Data Processing Addendum

1.1 Roles. In respect of personal data contained in Customer Data, the Customer is the controller and Tachyo is the processor. For other data (see our Privacy Policy), Tachyo is a controller and this DPA does not apply.

1.2 Terms. “Controller”, “processor”, “personal data”, “personal data breach”, “processing” and “data subject” have the meanings in the UK GDPR. “Data Protection Law” means the UK GDPR, the Data Protection Act 2018, PECR and other UK data protection law. Other capitalised terms have the meaning in the Customer Terms.

1.3 Details of processing. The subject matter, duration, nature, purpose, types of personal data and categories of data subject are set out in Annex 1.

2.1 Documented instructions. Tachyo will process personal data only on the Customer’s documented instructions, which are: this DPA and the Customer Terms; the Customer’s use and configuration of the Services (including settings its administrators choose); and any further written instructions Tachyo accepts. Tachyo may also process where UK law requires it to, and will tell the Customer first unless the law forbids it.

2.2 Unlawful instructions. Tachyo will tell the Customer if it believes an instruction breaches Data Protection Law, and is not obliged to follow it.

2.3 Confidentiality. Tachyo will make sure everyone it authorises to process personal data is under a duty of confidentiality, and limits access to those who need it to provide the Services.

2.4 No other use. Tachyo will not sell personal data or use it for its own marketing. Tachyo may create aggregated and de-identified data as permitted by Clause 7.2 of the Customer Terms; before de-identification it acts as a controller only so far as needed to do that.

Tachyo will keep in place technical and organisational measures appropriate to the risk, as required by Article 32 UK GDPR, including those in Annex 2. Tachyo may update the measures provided it does not reduce the overall level of protection.

4.1 General authorisation. The Customer gives Tachyo general written authorisation to use the sub-processors in Annex 3.

4.2 Changes. Tachyo will give the Customer at least 30 days’ notice (by email to its administrators or in the Admin Platform) before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within 14 days of the notice. The parties will try to resolve the objection; if they cannot, the Customer may end the affected Services and Tachyo will refund prepaid Fees for the period after the end date.

4.3 Flow-down and responsibility. Tachyo will bind each sub-processor by written contract to data protection obligations that are materially the same as those in this DPA, and remains responsible to the Customer for each sub-processor’s performance.

5.1 Location. Tachyo stores Customer Data in the UK (AWS London region).

5.2 Transfers. Tachyo will transfer personal data outside the UK only where permitted by Data Protection Law, for example under UK adequacy regulations, the UK International Data Transfer Addendum or an International Data Transfer Agreement, and will put those safeguards in place with the relevant sub-processor. Annex 3 identifies where a sub-processor may process data outside the UK.

6.1 Data subject requests. Taking into account the nature of the processing, Tachyo will provide reasonable technical and organisational help so the Customer can respond to requests from data subjects, including through export and deletion tools in the Services and, where the tools do not cover it, by acting on the Customer’s written instruction. If a data subject contacts Tachyo about Customer Data, Tachyo will not respond on the substance, will tell the data subject who the controller is and will pass the request to the Customer within three business days.

6.2 Other assistance. Tachyo will give reasonable help with the Customer’s obligations on security, breach notification, data protection impact assessments and consultation with the ICO, so far as they relate to Tachyo’s processing and the information Tachyo holds. Tachyo may charge reasonable costs for help that goes beyond what is built into the Services.

7.1 Notice. Tachyo will notify the Customer’s administrator without undue delay, and where it can within 48 hours, after confirming a personal data breach affecting Customer Data.

7.2 Content. The notice will describe, as far as Tachyo then knows, the nature of the breach, the categories and approximate numbers of people and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Tachyo will provide further information as it becomes available.

7.3 Responsibility. The Customer decides whether to notify the ICO and the people affected, and Tachyo will not do so on the Customer’s behalf unless the law requires it or the Customer asks.

