Data Processing Agreement

1. About this agreement

This agreement is between you, the business that holds an A2Z Workshop account (the controller), and A2Z IT Limited, company number 16306508 (the processor, "we"). It forms part of our terms of service and applies to the personal data of your customers that we process for you. It is made under Article 28 of the UK GDPR and the Data Protection Act 2018. If it conflicts with the terms of service, this agreement wins on data protection.

The details of the processing are in Schedule 1, and our security measures in Schedule 2.

2. Your instructions

• We process the personal data only on your documented instructions. Your instructions are these terms and what you do in the app (for example, adding customers, turning reminders on, or sending a campaign). This includes any transfer outside the UK (section 5).
• The only exception is where UK law requires us to do something else. If so, we will tell you first, unless the law forbids it.
• We will tell you straight away if we think an instruction breaks data protection law.
• You are responsible for having a lawful basis for the data you give us and the messages you send, including consent for marketing.

3. Our staff

Only people who need to, for running or supporting the service, can access the personal data. They are bound to keep it confidential. Support access to your account is read-only, and every use is logged with the reason.

4. Security

We keep appropriate technical and organisational measures in place to protect the personal data, as required by Article 32 of the UK GDPR. They are listed in Schedule 2. We may improve them, but we will not reduce the overall level of protection.

5. Sub-processors and transfers

• You give us general permission to use the sub-processors listed in our privacy policy. Those that process your customers' data are Microsoft (Azure, including Azure Communication Services) and Cloudflare.
• We will email you at least 30 days before we add or replace a sub-processor that processes your customers' data. If you object on reasonable data protection grounds, tell us. If we cannot resolve it, you can cancel, and we will not charge you for any period after the change.
• We put a written contract in place with each sub-processor, with data protection terms at least as strong as these. We remain responsible to you for their work.
• Your customer and vehicle records are stored in the UK. Where a sub-processor handles any data outside the UK, we make sure the transfer is protected as UK law requires (for example, with the UK International Data Transfer Addendum or the UK-US data bridge).

6. Helping you

• Requests from your customers. The app lets you view, correct, export and delete customer records, and records opt-outs automatically. If one of your customers contacts us directly, we will pass the request to you without undue delay and not answer it ourselves, unless you ask us to. We will help you with any request you cannot handle in the app.
• Other duties. We will give you reasonable help with security, breach notification, data protection impact assessments and any consultation with the ICO, taking into account the information we have.

7. Data breaches

If we become aware of a personal data breach affecting your customers' data, we will tell you without undue delay, and within 48 hours. We will tell you what happened, what data and how many people are affected, the likely effects, and what we are doing about it, and send more details as we learn them. This helps you meet your own duty to tell the ICO within 72 hours where needed.

8. When the agreement ends

• You can export your data as a CSV file while your account is open, and for 30 days after it ends (read-only).
• Unless you ask us to delete it sooner, we then keep the data for 270 days, so you can reactivate your account. After that we erase the personal data. If you ask us to delete it earlier, we will do so.
• We keep only what UK law requires us to keep, or records that no longer identify anyone. Backups are replaced within 7 days.

9. Showing we comply

We will give you the information you reasonably need to show that we meet this agreement, and answer reasonable written questions. If that is not enough, or the ICO asks, you (or an auditor you choose, bound to confidentiality) may audit us, with at least 30 days' notice, no more than once a year, during working hours and at your own cost.

10. Liability and law

The limits of liability in our terms of service apply to this agreement, unless the law does not allow it. This agreement is governed by the law of England and Wales. It lasts as long as we process personal data for you.

Schedule 1: The processing

Subject and purpose

Keeping your customer and vehicle records, looking up vehicle and MOT details from the DVLA, and sending MOT, service and tyre reminders and (with consent) marketing messages by SMS and email for you.

Duration

While your account exists, then as in section 8.

Nature of the processing

Storing, organising, looking up, importing, exporting, sending messages, recording consent, opt-outs and delivery results, and deleting.

People the data is about

Your customers, and people who sign up on your public form.

Types of personal data

Name, mobile number, email address, vehicle registration, make and model, MOT, service and tyre dates, consent records (with time and, for marketing opt-ins, IP address), and message records (text, time and delivery result). No special category data.

Schedule 2: Security measures

• Hosting in Microsoft Azure data centres in the UK.
• Data encrypted in storage and in transit (TLS).
• Each business's data is kept apart in the database by row-level security, checked on every request.
• Sign-in through Microsoft Entra. Staff access uses separate Microsoft 365 accounts, is read-only for support, and is logged with a reason.
• Passwords and keys are kept in Azure Key Vault. Services connect with managed identities, not stored passwords.
• Application logs do not contain names, phone numbers, email addresses, registrations or message text.
• Records are deleted in two steps: hidden first, then erased.
• Automatic backups with point-in-time restore for 7 days, stored in the UK.
• Bot protection (Cloudflare Turnstile) on public sign-up forms.
• Infrastructure changes are made as reviewed code, not by hand.