Data Processing Agreement (DPA): changes marked in the text
In force from 4 November 2026 · deleted text · inserted text
Data Processing Agreement (DPA)
Version: 1.0 | Effective date: February 19, 2026 | Market: UK (aroute.co.uk)Version: 1.1 | Effective date: 4 November 2026. § 7.4 and § 13.1 as amended apply from 20 November 2026.
§1. Parties
This Data Processing Agreement (hereinafter: "Agreement" or "DPA") is entered into between:
Data Processor:
Emversa Maciej Łukowski
ul. Sielska 17a
60-129 Poznań, Poland
VAT ID: PL9720811257
Email: office@emversa.com
(hereinafter: "Processor" or "Emversa")
and
Data Controller:
The Organisation using the Aroute Platform
(hereinafter: "Controller" or "Organisation")
§2. Agreement Execution
- This Agreement is automatically concluded upon acceptance of the Aroute Platform Terms of Service during the registration process.
- Acceptance of the Terms of Service (checking the required checkbox "I accept the Terms of Service") constitutes simultaneous acceptance of this Data Processing Agreement.
- The Organisation represents that the person accepting the Terms of Service and this Agreement is authorised to represent the Organisation and enter into obligations on its behalf.
§3. Subject Matter
- The Controller entrusts the Processor with the processing of personal data of Drivers (employees and contractors of the Controller) to the extent necessary to provide the Aroute Platform services.
- The Processor undertakes to process the entrusted personal data only for the purpose and scope specified in this Agreement and in accordance with the Controller's instructions.
- The Processor processes data on behalf of the Controller pursuant to Article 28 of the UK GDPR and in compliance with the Data Protection Act 2018.
§4. Scope of Entrusted Data
4.1. Categories of Data Subjects
- Drivers (employees and contractors of the Organisation)
- Users invited by the Administrator
4.2. Categories of Processed Data
Identification data:
- First and last name
- Work email address
- Profile photo (optional)
Trip data:
- GPS coordinates (route start/end)
- GPS checkpoints containing: latitude and longitude, altitude, instantaneous speed, heading, GPS accuracy, timestamp
- Addresses (start/end)
- Timestamps (start/end)
- Trip distance
- Speed (maximum, average)
- Vehicle odometer reading
- Trip purpose
- Trip type (business/private)
Private vehicle data:
- Registration number
- Make and model
- Engine capacity
- Vehicle type
Reimbursement data:
- Reimbursement claim amounts
- Billing periods
- Approval status
Technical data:
- Working hours and days (for auto-trip feature)
- Language preferences
- Consent settings (location, marketing)
4.3. Special Categories of Data
The Processor does not process special categories of personal data within the meaning of Article 9 of UK GDPR.
§5. Purpose of Processing
The Processor processes entrusted data only for the purpose of:
- Recording and documenting business and private trips
- Generating Vehicle Mileage Log reports (for company vehicles) and Reimbursement Summary reports (for private vehicles)
- Processing reimbursement claims for private vehicles
- Visualising data on the fleet map (paid feature)
- Detecting mileage gaps and discrepancies
- Automatic trip detection (auto-trip)
Exporting data to Excel and PDF formatsExporting data to Excel, PDF, CSV and JSON formats, including the full Organisation data export- Providing iOS mobile application functionality
- Sending invitations to Drivers
- Technical support and user assistance
§6. Processor Obligations
The Processor undertakes to:
6.1. Compliance with Regulations
- Process data in accordance with UK GDPR, Data Protection Act 2018, and other applicable UK regulations
- Process data only on documented instructions from the Controller
- Immediately inform the Controller if an instruction violates applicable law
6.2. Confidentiality
- Ensure that persons authorised to process data have committed to confidentiality
- Process data only through trained personnel
6.3. Security
Implement appropriate technical and organisational measures ensuring data security, including:
- Data encryption in transit (TLS/HTTPS)
- Data encryption at rest
- Password hashing (bcrypt)
- Row-Level Security (RLS) at database level
- Role-based access control (RBAC)
- Webhook signature verification
- Regular security updates
6.4. Sub-processing
- Use sub-processors only under conditions specified in §7
- Ensure that sub-processors meet UK GDPR requirements
6.5. Assistance to Controller
- Assist in fulfilling data subject rights
- Assist in ensuring compliance with Articles 32-36 UK GDPR (security, DPIA, consultations)
- Provide information necessary to demonstrate compliance
6.6. Data Breaches
- Promptly (no later than 24 hours) notify the Controller of any data breach
- Document breaches and remedial actions taken
§6a. Controller Obligations
- The Controller represents that it has a legal basis for the processing entrusted to the Processor and for giving the Processor instructions.
