Data Processing Addendum

This Data Processing Addendum forms part of the Master Services Agreement between RJP Group Ltd (trading as Garage Page), registered in England and Wales, company no. 05937783, registered office 124 City Road, London EC1V 2NX ("Garage Page", "processor") and the garage ("you", "controller"). It sets out how we process Customer Data for you, as UK GDPR Article 28 requires.

1. Subject matter, duration, nature and purpose

• Subject matter: providing the Garage Page Service to you.
• Duration: the term of the agreement, plus the 90-day deletion period in section 9.
• Nature and purpose: hosting your page and diary; taking and managing bookings; sending texts, emails and reminders in your name; answering calls and chats (Reception plan); storing customer records, vehicle history, quotes, photos and documents; checking courtesy-car documents; reporting; and support.

2. Types of personal data and data subjects

The Service is not designed for special category data. Please don't enter health or other special category information in notes.

3. Our obligations

We will:

• process Customer Data only on your documented instructions — this agreement and the settings you choose in the app — unless the law requires otherwise, in which case we'll tell you first if we're allowed to;
• tell you if we think an instruction breaks data protection law;
• make sure everyone who can access Customer Data is bound by confidentiality;
• keep the security measures in section 6 in place;
• help you, taking into account what we can reasonably do, to respond to people exercising their rights (access, correction, deletion, objection), with data protection impact assessments, and with consulting the ICO where needed;
• tell you without undue delay, and in any case within 48 hours of becoming aware, of a personal data breach affecting Customer Data, with the information you need to meet your own obligations;
• at the end of the agreement, let you download Customer Data and then delete it within 90 days (and from backups as they expire), unless the law requires us to keep it;
• make available the information you reasonably need to show we're meeting this addendum, and allow audits as set out in section 7.

4. Sub-processors

You authorise us to use the sub-processors below. We have contracts with each of them that protect Customer Data to the same standard as this addendum, and we remain responsible for them. We'll tell you at least 14 days before adding or replacing one; if you object on reasonable data protection grounds and we can't resolve it, you can end the agreement and we'll refund any fees paid for the period after the change.

MOT history comes from the DVSA's MOT history service, a public data source rather than a processor. Stripe processes your own billing details as our provider; it doesn't receive Your Customers' data.

5. International transfers

Where a sub-processor processes Customer Data outside the UK, we make sure a transfer mechanism approved under UK law is in place, such as UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework) or the ICO's International Data Transfer Agreement or Addendum.

6. Security measures

• Encryption in transit (HTTPS/TLS) for all traffic, and encryption at rest by our hosting provider.
• Two-step sign-in (password plus an authenticator app code) required for every User of the app.
• Access by role (owner, manager, front desk, technician); technicians don't see prices; database rows are locked so only the application itself can read them.
• A log of who confirmed, moved, cancelled or closed bookings and who changed settings or downloaded data.
• Driving licence and insurance documents stored privately, shown only through short-lived links, and deleted after the hire unless you choose to keep them on file.
• Single-use, time-limited sign-in and set-up links; sign-in links are never stored in message logs.
• Keys and passwords for third-party services held only in protected server settings, never in pages or the database.
• Backups by our hosting provider, and restricted administrative access within Garage Page.

7. Audits

We'll answer reasonable written questions about how we protect Customer Data. If that isn't enough to show compliance, or a regulator requires it, you (or an independent auditor bound by confidentiality) may audit our compliance once a year on 30 days' notice, during business hours, at your cost, in a way that doesn't compromise other customers' data.

8. Liability and order of precedence

Each party's liability under this addendum is subject to the limits in the agreement, except where the law doesn't allow it. If this addendum conflicts with the agreement about Customer Data, this addendum wins.

Also part of the agreement: Master Services Agreement · Schedule 1 – Service and pricing.