The Customer confirms and agrees that it:

• (a) is responsible for having a lawful basis for the processing it instructs, and for the lawfulness of its instructions and of the settings it chooses;
• (b) will give each Driver and other data subject the privacy information required by Articles 13 and 14 before their data is collected, including that their location is tracked while on shift and any pay-related settings it switches on;
• (c) will complete a data protection impact assessment where the law or ICO guidance requires one, including for location monitoring of workers, and will consult workers or their representatives where required;
• (d) is responsible for the accuracy of Customer Data and for not entering special category data or criminal-offence data;
• (e) is responsible for responding to data subjects, and for deciding how long each kind of record is kept; and
• (f) will comply with the Information Commissioner’s guidance on monitoring workers and with employment law.

The Customer’s indemnity to Tachyo for failures to meet these responsibilities is in Clause 16 of the Customer Terms.

9.1 Information. Tachyo will make available the information reasonably necessary to show it is complying with Article 28 UK GDPR, including answers to reasonable security questionnaires.

9.2 Audits. If that information is not enough, the Customer (or an independent auditor bound by confidentiality) may audit Tachyo’s compliance, no more than once in any 12 months unless a regulator requires it or there has been a personal data breach, on at least 30 days’ written notice, during UK business hours, in a way that does not disrupt the Services, at the Customer’s cost. An audit does not give access to source code, to other customers’ data, or to information that would breach a duty of confidentiality owed to others.

10.1 Return. When the agreement ends, Tachyo will on request provide a copy of Customer Data in a structured, commonly used format such as CSV.

10.2 Deletion. Tachyo will delete the Customer Data as set out in Clause 6.8 of the Customer Terms: it is held suspended for 30 days after the agreement ends and then deleted from live systems and databases, with copies in the hosting provider’s backups overwritten in the ordinary course of that provider’s cycle. On the Customer’s written request Tachyo will confirm in writing that deletion has been completed.

10.3 Photographs and files. The Customer instructs Tachyo to keep uploaded photographs and files in restricted private storage for 24 months from their upload date, even after the agreement ends or a Driver record is deleted, because they can form part of vehicle safety, working-time and delivery records that the Customer must keep by law, and then to delete them (Clause 6.9 of the Customer Terms). During that time Tachyo will give the Customer a copy of the files on request, and will delete files sooner if the Customer asks in writing.

10.4 Exceptions. Tachyo may keep personal data that UK law requires it to keep, and will protect it and use it only for that purpose.

Each party’s liability under this DPA is subject to the limits and exclusions in Clause 15 of the Customer Terms, to the extent the law allows. Nothing in this DPA limits a data subject’s rights against either party, or either party’s liability that cannot lawfully be limited.

A1.1 Subject matter and purpose. Providing the Tachyo fleet-management platform to the Customer: hosting, storing, retrieving, calculating, displaying, transmitting and deleting Customer Data so that the Customer can run dispatch, shifts, inspections, fuel and parking claims, deliveries, payroll calculations, analytics and related functions, and so that Tachyo can give support and keep the Services secure.

A1.2 Duration. The term of the agreement plus the suspension and file-retention periods in Clause 10.

A1.3 Nature. Collection, recording, organisation, storage, retrieval, consultation, use, calculation, disclosure by transmission to the Customer’s authorised users, restriction, erasure and destruction. Processing is continuous while the account is active.

A1.4 Categories of data subject.

• The Customer’s Drivers: employees, workers, agency drivers and self-employed sub-contractors.
• The Customer’s administrators and office staff.
• People who receive deliveries and sign for them.
• Any other person named by the Customer in free-text fields.

A1.5 Types of personal data.

• Identity and contact: full name, driver ID, phone number, work email, company code, role.
• Authentication: hashed PIN, activation and sign-in events, IP addresses in security logs.
• Location: latitude, longitude, speed, accuracy and timestamp during a shift; last known position when signal is lost; device location at the time a receipt, delivery photo or signature is submitted.
• Working time: shift start and end, depot, vehicle and trailer, idle and GPS-offline events, rota, holiday requests.
• Inspections and incidents: walkaround results, notes, photographs and incident reports.
• Expenses: fuel, AdBlue and parking receipts, dashboard photographs, odometer readings.
• Deliveries: proof-of-delivery photographs and the first name, last name and drawn signature of the signatory.
• Pay: rates, extra payments, pay calculations and payroll records.

