Data Processing Agreement

1. Parties

This Joint Controller Agreement ("JCA") is between TekSpert Ltd ("TekSpert") and the tenant organisation ("Tenant") using the TekSpert Vehicle Data Platform.

2. Joint Controllership

For vehicle lookups performed through the Platform, TekSpert and the Tenant are joint controllers under Article 26 UK GDPR. TekSpert is the controller for the storage and security of lookup records. The Tenant is the controller for the lawful basis of each lookup they perform.

3. Responsibilities

TekSpert is responsible for:

• Securing all stored data (encryption at rest, access controls, audit logging)
• Upstream DVLA API compliance
• Responding to data subject access requests relating to platform-wide data
• Breach notification within 72 hours

The Tenant is responsible for:

• Ensuring lawful basis exists for each VRM lookup (legitimate interests in trade/fleet/insurance)
• Managing data subject access requests relating to their own use of looked-up data
• Complying with DVLA acceptable use conditions

4. Sub-processors

TekSpert uses the following sub-processors: DVLA (Vehicle Enquiry Service API), Stripe Inc (payment processing). No vehicle data is shared with Stripe.

5. Data Subject Rights

Both parties will cooperate on data subject requests. TekSpert provides a VRM erasure tool for tenants and an internal cross-tenant erasure tool for verified requests.

6. Acceptance

This DPA is accepted electronically during account signup. The acceptance timestamp and version are recorded against the tenant record.