H.A.S.P.R.O Data Processing Agreement (DPA)

Hamblett Auto Services – Fleet Management Platform
Last updated: 19 September 2026

This Data Processing Agreement (“Agreement”) forms part of the Service Contract between Hamblett Auto Services (“Processor”) and the Client (“Controller”) and governs the processing of personal data within the H.A.S.P.R.O fleet‑management platform (“Platform”).

---

1. Definitions

• Controller — The Client who determines the purpose and means of processing personal data.
• Processor — Hamblett Auto Services, who processes personal data on behalf of the Controller.
• Personal Data — Any information relating to an identifiable individual (e.g., drivers, staff).
• Processing — Any operation performed on Personal Data.
• Sub‑processor — Third parties engaged by the Processor to support the Service.
• Data Subject — The individual whose data is processed.


---

2. Purpose of Processing

The Processor will process Personal Data solely for:

• Fleet‑management operations
• PMI scheduling and record generation
• MOT fail (VT30) defect reporting
• Brake‑test interval management
• Calendar scheduling and customer filtering
• Vehicle, driver, and staff record management
• Compliance‑support tools aligned with DVSA expectations


The Processor will not process Personal Data for any purpose other than delivering the Service.

---

3. Categories of Data

The Platform may process:

• Driver names, contact details, licence information
• Staff names and roles
• Vehicle identifiers (VRM, VIN, fleet numbers)
• Maintenance records, inspection dates, defects
• MOT, PMI, brake‑test, and compliance data
• Customer account information
• Login and usage data


Sensitive data is not required or intentionally collected.

---

4. Controller Responsibilities

The Controller must:

• Ensure lawful grounds for entering Personal Data
• Provide accurate and up‑to‑date information
• Inform Data Subjects of processing activities
• Maintain DVSA compliance independently of the Platform
• Ensure Authorised Users follow internal data‑protection policies


The Controller remains fully responsible for DVSA compliance.

---

5. Processor Obligations

The Processor agrees to:

• Process Personal Data only on documented instructions
• Maintain appropriate technical and organisational security measures
• Ensure staff confidentiality
• Assist the Controller with data‑subject requests where feasible
• Notify the Controller of data breaches without undue delay
• Delete or return Personal Data upon termination (subject to retention rules)


---

6. Sub‑processors

The Processor uses trusted Sub‑processors to deliver the Service, including:

• Wix.com Ltd — Hosting, infrastructure, security
• Email delivery providers — Notifications and account communication
• Analytics providers — System performance and usage insights


The Processor will:

• Ensure Sub‑processors meet GDPR requirements
• Inform the Controller of material changes to Sub‑processors
• Remain liable for Sub‑processor actions


---

7. Security Measures

The Processor implements:

• Encrypted data transmission (HTTPS/TLS)
• Secure hosting environments
• Access controls and authentication
• Regular system updates and patching
• Monitoring for suspicious activity
• Data minimisation and retention controls


The Controller is responsible for securing their own devices and login credentials.

---

8. Data Subject Rights

The Processor will assist the Controller with:

• Access requests
• Rectification
• Erasure
• Restriction
• Objections
• Data portability


The Processor will not respond directly to Data Subjects unless instructed by the Controller.

---

9. Data Breach Notification

If a Personal Data breach occurs:

• The Processor will notify the Controller without undue delay
• The notification will include known details, impact, and mitigation steps
• The Controller is responsible for notifying regulators or Data Subjects where required


---

10. International Transfers

Personal Data may be transferred outside the UK/EU only when:

• Adequate safeguards are in place
• Standard Contractual Clauses (SCCs) are used where required
• Sub‑processors meet GDPR transfer requirements


---

11. Retention & Deletion

Upon termination:

• The Controller may request a data export within 30 days
• The Processor will delete Personal Data after the retention period
• The Processor may retain anonymised data for analytics and system improvement


---

12. Audit Rights

The Controller may request:

• Information necessary to demonstrate compliance
• Confirmation of security measures
• Details of Sub‑processors


Formal audits may be conducted with reasonable notice and must not disrupt operations.

---

13. Liability

The Processor is not liable for:

• Incorrect or incomplete data entered by the Controller
• DVSA penalties, missed inspections, or compliance failures
• Losses arising from misuse of the Platform


Total liability is limited to fees paid in the previous 12 months.

---

14. Termination

This Agreement terminates when:

• The Service Contract ends
• The Controller requests termination
• The Processor discontinues the Platform


Obligations relating to confidentiality and data protection survive termination.

---

15. Governing Law

This Agreement is governed by the laws of England and Wales.
Disputes will be resolved in UK courts.

---

16. Contact Information

Hamblett Auto Services
High Peak, United Kingdom
Email: hamblettautos@hotmail.com