Data Processing Agreement

Version 1.1

This Data Processing Agreement is between the subscribing business (the "Controller", "you") and Saracen Commercial Contracting Ltd (SCC Ltd), trading as OperatorSafe (company number 05479787) (the "Processor", "we"). It forms part of the Terms of Service and applies for as long as we process personal data for you. "UK GDPR", "personal data", "processing", "controller", "processor" and "personal data breach" have the meanings given in the UK GDPR and the Data Protection Act 2018, as amended or replaced.

1. Details of the processing

Item	Detail
Subject matter	Providing the OperatorSafe compliance portal and walkround check app
Duration	The length of your subscription, plus the export period in the Terms
Nature and purpose	Storing, organising, analysing and reporting on your drivers' and vehicles' records so you can manage compliance
Types of personal data	Names, licence and tachograph card numbers, contact details, vehicle checks, defect reports, signatures, photos, driver card and vehicle unit data (including driving, rest and work activity), login and activity records
People the data is about	Your drivers, transport managers, mechanics, other staff and users
Special category data	None intended. You must not upload it

2. What we will do

We will:

Process the personal data only on your documented instructions, which are these terms and your use of the service, unless the law requires otherwise. We will tell you first if the law requires it, unless it forbids us to.
Make sure everyone allowed to process the data is bound by confidentiality.
Keep the data secure with appropriate technical and organisational measures (see section 6).
Only use sub-processors as set out in section 4.
Help you respond to requests from people exercising their rights, by providing tools and information, and tell you promptly if someone contacts us directly about your data.
Help you meet your obligations on security, breach notification and impact assessments, taking account of what we do and what information we hold.
Tell you without undue delay, and in any case within 48 hours, after we become aware of a personal data breach affecting your data, with the details we have.
When the subscription ends, return your data on request (see the Terms) and then delete it permanently, unless the law requires us to keep it.
Give you the information you reasonably need to show we meet this agreement, and allow reasonable audits, on at least 30 days' notice, no more than once a year unless there has been a breach, during working hours and in a way that does not put other customers' data at risk.

3. What you will do

You will:

Make sure you have a lawful basis for putting the data into the service and for the way you use the reports.
Give your drivers and staff a clear privacy notice (a template is provided).
Give us lawful, accurate instructions and keep your data accurate.
Not upload data that is not needed, and not upload special category data.
Review the reports and ratings yourself before relying on them, and not use them as the only basis for a decision that significantly affects a person.

4. Sub-processors

You give us general permission to use the sub-processors below. We will tell you at least 30 days before adding or replacing one, and you may object on reasonable data protection grounds. If we cannot resolve it, you may cancel under the Terms. We stay responsible for our sub-processors and require them to meet terms equivalent to this one.

Sub-processor	What it does	Location
UpCloud	Server hosting	United Kingdom or European Economic Area
Web and email hosting provider	Sending the service's emails	United Kingdom or European Economic Area
Stripe	Subscription payments (subscriber details only)	As set out in Stripe's terms, with UK transfer safeguards

5. Transfers outside the UK

We will not transfer your personal data outside the UK unless there are safeguards the UK GDPR allows, such as UK adequacy regulations or an approved transfer agreement with the UK addendum.

6. Security measures

Encrypted connections (HTTPS) for all access.
Passwords stored as one-way hashes; accounts locked after repeated failed logins.
Each customer's data separated by account, with role-based access.
Controlled access to servers, with up-to-date software and security patches.
Regular backups of the server, held securely by our hosting provider.
Activity logging of important actions.
Permanent deletion of documents when a user deletes them.

7. Liability and general

7.1 Each party's liability under this agreement is subject to the limits and exclusions in the Terms. Nothing here limits liability that cannot be limited by law, or a person's right to claim compensation from either of us under the UK GDPR.

7.2 If this agreement and the Terms conflict about the processing of personal data, this agreement applies.

7.3 English law applies and the courts of England and Wales have exclusive jurisdiction.