Data Processing Agreement

The partner (controller) decides what customer data is collected. The operator of FastTradein named in the Operator details section (support@fasttradein.app) is the processor and handles that data only to provide the subscribed service: estimates, trade-in requests, inspection, documents, notifications, and exports. This agreement applies to every partner from sign-up and lasts as long as we process personal data for the partner.

Data and people covered: the partner’s customers (name; email; phone; ID document number and issuing authority when they are recorded at in-store trade-in; device model; IMEI or serial number; condition answers; trade-in request, voucher, and payout-method data; and handover documents) and the partner’s staff (name, email, and sign-in data).

Instructions and confidentiality: we process the data only on the partner’s documented instructions, given through the workspace settings and these terms, unless the law requires otherwise; in that case we tell the partner first, unless the law forbids it. We inform the partner immediately if we believe an instruction infringes GDPR. Everyone with access to the data is bound by confidentiality.

Security: we apply tenant isolation, access controls, and TLS in transit. The webhook secret is encrypted with AES-256-CBC when stored. FastTradein does not collect card numbers or bank account details, and we do not use the partner’s data to train models or to market to the partner’s customers.

Sub-processors: OVH SAS (OVHcloud) hosts application data and backups in a data center in Germany (EU). Service email, including notifications to the partner’s customers, is sent by an email delivery service with a data center in the EU. Partners can request the full list of sub-processors, with names and countries, at support@fasttradein.app. Before adding or replacing a sub-processor, we inform partners by email and on this page, and a partner may object. We bind every sub-processor in writing to the same data protection duties and remain responsible for its work.

Breaches and assistance: we notify the partner without undue delay, and within 48 hours at the latest, after becoming aware of a personal data breach that affects its data. We help the partner respond to data subject requests and, where needed, assist with data protection impact assessments and consultations with the supervisory authority.

A partner can anonymize customer details on a request in the workspace, export trade-in requests (CSV) on Business and Pro, or send a written request to support@fasttradein.app. When the subscription or trial ends, the partner can, on any plan, ask support@fasttradein.app for a CSV export of its requests before deletion. We keep the tenant records for 14 months after the subscription or trial ends and then delete them, unless the law requires longer retention. On the partner’s written request we delete them sooner.

Compliance and audits: on request, we provide the information needed to show that these obligations are met. Audits must be agreed in advance and take place at most once a year, at the partner’s expense, unless a data breach or a supervisory authority requires otherwise.

A countersigned copy of this agreement is available on request at support@fasttradein.app. If the partner’s legal counsel requires different terms, we can agree on an addendum.

Operator details

The FastTradein service is provided by Ruslan Butivchenko (Ukraine), trading as FastTradein (the “operator”, “we”). Contact: support@fasttradein.app.