Data Processing Agreement

Version 1.0 — July 2026

This Data Processing Agreement ("DPA") forms part of the agreement between Joshua Law, trading as MOTvault (UK, ICO registration ZC103739 — the "Processor", "we") and the garage business subscribing to MOTvault (the "Controller", "you"). It sets out how we process personal data on your behalf, as required by Article 28 of the UK GDPR.

1. What this covers

2. Your role and ours

You are the data controller of your customers' personal data: you decide what goes into MOTvault and why. We are your data processor: we handle that data only to provide the service, and only on your documented instructions (your use of the software's features constitutes those instructions). If we are ever required by law to process the data otherwise, we will tell you first unless the law prevents us.

3. Confidentiality

We make sure anyone we authorise to access your data (staff or contractors) is bound by a duty of confidentiality.

4. Security

We apply appropriate technical and organisational measures, including: encrypted connections (HTTPS/TLS) throughout; per-garage data isolation enforced at database level (row-level security); authentication for all dashboard access; secrets held server-side and never in the browser; and hosting with reputable providers (see section 5) with their own certified security programmes.

5. Sub-processors

You authorise the following sub-processors, which we use to run the service:

We will notify you of any intended change of sub-processor and give you the chance to object on reasonable grounds. Where a sub-processor stores data outside the UK, transfers rely on UK-approved safeguards.

6. Helping you with data subject rights

If one of your customers exercises a UK GDPR right (access, correction, deletion, portability, objection), the software lets you handle most requests yourself. Where you need our help, email hello@motvault.com and we will assist without undue delay.

7. Personal data breaches

If we become aware of a personal data breach affecting your data, we will notify you without undue delay, give you the information you need for your own ICO assessment, and assist with any notification you have to make.

8. Return and deletion

You can export your data at any time from within the software. When your subscription ends, we will, at your choice, return or delete the personal data we hold for you within 30 days, unless the law requires us to keep it longer.

9. Audit

We will make available the information reasonably necessary to demonstrate our compliance with this DPA, and allow for audits (including inspections) conducted by you or your appointed auditor, on reasonable notice and no more than once a year unless a breach has occurred.

10. General

This DPA is governed by the laws of England and Wales. If it conflicts with our Terms of Service, this DPA prevails for data protection matters. We are registered with the Information Commissioner's Office, registration number ZC103739.