Data processing agreement

1. Processing schedule — to be agreed

2. Documented instructions and confidentiality

The proposed processor obligation is to process only on the controller’s documented instructions, including instructions for transfers, unless applicable law requires otherwise. The processor must notify the controller of a binding legal requirement where legally permitted and flag an instruction it considers unlawful.

Access must be limited to authorised personnel bound by confidentiality. The final schedule must identify who may issue instructions and how changes are recorded.

3. Security and assistance

The parties must agree technical and organisational measures proportionate to the risks. Implemented application measures include password hashing, tenant checks, session revocation, origin validation and dated activity entries. These are not a complete production security schedule.

The proposed assistance covers individual rights, security assessments, DPIAs and regulatory consultation. The company must establish a tested incident process and notify the controller without undue delay after becoming aware of a personal data breach, supplying available information and follow-up updates. The controller separately assesses any regulator notification deadline.

4. Subprocessors and transfers

Appoint subprocessors only under prior specific or general written authorisation, with equivalent data-protection obligations. If general authorisation is used, define change notices and a meaningful opportunity to object. Identify each legal entity, service, data location and transfer mechanism in an agreed annex.

Production hosting and other subprocessors are unappointed. No placeholder provider list constitutes customer authorisation, and a standard clause link alone does not complete a transfer assessment.

5. Audit, return and deletion

The processor must make necessary compliance information available and allow and contribute to proportionate audits and inspections. Scope, secure evidence sharing and confidentiality should be documented without frustrating statutory audit rights.

At the controller’s choice, return or delete personal data after the service, and delete copies unless applicable law requires storage. Specify export formats, timeframes, backup handling and limited legal holds. The current application does not yet implement that complete workflow.

5A. Driver checks, monitoring and messaging instructions

The web/backend pilot now supports business-directed driver expiry/reference records and review decisions, activity reports, private incident media and business-driver messages. Driver Pool authorisation — the platform's own review of a driver's right-to-work evidence (GOV.UK share code or passport photograph review), driving licence, delivery insurance and identity selfie before Pool access is granted — is controller processing by UNLIMIT DIGITAL LTD and is not carried out on the engaging business's instructions; biometric processing within Driver Pool (automated face comparison and AWS Face Liveness) relies on the individual driver's explicit consent and is not instructed by any business. Before production use, agree the business-directed categories, purposes, authorised roles, providers/transfers, retention, rights assistance and security measures in the processing schedule. Automated government or insurance checks, automatic customer arrival messaging and shared-driver matching remain outside the implemented schedule.

For the intended business-directed driver-check service, the engaging business performs and determines its required checks, retains the necessary evidence and communicates decisions and notices. The processor records and protects data on lawful documented instructions; it does not certify right to work, driving entitlement or insurance cover. Responsibility for a statutory check cannot be removed by this allocation.

Limit evidence access to authorised reviewers, maintain access/decision records, protect transfers and stored files, and use separate retention schedules. Customer contact and channel permission records must be sufficient for the instructed service message. Sharing between businesses or use for unrelated marketing requires its own authority and assessment; no such permission is implied.

Where the platform administrator or a business enables server-side AI-assisted receipt reading, receipt image and/or extracted text — which may include the customer name, delivery address, telephone number and order amounts — may be submitted to a third-party AI language model service configured by the administrator. Approved provider categories include general-purpose large language model services (currently: Groq; optionally Google Gemini, Anthropic Claude or OpenAI) and self-hosted inference servers. These services act as subprocessors for the purpose of receipt field extraction. The providers currently used are based or primarily operated outside the UK/EEA; adequate transfer safeguards must be confirmed and documented before each provider is appointed. Confirmed order details from a business's completed orders may be retained internally as examples to improve reading accuracy for that same business only; this constitutes separate internal processing and must be described in the processing schedule.

Actual processing determines controller and processor roles. Where the company determines its own purposes or means, such as platform security or a future matching service, assess and disclose the resulting role and lawful basis. The company must meet its own statutory duties and inform the controller if, in its opinion, an instruction infringes applicable data-protection law. No service-term disclaimer removes those obligations or individual statutory remedies.

6. Before this agreement can take effect

• Name the customer and authorised signatories; settle the service contract and precedence provisions.
• Complete the retention, security, approved-subprocessor and transfer annexes.
• Publish working incident/privacy contacts and test assistance, return and deletion procedures.
• Obtain appropriate legal review and record mutual agreement. This page is not an executed DPA.