1. Subject Matter & Duration

1. Predmet i trajanje

QRForge processes personal data on behalf of the Fleet Operator to provide dispatch management, courier assignment, and delivery tracking services. This DPA is incorporated by reference into the QRForge Terms of Service and takes effect upon registration.

QRForge obrađuje lične podatke u ime Operatera flotile kako bi pružio usluge upravljanja dispečerom, dodjele dostavljača i praćenja dostave. Ovaj UOP ugrađen je referencom u Uvjete korištenja QRForgea i stupa na snagu registracijom.

This DPA remains in force for the duration of the Fleet Operator's use of the platform.

Ovaj UOP ostaje na snazi za period korištenja platforme od strane Operatera flotile.

2. Personal Data Processed

2. Obrađeni lični podaci

Customer data (accessed by couriers)

Podaci kupca (dostupni dostavljačima)

Courier (employee/contractor) data

Podaci dostavljača (zaposleni/kooperant)

The Fleet Operator is the data controller for its couriers' personal data and must ensure it has appropriate legal basis (employment contract, legitimate interest) to share courier data with QRForge for platform use.

Operator flotile je voditelj obrade ličnih podataka svojih dostavljača i mora osigurati odgovarajući pravni osnov (ugovor o radu, legitimni interes) za dijeljenje podataka dostavljača s QRForgeom radi korištenja platforme.

3. Courier Data Handling Obligations

3. Obaveze rukovanja podacima dostavljača

The Fleet Operator agrees to ensure that all couriers operating under its account:

Operator flotile pristaje osigurati da svi dostavljači koji rade pod njegovim računom:

• Use customer personal data (phone number, address) exclusively to complete the assigned delivery — no use for any other purpose.
• Do not store, copy, screenshot, or otherwise retain customer personal data beyond what is necessary to complete the delivery.
• Do not contact customers after a delivery is completed unless it is to return a lost item.
• Treat customer personal data with strict confidentiality and do not disclose it to any third party.
• Report any suspected data breach or misuse of customer data to the Fleet Operator immediately, who must then notify QRForge within 24 hours.

• Koriste lične podatke kupca (broj telefona, adresa) isključivo za završetak dodijeljene dostave — nikakva upotreba u druge svrhe.
• Ne pohranjuju, ne kopiraju, ne snimaju zaslone niti na drugi način zadržavaju lične podatke kupca izvan onoga što je potrebno za završetak dostave.
• Ne kontaktiraju kupce nakon završetka dostave, osim radi vraćanja izgubljenog predmeta.
• S ličnim podacima kupca postupaju s striktnom povjerljivošću i ne otkrivaju ih trećim stranama.
• Odmah prijavljuju Operateru flotile svaku sumnju na povredu podataka ili zloupotrebu podataka kupca, koji zatim mora obavijestiti QRForge u roku od 24 sata.

The Fleet Operator is liable for any data protection violation committed by its couriers in connection with QRForge deliveries.

Operator flotile je odgovoran za svaku povredu zaštite podataka koju počine njegovi dostavljači u vezi s dostavama QRForgea.

4. QRForge's Obligations as Processor

4. Obaveze QRForgea kao obrađivača

QRForge shall:

QRForge će:

• Process personal data only for the purposes stated in this DPA and on the documented instructions of the Fleet Operator.
• Implement technical controls ensuring couriers see only data for their currently assigned order.
• Maintain audit logs of all admin access to fleet and courier data.
• Notify the Fleet Operator of any data breach affecting courier or customer data within 72 hours.
• Delete all Fleet Operator and associated customer data upon account termination, subject to legal retention requirements.
• Assist the Fleet Operator in responding to data subject rights requests from couriers or customers.

• Obrađivati lične podatke samo u svrhe navedene u ovom UOP-u i prema dokumentovanim uputstvima Operatera flotile.
• Implementirati tehničke kontrole koje osiguravaju da dostavljači vide samo podatke za svoju trenutno dodijeljenu narudžbu.
• Voditi revizijske logove svih admin pristupa podacima flotile i dostavljača.
• Obavijestiti Operatera flotile o svakoj povredi podataka koja utječe na podatke dostavljača ili kupca u roku od 72 sata.
• Brisati sve podatke Operatera flotile i povezane podatke kupaca po prestanku računa, uz zakonske zahtjeve čuvanja.
• Pomoći Operateru flotile u odgovaranju na zahtjeve za prava ispitanika dostavljača ili kupaca.

5. Technical & Organisational Measures

5. Tehničke i organizacijske mjere

• Courier data scoping — platform enforces that a courier can only view the customer data for their specific assigned order; no bulk access to customer records.
• Encryption — all data encrypted at rest (AES-256) and in transit (TLS 1.2+).
• Fleet suspension controls — suspending a fleet immediately revokes all courier and dispatcher sessions via token revocation, removing access to customer data.
• Access control — role-based; fleet dispatchers see only their fleet's data; couriers see only their assigned order.
• Audit logging — admin actions on fleet data logged with actor, timestamp, and IP.
• Infrastructure — Google Cloud europe-west1; ISO 27001, SOC 2 Type II certified.

• Opseg podataka dostavljača — platforma osigurava da dostavljač može vidjeti samo podatke kupca za svoju specifičnu dodijeljenu narudžbu; bez masovnog pristupa evidencijama kupaca.
• Enkripcija — svi podaci enkriptirani u mirovanju (AES-256) i prijenosu (TLS 1.2+).
• Kontrole suspenzije flotile — suspenzija flotile odmah opoziva sve sesije dostavljača i dispečera putem opoziva tokena, uklanjajući pristup podacima kupaca.
• Kontrola pristupa — zasnovana na ulogama; dispečeri flotile vide samo podatke svoje flotile; dostavljači vide samo svoju dodijeljenu narudžbu.
• Revizijsko logiranje — admin radnje na podacima flotile bilježe se s akterom, vremenskom oznakom i IP-om.
• Infrastruktura — Google Cloud europe-west1; ISO 27001, SOC 2 Type II certificiran.

6. Sub-processors

6. Pod-obrađivači

QRForge will notify Fleet Operators of sub-processor changes at least 14 days in advance.

QRForge će obavijestiti Operatere flotile o promjenama pod-obrađivača najmanje 14 dana unaprijed.

7. Governing Law

7. Mjerodavno pravo

This DPA is governed by the laws of Bosnia and Herzegovina. The parties voluntarily align with GDPR as the applicable standard. Disputes shall be resolved before the competent courts of Bosnia and Herzegovina.

Ovaj UOP reguliran je zakonima Bosne i Hercegovine. Stranke se dobrovoljno usklađuju s GDPR-om. Sporovi se rješavaju pred nadležnim sudovima Bosne i Hercegovine.

For questions or to request a signed PDF copy: admin@qrforge.link

Za pitanja ili zahtjev potpisane PDF kopije: admin@qrforge.link