This Data Processing Agreement ("DPA") forms part of the Terms of Service between Journey Tech Ltd, trading as TyreOps (Company Number: 11463274, VAT Number: GB303054849) ("Processor", "we", "us") and the customer ("Controller", "you", "your") and governs the processing of personal data by TyreOps on your behalf.

This DPA is entered into to ensure compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and any applicable data protection legislation.

1. Definitions

In this DPA, the following terms have the meanings set out below:

"Personal Data" means any information relating to an identified or identifiable natural person that is processed by TyreOps on your behalf through the Service
"Processing" means any operation performed on Personal Data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, erasure or destruction
"Data Subject" means the identified or identifiable natural person to whom the Personal Data relates
"Sub-Processor" means any third party engaged by TyreOps to process Personal Data on your behalf
"Controller" means the entity that determines the purposes and means of processing Personal Data (you, the customer)
"Processor" means the entity that processes Personal Data on behalf of the Controller (TyreOps)
"Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data
"Applicable Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and any successor or replacement legislation

2. Processing of Personal Data

2.1 Scope and Purpose

TyreOps processes Personal Data solely on your documented instructions and for the purpose of providing the Service as described in our Terms of Service. The categories of Personal Data processed and the types of Data Subjects are determined by your use of the Service and typically include:

Data Subjects: Your employees, customers, suppliers and other business contacts
Categories of data: Names, contact details (email, phone, address), vehicle information, job records, transaction history and any other data you enter into the platform

2.2 Obligations of the Processor

TyreOps shall:

Process Personal Data only on your documented instructions, unless required by law
Ensure that persons authorised to process Personal Data are subject to confidentiality obligations
Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk
Assist you in responding to requests from Data Subjects exercising their rights
Assist you in ensuring compliance with your obligations regarding data security, breach notification, impact assessments and prior consultation
At your choice, delete or return all Personal Data upon termination of the Service
Make available all information necessary to demonstrate compliance with this DPA

2.3 Obligations of the Controller

You shall:

Ensure that you have a lawful basis for the processing of Personal Data
Provide documented instructions to TyreOps regarding the processing of Personal Data
Ensure that Data Subjects are informed about the processing of their Personal Data in accordance with Applicable Data Protection Law
Be responsible for the accuracy, quality and legality of the Personal Data you provide

3. Data Security

TyreOps implements and maintains appropriate technical and organisational security measures to protect Personal Data against unauthorised or unlawful processing, accidental loss, destruction or damage. These measures include:

Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
Role-based access controls with principle of least privilege
Multi-factor authentication for system access
Regular vulnerability assessments and penetration testing
Automated daily backups with geographic redundancy
Network security monitoring and intrusion detection
Employee security awareness training
Documented incident response and disaster recovery procedures

Data Breach Notification

In the event of a Data Breach, TyreOps shall notify you without undue delay and in any event within 48 hours of becoming aware of the breach. The notification shall include:

A description of the nature of the breach, including the categories and approximate number of Data Subjects and records concerned
The name and contact details of our data protection point of contact
A description of the likely consequences of the breach
A description of the measures taken or proposed to address the breach and mitigate its effects

4. Sub-Processors

4.1 Authorisation

You provide general written authorisation for TyreOps to engage Sub-Processors to assist in providing the Service. We maintain a list of current Sub-Processors, which is available upon request.

4.2 Notification of Changes

We will notify you of any intended changes to Sub-Processors at least 30 days before the change takes effect, giving you the opportunity to object. If you have a reasonable objection, we will work with you to find an alternative solution. If no resolution can be reached, either party may terminate the affected Service.

4.3 Sub-Processor Obligations

TyreOps ensures that all Sub-Processors are bound by written agreements imposing data protection obligations no less protective than those set out in this DPA. TyreOps remains fully liable for the acts and omissions of its Sub-Processors.

5. International Transfers

TyreOps primarily stores and processes Personal Data within the United Kingdom and the European Economic Area. Where a transfer of Personal Data to a country outside the UK is required, we will ensure that appropriate safeguards are in place, including:

Transfers to countries that have received an adequacy decision from the UK Secretary of State
Use of the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses
Binding Corporate Rules where applicable

We will inform you of any international transfers and the safeguards applied upon request.

6. Data Subject Rights

TyreOps will assist you in fulfilling your obligations to respond to Data Subject requests under Applicable Data Protection Law. This includes requests related to:

Access to Personal Data
Rectification of inaccurate data
Erasure of Personal Data
Restriction of processing
Data portability
Objection to processing

If TyreOps receives a request directly from a Data Subject, we will promptly inform you and will not respond to the request without your instructions, unless required by law.

We will provide reasonable assistance to enable you to respond to Data Subject requests within the time limits prescribed by Applicable Data Protection Law.

7. Audit Rights

TyreOps will make available to you all information reasonably necessary to demonstrate compliance with this DPA and allow for and contribute to audits and inspections conducted by you or an independent auditor appointed by you, subject to the following conditions:

You must provide at least 30 days' written notice of any audit request
Audits shall be conducted during normal business hours and shall not unreasonably disrupt our operations
You shall bear the costs of any audit unless the audit reveals a material breach of this DPA by TyreOps
Auditors must be bound by confidentiality obligations and must not be a competitor of TyreOps
We may satisfy audit requests by providing relevant certifications, audit reports (such as SOC 2 or ISO 27001) or results of third-party assessments

8. Term & Termination

This DPA shall remain in effect for the duration of your use of the Service and for as long as TyreOps processes Personal Data on your behalf.

Upon termination of the Service, TyreOps shall, at your election:

Return: Provide you with a copy of all Personal Data in a commonly used, machine-readable format within 30 days of your request
Delete: Securely delete all Personal Data within 90 days of termination, unless retention is required by Applicable Data Protection Law

We will certify in writing that deletion has been completed upon your request. Any Personal Data retained for legal compliance purposes will continue to be protected in accordance with this DPA.

9. Governing Law

This DPA shall be governed by and construed in accordance with the laws of England and Wales, and the parties submit to the exclusive jurisdiction of the courts of England and Wales.

10. Contact Us

For questions about this DPA or to exercise any rights under this agreement, please contact us:

Email: [email protected]
Phone: 0800 069 9753
Company: Journey Tech Ltd, trading as TyreOps
Company Number: 11463274
VAT Number: GB303054849