Last updated: October 19, 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service between LHBSoft ("Processor", "we") and every business customer of ReForge by LHBSoft — a repair shop or a fleet company ("Customer", "you"). It applies whenever we process personal data on your behalf in providing ReForge, and it prevails over the Terms of Service on any question of data protection.
You are the controller of the personal data you and your staff enter into ReForge or that ReForge records for your business. We are your processor and process that data only to provide ReForge to you, on your documented instructions — which are these Terms, this DPA and your use and configuration of ReForge.
We tell you if, in our opinion, an instruction infringes data protection law.
Everyone at LHBSoft who can access your data is bound by confidentiality, and accesses it only as needed to run, support or secure the service.
We maintain technical and organisational measures appropriate to the risk, including:
You authorise us to use the sub-processors listed in our Privacy Policy. Each is bound by data protection terms at least as protective as this DPA, and we remain responsible for them.
We announce a new or replacement sub-processor at least 30 days in advance by email or in the app. If you object on reasonable data protection grounds and we cannot address the objection, you may terminate the affected service without penalty before the change takes effect.
Where a sub-processor processes data outside the EU/EEA, the transfer relies on an adequacy decision (including the EU–US Data Privacy Framework for certified providers) or on the European Commission's Standard Contractual Clauses.
We notify you without undue delay, and at the latest within 48 hours of becoming aware, of a personal data breach affecting your data, with the information you need to meet your own notification duties, and update you as we learn more.
You can export all of your data at any time, free of charge, from Profile → Your data, and your issued documents (PDF and XML) one year at a time.
When you close your account, sign-in is removed at once. Your business data is deleted permanently 30 days later, unless EU or Member State law requires us to keep it. Export everything you must keep — in particular invoices, which you are obliged to retain under accounting and tax law — before closing. Backups are overwritten on their regular cycle.
On request we make available the information necessary to demonstrate compliance with this DPA. Audits or inspections by you or an auditor you appoint are possible on 30 days' written notice, during business hours, at your cost, no more than once a year unless a breach or a supervisory authority requires otherwise, and subject to confidentiality.
Liability under this DPA follows the Terms of Service, without limiting either party's liability towards data subjects under GDPR Art. 82. This DPA lasts as long as we process personal data on your behalf.