A1.6 Special category data. None is intended. Incident reports and notes are free text and could include details such as an injury. The Customer is responsible for having a lawful basis and any further condition that applies to anything of that kind, and should keep it to what it needs. The Customer must not enter criminal-offence data.

• Hosting. The database and file storage are hosted in the AWS London region through Supabase. Physical and infrastructure security is provided by the hosting provider.
• Encryption. Data is encrypted in transit using TLS, and encrypted at rest by the hosting provider.
• Customer separation. Row-level security in the database limits each administrator and driver to their own company’s records, and a driver to their own records. Feature and plan limits are enforced in the database, not just in the interface.
• Driver authentication. A six-digit PIN stored only as a salted hash; easy PINs (repeated or sequential digits) are rejected; single-use activation codes that expire after 48 hours; progressive lock-outs after repeated wrong attempts; deactivated drivers cannot sign in.
• Administrator authentication. Email and password sign-in with two-step verification (authenticator app) supported; once an administrator has enrolled, the database refuses access that has not completed the second step.
• File storage. Photographs and receipts are kept in private storage, readable only by the company that owns them, with limits on file type and size.
• Audit logging. Driver activations, PIN changes, administrator sign-ins and failed attempts are logged with time and IP address and are visible to the Customer’s administrators.
• Data minimisation. Location is collected only while a driver is clocked in. The product does not use biometrics or record audio or video.
• Anti-spoofing. The Driver App rejects locations flagged by the phone as mock or simulated.
• Access control. Access to production systems is limited to those who need it, protected by individual credentials, and server-side keys are kept out of the apps and the website.
• Deletion tools. Administrators can delete records, and an employee’s account and related data can be deleted on a confirmed request.
• Resilience. We use a managed provider; we do not commit to a particular backup frequency or recovery time unless an Order says so.

• Supabase, Inc. (infrastructure: Amazon Web Services) — Database, user authentication, private file storage and server functions for the Tachyo platform. Location: Data stored in the AWS London region (eu-west-2), United Kingdom. Supabase server functions run on a global edge network, so data in transit (for example a sign-in request) may be handled outside the UK before it reaches the London database. Data involved: All Customer Data held in the platform, including driver records, shift and location records, photographs, signatures, pay-rate and payroll records, and administrator account data.
• Vercel Inc. — Hosting and delivery of the Tachyo admin dashboard and this website, and running the website's contact-form handler. Location: Global edge network; server functions may run in the United States. Data involved: Technical request data (IP address, browser type, pages requested) and the contact-form details a prospective customer submits. Vercel does not hold the platform database.
• Resend, Inc. — Sending service emails: account set-up and sign-in links, access-request notifications and scheduled analytics report emails. Location: Sending region: EU (Ireland). Resend, Inc. is a United States company. Data involved: Recipient email address, sender and the content of the email being sent (for example, a sign-in link or a weekly profit summary).

Other services your browser or phone contacts. These are not sub-processors of Customer Data because they do not receive the platform database, but they do receive technical data directly from users’ browsers or phones:

• OpenFreeMap / OpenStreetMap contributors — Map tiles and map styles for the live map and journey history in the dashboard, and the map in the driver app. Data involved: IP address and the map area being viewed. Driver identities are not sent.
• OpenStreetMap Foundation (Nominatim and embedded map) — Address look-up when an administrator uses a location to fill in an address, and the map preview shown when an administrator compares a fuel receipt's recorded location. Data involved: IP address and the coordinates being looked up or displayed.
• Google Fonts (Google LLC) — Delivers the typefaces used by the admin dashboard. Data involved: IP address and browser details of the person loading the dashboard.

Questions about this DPA: privacy@tachyo.co.uk.