Data Processing Agreement

1. Parties, scope and processing details

This DPA accompanies the Service Agreement between BeeTrac's identified legal operator (processor) and the customer business (controller). Processing lasts for the service and approved return/retention period. Its nature is collection, storage, organisation, retrieval, reporting, access, coordination and deletion of fleet administration data.

Data subjects include customer contacts, employees/drivers, supplier contacts and people incidentally photographed. Data comprises contact/assignment details, optional licence numbers, check status/evidence, vehicle/lease/mileage/fuel/service records, documents, photographs and communications. Special-category and criminal-offence data are not part of the standard scope without a separately documented lawful arrangement. BeeTrac's independent controller processing for enquiries, accounts, billing, security and legal records is described in the Privacy Policy.

2. Documented instructions

Process only on documented customer instructions, including approved transfers, unless UK law requires otherwise; inform the customer of such a requirement before processing unless legally prohibited. Inform the customer if an instruction appears to infringe applicable data protection law. The customer establishes the lawful basis, notices and authority for supplied data and keeps instructions accurate.

3. Confidentiality and security

Limit access to authorised persons committed to confidentiality. Maintain risk-appropriate technical and organisational measures, including tenant/role restrictions, private storage, expiring file links, staff MFA and audit logging. Assist the customer with security obligations proportionately. Do not describe unverified scanning, backup or testing capabilities as implemented.

4. Sub-processors

The customer grants general authorisation only for sub-processors in the agreed, verified register. Give advance notice of additions or replacements and a reasonable opportunity to object on substantiated data-protection grounds. Resolve an objection through a reasonable alternative or termination of the affected service where necessary. Impose equivalent processing obligations and remain responsible for sub-processors' performance of those obligations. Pending-verification entries are not evidence of final customer authorisation.

5. Rights assistance

Taking account of the processing, assist with data-subject access, correction, erasure, restriction, objection and portability using appropriate measures. Forward requests concerning customer-controlled data promptly and do not independently answer except on instructions or as required by law. Use identity verification proportionate to the request.

6. Breaches, DPIAs and consultation

Notify the customer without undue delay after becoming aware of a personal data breach involving its controlled data. Provide known facts about affected data/subjects, likely consequences, containment and contact details, with updates as information becomes available. Assist proportionately with assessment, notifications, security obligations, DPIAs and regulator consultations, taking account of the nature of processing and available information. BeeTrac does not automatically notify the ICO on the customer's behalf.

7. Transfers

Do not transfer customer data internationally except under documented instructions and a verified lawful transfer mechanism where required. Keep locations, onward transfers, contractual mechanisms and assessments in the register. Pending verification is not a transfer-compliance assurance.

8. Return, deletion and contract end

At the customer's choice, return or delete customer-controlled personal data at service end, and delete copies unless law requires retention. Agree export format, timing, lawful holds and treatment of backup copies in the approved retention schedule. Restrict data retained under law and process only for that lawful need. BeeTrac's own controller financial/security/legal records follow a separate lawful retention assessment; contract termination does not automatically erase them.

9. Evidence and audits

Make information reasonably necessary to demonstrate these processing obligations available and allow/contribute to proportionate audits and inspections by the customer or its mandated auditor, with confidentiality, security and reasonable notice safeguards. Those safeguards do not remove statutory rights or obstruct a regulator. Record findings and agreed remedial actions.

10. Precedence and approval

This DPA prevails over conflicting service terms on customer-controlled processing. Both documents require versioned acceptance by an authorised business contact. This is an Article 28-style draft, pending solicitor review; contractual schedules, legal identity, verified provider arrangements and retention decisions must be completed before production use.