1. Predmet i trajanje

1. Subject Matter & Duration

QRForge u ime Operatera flotile obrađuje samo lične podatke navedene u Odjeljku 2.1: naloge osoblja, evidenciju kurira te lokaciju i status dostupnosti kurira koji se koriste za dodjelu narudžbi te flotile. Ovaj Ugovor sastavni je dio Uvjeta korištenja QRForgea i stupa na snagu registracijom.

QRForge processes on the Fleet Operator's behalf only the personal data listed in Section 2.1: staff accounts, courier records, and courier location and online status used for the fleet's dispatch. This DPA is incorporated by reference into the QRForge Terms of Service and takes effect upon registration.

Podatke o narudžbama kupaca Operator flotile prima kao samostalni voditelj obrade (Odjeljak 2.2). QRForge te podatke obrađuje kao voditelj obrade za rad platforme, kako je opisano u Politici privatnosti, a ne u ime Operatera flotile.

The Fleet Operator receives customer order data as an independent controller (Section 2.2). QRForge processes that data as a controller for running the platform, as described in the Privacy Policy, not on the Fleet Operator's behalf.

Ovaj Ugovor ostaje na snazi za period korištenja platforme od strane Operatera flotile.

This DPA remains in force for the duration of the Fleet Operator's use of the platform.

2. Lični podaci

2. Personal Data

2.1 Podaci koje QRForge obrađuje u ime Operatera flotile

2.1 Data QRForge processes on the Fleet Operator's behalf

Operator flotile je voditelj obrade ličnih podataka svojih kurira i mora osigurati odgovarajući pravni osnov (ugovor o radu, legitimni interes) za njihovo korištenje na platformi.

The Fleet Operator is the data controller for its couriers' personal data and must ensure it has an appropriate legal basis (employment contract, legitimate interest) for using that data on the platform.

2.2 Podaci kupca koje Operator flotile prima kao samostalni voditelj obrade

2.2 Customer data the Fleet Operator receives as an independent controller

3. Obaveze rukovanja podacima kupaca

3. Customer Data Handling Obligations

Operator flotile pristaje osigurati da svi kuriri koji rade pod njegovim računom:

The Fleet Operator agrees to ensure that all couriers operating under its account:

• Koriste lične podatke kupca (broj telefona, adresa) isključivo za završetak dodijeljene dostave — nikakva upotreba u druge svrhe.
• Ne pohranjuju, ne kopiraju, ne snimaju zaslone niti na drugi način zadržavaju lične podatke kupca izvan onoga što je potrebno za završetak dostave.
• Ne kontaktiraju kupce nakon završetka dostave, osim radi vraćanja izgubljenog predmeta.
• S ličnim podacima kupca postupaju strogo povjerljivo i ne otkrivaju ih trećim stranama.
• Odmah prijavljuju Operateru flotile svaku sumnju na povredu podataka ili zloupotrebu podataka kupca, koji zatim mora obavijestiti QRForge u roku od 24 sata.

• Use customer personal data (phone number, address) exclusively to complete the assigned delivery — no use for any other purpose.
• Do not store, copy, screenshot, or otherwise retain customer personal data beyond what is necessary to complete the delivery.
• Do not contact customers after a delivery is completed unless it is to return a lost item.
• Treat customer personal data with strict confidentiality and do not disclose it to any third party.
• Report any suspected data breach or misuse of customer data to the Fleet Operator immediately, who must then notify QRForge within 24 hours.

Operator flotile je odgovoran za svaku povredu zaštite podataka koju počine njegovi kuriri u vezi s dostavama preko QRForgea.

The Fleet Operator is liable for any data protection violation committed by its couriers in connection with QRForge deliveries.

