Data Processing Agreement

Last updated: 9 August 2026

1. Purpose

This Data Processing Agreement ("DPA") forms part of the contract between PSV Fleet Ltd ("Processor") and the customer ("Controller") for the use of the PSV Fleet platform. It sets out the terms under which we process personal data on your behalf.

2. Definitions

• Controller: The organisation (operator) that determines the purposes and means of processing personal data
• Processor: PSV Fleet Ltd, which processes personal data on behalf of the Controller
• Data Subject: An identified or identifiable natural person (e.g., driver, employee)
• Personal Data: Any information relating to an identified or identifiable natural person
• Processing: Any operation performed on personal data (collection, storage, use, deletion)

3. Scope of Processing

We process personal data solely to provide the fleet management Service. The categories of data subjects include drivers, office staff, mechanics and other team members. The types of personal data processed include names, contact details, driving licence information, vehicle data, booking records, walkaround check results, defect reports, fuel logs and driver hours.

4. Obligations of the Processor

We will:

• Process personal data only on documented instructions from the Controller
• Ensure that persons authorised to process personal data have committed themselves to confidentiality
• Implement appropriate technical and organisational security measures (AES-256 encryption, row-level security, SOC 2 Type II)
• Assist the Controller in responding to data subject requests
• Assist the Controller in ensuring compliance with GDPR obligations regarding security, data breach notification and data protection impact assessments
• At the choice of the Controller, delete or return all personal data after the end of the service provision
• Make available all information necessary to demonstrate compliance and allow for audits

5. Sub-processors

We use the following sub-processors to provide the Service:

• Supabase: Database hosting and authentication (PostgreSQL, row-level security)
• Vercel: Application hosting and CDN

All sub-processors are bound by data processing agreements that meet GDPR requirements. We will notify the Controller of any changes to sub-processors at least 30 days in advance.

6. Data Transfers

All personal data is stored in data centres within the United Kingdom. We do not transfer personal data outside the UK or EEA without appropriate safeguards, including Standard Contractual Clauses where required.

7. Data Security

We implement the following technical and organisational measures:

• AES-256 encryption for all sensitive personal data at rest
• TLS 1.3 encryption for all data in transit
• PostgreSQL row-level security isolating each Controller's data
• Role-based access controls with least-privilege principle
• Regular automated backups with 30-day retention
• SOC 2 Type II certified infrastructure
• Continuous monitoring and logging of access to personal data

8. Data Breach Notification

In the event of a personal data breach, we will:

• Notify the Controller without undue delay, and no later than 48 hours after becoming aware of the breach
• Provide details of the nature of the breach, categories and approximate number of data subjects affected
• Take all reasonable steps to contain and remediate the breach
• Cooperate with the Controller and the ICO in investigating and reporting the breach

9. Data Subject Rights

We will assist the Controller in responding to data subject requests within the timeframes required by UK GDPR. The Service includes built-in tools for:

• Data export (DSAR) — available to the Controller at any time via Settings
• Data rectification — editable through the application interface
• Data erasure — via account deletion with 30-day export window

10. Data Retention and Deletion

Personal data is retained for the duration of the service agreement. Upon termination:

• The Controller has 30 days to export all data
• After 30 days, all personal data is permanently and irreversibly deleted from our systems
• Operational records (walkarounds, defects) may be retained for up to 15 months for compliance purposes, as required by DVSA regulations
• Backup copies are purged within 60 days

11. Liability

Each party shall be liable for damage caused by processing that infringes the UK GDPR. The Processor shall not be liable for damage caused by processing only if the Processor has not complied with obligations of the UK GDPR specifically directed to processors or has acted outside of or contrary to the lawful instructions of the Controller.

12. Governing Law

This DPA is governed by the laws of England and Wales. Any disputes shall be subject to the exclusive jurisdiction of the courts of England and Wales.

13. Contact

For any questions regarding data processing, contact our Data Protection Officer at privacy@psvfleet.com.