This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Elite Solutions Hub Ltd (“Processor”, “we”) and the Subscriber (“Controller”, “you”) and applies where we process Personal Data on your behalf through the Elite Fleet Management platform (the “Service”). It reflects the requirements of Article 28 of the UK GDPR. If it conflicts with the Terms on data protection, this DPA prevails.
1. Definitions
“UK GDPR”, “Personal Data”, “Processing”, “Controller”, “Processor”, “Data Subject” and “Personal Data Breach” have the meanings in UK data protection law (the UK GDPR and Data Protection Act 2018). “Subscriber Personal Data” means Personal Data we process on your behalf under the Terms.
2. Roles & scope
As between the parties, you are the Controller and we are the Processor of Subscriber Personal Data. Each party will comply with its obligations under UK data protection law. The subject matter, duration, nature, purpose, types of data and categories of Data Subjects are set out in Annex A.
3. Processing on your instructions
We will process Subscriber Personal Data only on your documented instructions (including as set out in the Terms and your configuration and use of the Service), unless required by law — in which case we will, where permitted, inform you first. We will promptly tell you if, in our opinion, an instruction infringes data protection law.
4. Confidentiality
We ensure that persons authorised to process Subscriber Personal Data are bound by appropriate confidentiality obligations and only access data on a need-to-know basis.
5. Security
Taking account of the state of the art, costs, and the nature, scope, context and risk of the processing, we implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as described in Annex B.
6. Sub-processors
You give general authorisation for us to engage sub-processors to provide the Service. Our current sub-processors are listed in Annex C. We impose data protection obligations on each sub-processor no less protective than those in this DPA, and we remain responsible for their performance. We will give you reasonable notice of any intended change of sub-processor and a chance to object on reasonable data-protection grounds; if we cannot resolve a reasonable objection, you may terminate the affected part of the Service.
7. Assisting you
- Data-subject rights: taking account of the nature of the processing, we provide reasonable assistance (including appropriate technical and organisational measures) to help you respond to Data-Subject requests. Where a Data Subject contacts us directly about your data, we will refer them to you.
- DPIAs & consultation: we provide reasonable assistance with data protection impact assessments and prior consultation with the ICO, given the information available to us.
8. Personal Data Breach
We will notify you without undue delay after becoming aware of a Personal Data Breach affecting Subscriber Personal Data, and provide information reasonably available to us to help you meet your own notification obligations.
9. International transfers
We will not transfer Subscriber Personal Data outside the UK/EEA except where an appropriate safeguard is in place (such as UK adequacy regulations, the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses), or another lawful basis applies.
10. Return & deletion
On termination of the Service, and at your choice, we will delete or return Subscriber Personal Data and delete existing copies, unless we are required by law to retain it. You may export your data before termination using the Service.
11. Audits
We make available information reasonably necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate — on reasonable prior notice, no more than once a year (unless required by a regulator or following a Breach), during business hours, subject to confidentiality, and without unreasonably disrupting our operations.
12. Liability
Each party’s liability under this DPA is subject to the limitations and exclusions in the Terms.
13. Term
This DPA applies for as long as we process Subscriber Personal Data under the Terms.
Annex A — Details of processing
- Subject matter: provision of the Elite Fleet Management platform to the Controller.
- Duration: the term of the subscription, plus any retention period in the Terms/Privacy Policy.
- Nature & purpose: hosting, storage, and processing of records to operate a vehicle-rental / private-hire business — vehicles, agreements, drivers, compliance, charges, payments, communications, and (where enabled) telematics and AI-assisted analysis.
- Types of Personal Data: identification and contact details; driver licence, PCO and DVLA-related details; insurance details; addresses; vehicle and agreement records; payment and arrears data; message logs; and, where enabled by the Controller, vehicle location/telematics.
- Categories of Data Subjects: the Controller’s staff/operators, drivers, and customers.
Annex B — Technical & organisational measures
- Encryption of data in transit (TLS) and encryption of sensitive credentials at rest.
- Per-tenant data isolation enforced at the database (row-level security).
- Role-based access control and least-privilege access for staff.
- Authentication via a managed identity provider; secrets held in a secure configuration store.
- Immutable audit logging of security-relevant actions.
- Reputable infrastructure sub-processors with their own security certifications.
- Backup and recovery processes, and monitoring to detect and respond to incidents.
Annex C — Sub-processors
- Supabase — database, authentication.
- Vercel — application hosting.
- Cloudflare (R2) — file/object storage.
- Stripe — subscription and payment processing.
- GoCardless — direct-debit payment processing (where used).
- Resend — transactional email.
- Twilio — SMS (where used).
- AI provider — the model provider powering the included assistant.
Note for Elite Solutions Hub Ltd: keep this sub-processor list accurate and confirm each provider’s transfer safeguards with your solicitor/DPO before launch.
Contact
Elite Solutions Hub Ltd · privacy@elitesolutionshub.com