4. Obaveze QRForgea kao obrađivača

4. QRForge's Obligations as Processor

Za podatke iz Odjeljka 2.1 QRForge će:

For the data in Section 2.1, QRForge shall:

• Obrađivati lične podatke samo u svrhe navedene u ovom Ugovoru i prema dokumentovanim uputstvima Operatera flotile.
• Implementirati tehničke kontrole koje osiguravaju da kuriri vide samo podatke za svoju trenutno dodijeljenu narudžbu.
• Voditi revizijske logove svih admin pristupa podacima flotile i kurira.
• Obavijestiti Operatera flotile o svakoj povredi tih podataka u roku od 72 sata.
• Brisati ili vraćati te podatke po prestanku računa, uz zakonske zahtjeve čuvanja.
• Pomoći Operateru flotile u odgovaranju na zahtjeve ispitanika.

• Process personal data only for the purposes stated in this DPA and on the documented instructions of the Fleet Operator.
• Implement technical controls ensuring couriers see only data for their currently assigned order.
• Maintain audit logs of all admin access to fleet and courier data.
• Notify the Fleet Operator of any breach affecting that data within 72 hours.
• Delete or return that data upon account termination, subject to legal retention requirements.
• Assist the Fleet Operator in responding to data subject requests.

5. Tehničke i organizacijske mjere

5. Technical & Organisational Measures

• Opseg podataka kurira — platforma osigurava da kurir može vidjeti samo podatke kupca za svoju dodijeljenu narudžbu; bez masovnog pristupa evidencijama kupaca.
• Enkripcija — svi podaci enkriptirani u mirovanju (AES-256) i prijenosu (TLS 1.2+).
• Kontrole suspenzije flotile — suspenzija flotile odmah opoziva sve sesije kurira i dispečera putem opoziva tokena, uklanjajući pristup podacima kupaca.
• Kontrola pristupa — zasnovana na ulogama; dispečeri flotile vide samo podatke svoje flotile; kuriri vide samo svoju dodijeljenu narudžbu.
• Revizijsko logiranje — admin radnje na podacima flotile bilježe se s akterom, vremenskom oznakom i IP-om.
• Infrastruktura — Google Cloud, glavna baza u EU (Google Cloud EU multi-region), pod Googleovim ISO 27001 i SOC 2 Type II certifikacijama.

• Courier data scoping — the platform enforces that a courier can only view the customer data for their specific assigned order; no bulk access to customer records.
• Encryption — all data encrypted at rest (AES-256) and in transit (TLS 1.2+).
• Fleet suspension controls — suspending a fleet immediately revokes all courier and dispatcher sessions via token revocation, removing access to customer data.
• Access control — role-based; fleet dispatchers see only their fleet's data; couriers see only their assigned order.
• Audit logging — admin actions on fleet data logged with actor, timestamp, and IP.
• Infrastructure — Google Cloud, main database in the EU (Google Cloud EU multi-region), under Google's own ISO 27001 and SOC 2 Type II certifications.

6. Pod-obrađivači

6. Sub-processors

QRForge će obavijestiti Operatere flotile o promjenama pod-obrađivača najmanje 14 dana unaprijed. Gdje pod-obrađivač obrađuje podatke izvan Bosne i Hercegovine i EU, oslanjamo se na zaštitne mjere propisane zakonom.

QRForge will notify Fleet Operators of sub-processor changes at least 14 days in advance. Where a sub-processor processes data outside Bosnia and Herzegovina and the EU, we rely on the safeguards required by law.

7. Mjerodavno pravo

7. Governing Law

Na ovaj Ugovor primjenjuje se pravo Bosne i Hercegovine, uključujući Zakon o zaštiti ličnih podataka BiH. Sporove rješava sud nadležan prema sjedištu operatera.

This DPA is governed by the laws of Bosnia and Herzegovina, including the BiH Law on Personal Data Protection. Disputes are resolved by the competent court at the operator's seat.

Za pitanja ili zahtjev potpisane PDF kopije: support@qrforge.link

For questions or to request a signed PDF copy: support@qrforge.link