Data processing agreement (Article 28 draft)

Draft · version dpa-2026-10-23 · effective 23 October 2026. This draft has not yet been reviewed by a solicitor and may change. FleetMate does not hold any security certification.

1. Roles

For this draft agreement, the service provider is Ion-Silviu Mihai, a UK sole trader trading as FleetMateUK. This document remains a draft pending agreement with each customer company.

The customer company is controller; FleetMate is processor for customer operational data.

2. Instructions

FleetMate processes personal data only on documented instructions — using the service as configured counts as instructions — unless law requires otherwise, in which case we tell you first where allowed.

3. Subject matter

• Data subjects: customer staff and drivers, the customer's own customers and contacts.
• Data: names, contact details, vehicle registrations, addresses, inspection photos/notes, optional recorded signatures, job-time GPS.
• Duration: the account term plus the retention schedule below.

4. Confidentiality and access

Personnel are bound by confidentiality. Platform operators have no console access to customer content and no impersonation. Exceptional technical access (e.g. incident recovery) is restricted to what is necessary and should be recorded.

5. Security (Article 32)

Encryption in transit; storage encrypted at rest by the infrastructure provider; company-separated database access rules tested with automated checks; private file storage with short-lived links; append-only audit logs; redacted support data. Not end-to-end encrypted.

6. Sub-processors

• Lovable / Lovable Cloud (application hosting, database, authentication, file storage) and their infrastructure providers.
• OpenStreetMap tile servers (map images; receive IP address only).
• No in-app job-email, SMS, push, payment or AI provider is currently connected to receive operational job records. A separate privacy correspondence channel uses Cloudflare Email Routing, a Google-hosted Gmail mailbox and Resend for outbound replies; providers may process information voluntarily included in those messages. The roles and international transfer arrangements for this channel must be reviewed before adopting this draft.

We will give notice before adding a sub-processor so you can object.

7. Assistance

We help with data-subject requests (export tools, correction, erasure requests), DPIAs and consultations.

8. Breaches

We notify you without undue delay after becoming aware of a personal data breach affecting your data, with what we know, likely consequences and measures taken, so you can meet the ICO's 72-hour deadline.

9. Retention and deletion

• Job-time GPS history: default 90 days (configurable 30–730).
• Support tickets: 12 months.
• Jobs, inspections, photos, documents: for the account term and your configured post-contract period; legal holds respected.
• At the end, data is deleted or returned at your choice after a reviewed closure request; backups age out on the provider's cycle.

10. Audits

We provide information needed to show compliance and allow reasonable audits with notice.

11. Transfers

Restricted transfers rely on UK adequacy regulations or the IDTA/Addendum.