the end: once use ends, cockpit data is deleted within 90 days unless a law requires longer retention. Earlier on request.
  • Makes available the information needed to demonstrate these obligations.

5. Obligations of the controller

  • Enters only data for which it has a legal basis, and only as much as it actually needs.
  • Informs the recorded people itself under Article 13 — that it has recorded them, for what purpose, and that MerrVetura performs the technical processing. This duty does not pass to the processor.
  • Answers data subject requests itself. If a request reaches us, we pass it on.
  • Enters no insulting or unnecessary data and no special categories.

6. Transfers abroad

Cockpit data is held in the European Union. It is not transferred outside the EU before admissibility under Articles 44 to 49 is clarified and the controller is informed.

7. Liability

Each party is liable for breaching its own obligations. The processor is not liable for the lawfulness of the data the controller enters.

8. Changes and applicable law

Changes are announced at least 30 days in advance and require fresh acceptance; until then the accepted version applies. The law of the Republic of Kosovo applies, with jurisdiction in Prishtina.

9. Acceptance

Acceptance is given electronically when registering as a dealer or in the cockpit. The date, version and accepting account are recorded — that is the proof Article 32 requires for the written form.