Data Processing Agreement

1. Background and status

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Totalsoft IT Solutions Ltd (“Processor”, “we”, “us”) and the garage or workshop business using the Service (“Controller”, “you”). It reflects the parties’ agreement on the processing of Personal Data under UK GDPR and the Data Protection Act 2018, and applies to the extent we process Personal Data on your behalf and on your instructions as part of the Service.

Where terms are defined in UK GDPR (such as “Personal Data”, “Processing”, “Data Subject”, “Controller” and “Processor”), they carry the same meaning here.

2. Subject matter, duration, nature and purpose

Subject matter: the Processor’s provision of the Garage Manager platform, which involves processing Personal Data the Controller inputs or causes to be input into the Service.

Duration: for the term of the Controller’s subscription, and thereafter only as necessary to comply with clause 8 (return and deletion) or a legal retention obligation.

Nature and purpose: storage, retrieval, organisation, and transmission of Personal Data as needed to provide bookings, job card, quoting, invoicing, MOT/service reminder, stock, and staff/customer management functionality.

Types of Personal Data: customer name, contact details (phone, email, address), vehicle registration and details, job/service history, and payment/invoicing references. The Controller determines what data it inputs and should avoid submitting special category data unless strictly necessary and lawful to do so.

Categories of Data Subjects: the Controller’s customers, and the Controller’s own staff where added as platform users.

3. Processor obligations

We agree to:

• Process Personal Data only on the Controller’s documented instructions (including as set out in the Terms of Service), unless required to do otherwise by law, in which case we will inform the Controller before processing, unless prohibited from doing so.
• Ensure personnel authorised to process Personal Data are subject to confidentiality obligations.
• Implement appropriate technical and organisational measures to protect Personal Data, having regard to UK GDPR Article 32, including encryption of data in transit, access controls limiting who can view Personal Data, separation of each garage’s data from every other garage’s, and regular backups.
• Taking into account the nature of the processing, provide reasonable assistance to the Controller in responding to Data Subject rights requests, using the tools available in the Service or by direct support request.
• Taking into account the nature of the processing and the information available to us, assist the Controller in meeting its obligations under UK GDPR Articles 32 to 36: the security of processing, assessing and notifying Personal Data breaches to the ICO and to Data Subjects, data protection impact assessments, and prior consultation with the ICO.
• Notify the Controller without undue delay after becoming aware of a Personal Data breach affecting the Controller’s data, and give the Controller the information it reasonably needs to assess the breach and meet its own reporting obligations, as that information becomes available — including what happened, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed.
• Immediately inform the Controller if, in our opinion, an instruction infringes UK GDPR or other data protection law.
• At the Controller’s choice, delete or return Personal Data after the end of the provision of Service, as set out in clause 8.

4. Controller obligations

The Controller warrants that it has a lawful basis to instruct the processing of the Personal Data it submits to the Service, that its instructions comply with applicable data protection law, and that it will respond appropriately to Data Subject requests it receives directly.

5. Sub-processors

The Controller authorises the Processor to engage the sub-processors set out below, and any others notified in advance under this clause, to support delivery of the Service. The table shows where each processes Personal Data and, where that is outside the UK, how the transfer is protected (see clause 6).

AI features. When a user asks the AI diagnostic assistant a question, we send OpenAI the question, the earlier messages in that conversation, and technical details of the vehicle (such as make, model and engine). Before anything is sent, the Service checks for and refuses to send email addresses, phone numbers, registration numbers, VINs, postcodes, web addresses and the names and details of the customer on the job. OpenAI does not use this data to train its models, and keeps it for up to 30 days to monitor for abuse before deleting it. Conversations are also kept in the Service with the job they relate to, as Customer Data, and are deleted with it under clause 8. Nothing is sent to OpenAI unless a user asks a question.

We will give the Controller reasonable advance notice of any intended change to this list (addition or replacement of a sub-processor), during which the Controller may object on reasonable data-protection grounds; if the parties cannot resolve the objection, either party may treat that as grounds to terminate the affected part of the Service without further liability, without prejudice to fees already accrued.

Any sub-processor is engaged under a written contract imposing data protection obligations no less protective than those in this DPA, and we remain liable to the Controller for a sub-processor’s performance of those obligations.

Services the Controller connects. Where the Controller connects the Service to a third-party service of its choosing — for example accounting or bookkeeping software such as Xero, QuickBooks, Sage, FreeAgent, Zoho Books, KashFlow, Clear Books or FreshBooks, or its own account with a payment provider such as Stripe, SumUp, Square or GoCardless — we send Personal Data to that service, and receive it from it, on the Controller’s instructions. That service is engaged by the Controller under its own terms and is not our sub-processor, and it is not added to the list above. The Controller can disconnect it at any time.

Government data services. To look up vehicle and MOT information we send vehicle registration numbers to government services, such as the DVSA MOT history service. Those services act as independent controllers of the data they hold, not as our sub-processors.

6. International transfers

Customer Data is hosted in the UK. Some sub-processors process Personal Data outside the UK, as shown in clause 5. We will not transfer Personal Data outside the UK unless an adequate level of protection is ensured: to a country or organisation covered by UK adequacy regulations (including US organisations certified under the UK Extension to the EU–US Data Privacy Framework), or under appropriate safeguards such as the UK International Data Transfer Agreement (IDTA) or the ICO’s International Data Transfer Addendum to the EU Standard Contractual Clauses.

7. Security and audit

We will make available to the Controller information reasonably necessary to demonstrate compliance with this DPA and UK GDPR Article 28, and will allow for and contribute to audits, including inspections, conducted by the Controller (or an auditor mandated by the Controller) on reasonable prior written notice, no more than once per year unless triggered by a reasonably suspected breach, and subject to reasonable confidentiality and cost arrangements to be agreed.

8. Return and deletion of data

For 90 days after the Service ends, the Controller may ask us to make Personal Data available for export in a common format, or to delete it sooner. After those 90 days we delete Personal Data within a further 30 days. Copies in our backups are deleted as those backups expire in our normal backup cycle. We may keep data the law requires us to keep, for the period required, and the confidentiality obligations in this DPA continue to apply to anything kept.

9. Liability

Each party’s liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service.

10. Governing law

This DPA is governed by the laws of England and Wales, on the same basis as the Terms of Service.

11. Contact

Questions about this DPA can be sent to support@totalsoft.co.uk.