Data processing agreement

Draft (2026-10-draft). This document has not yet been reviewed by a solicitor and must be approved before the service is offered to paying customers.

This agreement forms part of the terms of service between the customer (the controller) and ATRA Transport Ltd (the processor), as required by Article 28 of the UK GDPR.

1. Subject, duration, nature and purpose

The processor hosts and processes the records the controller and its drivers enter into ATRA Daily Check, for the purpose of recording and reviewing vehicle walkaround checks, defects and incidents, for as long as the service is provided and until deletion under clause 8.

2. Personal data and data subjects

Drivers, managers and other staff of the controller, and people named in incident reports (for example other drivers and witnesses): names, usernames, email addresses, phone numbers where entered, check and incident records, photos and videos, location at the start and end of a check or incident, signatures, device and sign-in records. Incident reports may include information about injuries, which is health data; the controller decides whether to record it.

3. Instructions

The processor processes the personal data only on the controller's documented instructions, which are these terms and the controller's use of the service, unless the law requires otherwise, in which case it tells the controller first unless the law forbids that.

4. Confidentiality and security

People authorised to process the data are bound by confidentiality. The processor keeps appropriate technical and organisational measures, including: encrypted connections (HTTPS), encryption of stored files at rest by the storage provider, each customer's records kept separate in the application, hashed passwords, account lock-out after repeated failed sign-ins, least-privilege access for the processor's own staff (the owner panel does not show customers' records), and backups. [List to be completed and reviewed.]

5. Sub-processors

The controller authorises these sub-processors: hosting (Railway), file storage (S3-compatible provider), email delivery (Resend), payments (Stripe; billing contacts only). The processor will give at least 30 days' notice of a new sub-processor, during which the controller may object and, if the objection cannot be resolved, close the account. The processor imposes data protection obligations on each sub-processor equivalent to these. [Confirm the providers and the safeguards for any transfer outside the UK.]

6. Help to the controller

The processor helps the controller, as far as reasonably possible, to answer requests from data subjects, and with security, breach notification, data protection impact assessments and consultation with the ICO. The panel lets the controller find, export and correct records itself.

7. Personal data breaches

The processor tells the controller without undue delay, and aims to do so within 48 hours, after becoming aware of a personal data breach affecting the controller's data, with the information it has.

8. Deletion and return

The controller can export its records at any time. After the account is closed, the processor deletes the controller's records and files 90 days after closing, and after a trial that was never subscribed, 180 days after the trial ended, unless the law requires them to be kept.

9. Audits

The processor makes available the information reasonably needed to show it meets this agreement, and allows audits on reasonable notice, at the controller's cost, no more than once a year unless a breach has occurred.