Data Processing Agreement

Effective 16 October 2026 · Vilmak Ltd

1. Definitions

1. Terms defined in the Terms of Service have the same meaning in this DPA. Controller, processor, data subject, personal data, personal data breach, processing and supervisory authority have the meanings given in the UK GDPR.
2. Customer Personal Data means personal data contained in Customer Data that we process on behalf of the Customer in providing the Service.
3. Sub-processor means any third party appointed by us to process Customer Personal Data.
4. Restricted Transfer means a transfer of Customer Personal Data to a country outside the United Kingdom that is not covered by UK adequacy regulations.

2. Roles and scope

1. The Customer is the controller and we are the processor of Customer Personal Data. The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are described in Annex 1.
2. The Customer shall ensure that it has a lawful basis for the processing, that it has provided all information to data subjects required by Data Protection Laws, and that its instructions comply with Data Protection Laws. The Customer is responsible for the accuracy and lawfulness of Customer Personal Data and of the means by which it was obtained.

3. Our obligations

We shall:

1. process Customer Personal Data only on the Customer's documented instructions, including with regard to Restricted Transfers, unless required to do otherwise by UK law, in which case we will inform the Customer of that legal requirement before processing unless the law prohibits this. The Terms, this DPA and the Customer's use and configuration of the Service are the Customer's complete documented instructions. We will tell the Customer immediately if, in our opinion, an instruction infringes Data Protection Laws;
2. ensure that every person we authorise to process Customer Personal Data is subject to a duty of confidentiality;
3. implement and maintain the technical and organisational measures described in Annex 2, which are designed to ensure a level of security appropriate to the risk, as required by Article 32 of the UK GDPR. We may update these measures provided that the overall level of security is not reduced;
4. comply with clause 4 when engaging Sub-processors;
5. taking into account the nature of the processing, assist the Customer by appropriate technical and organisational measures, as far as possible, to respond to requests from data subjects exercising their rights. If we receive such a request directly, we will promptly forward it to the Customer and will not respond to it except to direct the data subject to the Customer, unless required by law;
6. assist the Customer in ensuring compliance with its obligations under Articles 32 to 36 of the UK GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the nature of the processing and the information available to us;
7. notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data, and provide the information reasonably available to us to help the Customer meet its own obligations, including the nature of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences and the measures taken or proposed. We will take reasonable steps to contain and remedy the breach. Notification is not an acknowledgement of fault or liability;
8. at the end of the provision of the Service, delete or return Customer Personal Data in accordance with clause 11 of the Terms, and delete existing copies unless UK law requires us to store them;
9. make available to the Customer all information reasonably necessary to demonstrate compliance with Article 28 of the UK GDPR, and allow for and contribute to audits in accordance with clause 6.

4. Sub-processors

1. The Customer gives general written authorisation for us to engage the Sub-processors listed on our Sub-processors page.
2. We will give the Customer at least 30 days' notice before engaging a new Sub-processor or replacing one, by updating the Sub-processors page and notifying the Customer by email or in the Service. The Customer may object on reasonable data protection grounds within that period. If we cannot reasonably accommodate the objection, the Customer may terminate the affected Service by written notice and receive a refund of Fees paid in advance for the period after termination.
3. We will impose on each Sub-processor, by written contract, data protection obligations that offer at least the same level of protection as this DPA, and we remain liable to the Customer for each Sub-processor's performance of those obligations.

5. International transfers

We will not make, or permit a Sub-processor to make, a Restricted Transfer unless it is protected by an appropriate safeguard under Article 46 of the UK GDPR, such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses issued by the ICO, or another lawful transfer mechanism, together with any supplementary measures required.

6. Audits

1. We will respond to reasonable written requests for information about our processing, including security questionnaires, no more than once in any 12-month period, unless a further request is required by a supervisory authority or follows a personal data breach.
2. Where the information provided does not reasonably demonstrate compliance, the Customer may, on at least 30 days' written notice and no more than once in any 12-month period, carry out an audit itself or by an independent auditor bound by confidentiality, during normal business hours and in a way that does not unreasonably disrupt our business or compromise the security or confidentiality of other customers' data. The Customer shall bear its own costs and reimburse our reasonable costs of supporting the audit.

7. Liability

Each party's liability under or in connection with this DPA is subject to the exclusions and limits of liability in the Terms. Nothing in this DPA limits either party's liability to data subjects or supervisory authorities under Data Protection Laws where that liability cannot be limited.

8. Duration and precedence

This DPA continues for as long as we process Customer Personal Data. If there is a conflict between this DPA and the Terms in relation to the processing of personal data, this DPA prevails.

Annex 1: Details of processing

Annex 2: Technical and organisational security measures

• Encryption in transit. All access to the Service is over HTTPS (TLS), with HTTP Strict Transport Security. Push notification contents are end-to-end encrypted to the user's browser.
• Customer separation. Each customer's data is separated logically, and access is checked on the server for every request, file, report, export and background job. Automated tests verify that one customer cannot access another's data.
• Access control. Role-based permissions (company administrator, depot manager, fleet or compliance manager, driver) with depot-level restrictions. Drivers can see only their own records.
• Authentication. Passwords are stored as one-way salted hashes. Sign-in and password-change attempts are rate limited. Accounts and companies can be deactivated immediately.
• Evidence integrity. Original photographs and uploaded evidence are stored outside the public web root, are not replaceable by users, and are available only through short-lived signed links issued after a permission check.
• Audit trail. Significant actions, including submissions, reviews, defect status changes, vehicle releases, corrections, approvals and permission changes, are recorded with the user, time and IP address.
• Application security. Input validation on all requests; protection against cross-site scripting, clickjacking and content-type sniffing through security headers and a content security policy; uploads checked for type and size.
• Infrastructure. Administrative access to servers restricted to authorised personnel; deployments carried out through an automated, tested process with restricted privileges; operating system and software security updates applied regularly.
• Backups and recovery. Daily database backups and weekly evidence file backups, kept on a rolling basis.
• Retention. Configurable retention periods for inspection evidence, with legal hold for records under dispute or investigation.
• Personnel. Access to Customer Personal Data limited to personnel who need it to provide or support the Service, under confidentiality obligations.
• Incident response. Procedure to assess, contain and notify personal data breaches in accordance with clause 3.7.

Annex 3: Sub-processors

See the current list on our Sub-processors page, which forms part of this Annex.