Data processing agreement

Version 1 — draft, pending review

Placeholder, as above. This agreement is required by GDPR Article 28 and must be reviewed before it is relied on.

1. Roles

The workshop is the controller of its customers' personal data. AutoBook is the processor and acts only on the workshop's documented instructions.

2. Scope

AutoBook processes the data needed to run bookings, customer records, vehicles, sales and reports: names, contact details, vehicle registrations, appointment details and purchase history.

3. Security

Data is stored in the EU. Each workshop's data is held in its own database. Secrets and payment credentials are encrypted at rest. Access is limited to staff who need it to operate and support the service.

4. Sub-processors

The current list is published alongside this agreement. The workshop is notified before a new sub-processor is added.

5. Assistance

AutoBook assists the workshop with requests from data subjects, with security incidents, and with deletion or return of data at the end of the agreement.

6. Retention

On termination, data is deleted within the period stated here once the workshop has had the opportunity to export it, except where law requires longer retention — notably accounting records.