Data Processing Agreement

This Data Processing Agreement (“DPA”) is between the Customer that uses the See-Curity platform (the controller) and See-Curity, run by Justyna Biernat, London NW7 2PE, United Kingdom (the processor). It meets the requirements of Article 28 of the EU General Data Protection Regulation and the UK GDPR, and forms part of our Terms of Service. A Company Admin accepts it for the Customer when signing in.

1. What the processing is

Subject and purpose	Providing the GPS tracking service: live map, history, reports, geofences, alerts by WhatsApp and e-mail, remote commands, and the help assistant.
Duration	For as long as the Customer uses the service, and until the data is deleted under section 9.
Types of personal data	Vehicle location (GPS or mobile network), speed, direction, ignition, battery voltage, alarms, trips and visits to places, geofences, commands; vehicle details (name, registration, tracker and SIM numbers); names, e-mail addresses and phone numbers of users and alert recipients; any names or notes the Customer enters.
People concerned	Drivers and passengers of the Customer's vehicles; the Customer's staff and users; people who receive alerts.

2. The Customer's instructions

We process the data only on the Customer's documented instructions. The Customer's settings and actions on the platform, and these Terms, are those instructions. If we believe an instruction breaks data protection law, we will say so. If the law obliges us to process data in another way, we will tell the Customer first unless the law forbids it.

3. The Customer's responsibilities

The Customer decides which vehicles are tracked and why, and is responsible for having a lawful basis for the tracking, for informing drivers and other people concerned (our Driver notice may help), and for carrying out any data protection impact assessment and staff consultation its law requires.

4. Confidentiality

Everyone who can access the Customer's data on our side is bound to keep it confidential. Our support staff can see all of the Customer's data on the platform in order to give support and fix faults, and use it for nothing else.

5. Security

We take appropriate technical and organisational measures to protect the data, as listed in Annex A, and we review them as the platform develops.

6. Sub-processors

The Customer authorises the sub-processors listed in Annex B. We impose data protection obligations on each of them equivalent to those in this DPA, and we remain responsible for them. We will announce any new sub-processor on this page, and to Company Admins at sign-in, before it starts. The Customer may object on reasonable data protection grounds; if we cannot resolve the objection, the Customer may end the service.

7. International transfers

Where a sub-processor is outside the UK or the European Economic Area, the transfer is protected by an adequacy decision or by standard contractual clauses approved by the UK and EU authorities.

8. Help we give the Customer

• Requests from individuals: if a driver or other person contacts us directly, we pass the request to the Customer without delay and do not answer it ourselves unless the Customer asks us to. We help the Customer answer, for example by exporting the data concerned.
• Data breaches: we tell the Customer without undue delay, and in any case within 48 hours, after becoming aware of a breach that affects its data, with the information the Customer needs to inform the authorities and the people concerned.
• Impact assessments: we provide the information the Customer reasonably needs about our processing.

9. Deleting data

Tracking history is deleted automatically after 12 months. When the service ends, we delete the Customer's remaining data within 30 days, unless the law requires us to keep it. The Customer can export its reports before then.

10. Audits

We provide the information needed to show that we comply with this DPA. The Customer may carry out an audit, or have one carried out, with reasonable notice, during working hours, at its own cost, and at most once a year unless there has been a breach.

11. Liability and order of precedence

Liability under this DPA follows the Terms of Service. If this DPA and the Terms conflict on data protection, this DPA prevails.

Annex A – Security measures

• All connections to the platform are encrypted (HTTPS/TLS).
• Passwords are stored only as salted one-way hashes. Accounts are locked temporarily after repeated wrong passwords.
• Strict separation between customers: each company sees only its own vehicles, enforced in one central place in the software. Within a company, access depends on the user's role and the vehicles assigned to them.
• Automatic sign-out of the live map after a period of inactivity.
• Access to the server and the database is limited to the people who run the platform.
• Tracking history is automatically deleted after 12 months (data minimisation).
• Software changes are tested before release, and every release can be rolled back.

Annex B – Sub-processors

Sub-processor	Service	Location
Dedicloud (dedicloud.co.uk)	Server hosting and database	United Kingdom
OpenAI	The help assistant: questions, and the vehicle details needed to answer them	USA
Meta (WhatsApp)	Delivery of WhatsApp alerts	EU / USA
Google (Google Maps)	Map images loaded by the user's browser	USA
Esri (ArcGIS)	Map images loaded by the user's browser	USA

E-mail alerts are sent from our own server and delivered by the recipients' e-mail providers. Data from the tracker travels over the mobile network of the SIM card fitted in it.