- Before starting location recording of employees, the Controller fulfils its obligations under UK employment and data protection law, following the ICO guidance on monitoring workers, including telling workers about the monitoring before it starts and carrying out a DPIA where required.
- For Drivers who are not employees (e.g. contractors), the Controller ensures a separate legal basis.
- The Controller gives Drivers the information required by Art. 13 UK GDPR before they start using the Platform, and assesses whether a data protection impact assessment is required (Art. 35 UK GDPR). The Processor assists under §6.5.
- The Controller decides whether to enable features that affect the scope of processing (in particular the fleet map, speed display, auto-trip and manual entry mode) and is responsible for their consistency with the monitoring purposes set under point 2.
§7. Sub-processors (Further Entrustment)
7.1. Consent to Sub-processing
The Controller grants general consent for the Processor to use sub-processors listed in §7.3.
7.2. Obligations Towards Sub-processors
The Processor undertakes to:
- Enter into a data processing agreement with each sub-processor
- Ensure that sub-processors meet requirements no less than those specified in this Agreement
- Bear full responsibility for sub-processor actions
7.3. List of Sub-processors
| Sub-processor | Purpose | Location | Data Processed |
|---|---|---|---|
| Supabase Inc. | Database hosting, authentication, Edge Functions | All user, trip, checkpoint data | |
| Stripe Payments Europe, Ltd. | Ireland (EU) | Organisation billing data | |
| Vercel Inc. | Application hosting, CDN | Request logs, IP addresses | |
| Resend, Inc. | Transactional email delivery | USA | Email addresses, names, invitation tokens |
| Google LLC | Google Analytics (with consent) | USA | Anonymised analytics data |
| Apple Inc. | Maps and address search in the iOS app (MapKit, CLGeocoder on the device) | USA | Search text typed and trip coordinates |
| Google LLC | Maps in the Android app (Google Maps SDK on the device) and address search (Google Places through the Processor's server) | USA | Search text typed and the user's location as the centre of a 50 km search area (Places); device IP address and visible map area (Maps SDK) |
| OpenStreetMap Foundation | Geocoding (reverse geocoding) | GPS coordinates (no personal data) | |
| OpenStreetMap Foundation | Map tiles (map display in the browser) | United Kingdom | Browser IP address, visible map area |
| Distance calculation | GPS coordinates (no personal data) | ||
| Weather conditions | |||
7.4. Changes to Sub-processor List
- The Processor will notify the Controller of the intention to add or change a sub-processor
with 30 days' advance noticeby email to the Organisation's billing address.with 14 days' advance notice - The Controller may object to a new sub-processor
within 14 days of notification. Lack of objection means acceptance.before that notice period ends - In case of justified objection, the parties will negotiate to find a solution. If no solution is reached, the Controller may terminate the agreement effective at the end of the current billing period.
§8. International Data Transfers
8.1. Transfers to EU/EEA
Transfers to EU/EEA countries are permitted as the EU/EEA is recognised as providing adequate protection under UK adequacy regulations.
8.2. Transfers to USA
Some sub-processors process data in the USA. Transfers are secured through:
UK International Data Transfer Agreement (IDTA)UK Addendum to EU Standard Contractual Clauses (SCC)UK Extension to EU-US Data Privacy Framework (where applicable)
8.3. Sub-processors in Third Countries
8.1. Transfers to the EU/EEA
The Processor is established in Poland. Transfers from the United Kingdom to the EU/EEA are permitted under the UK adequacy regulations.
8.2. Transfers to the USA
For every sub-processor established in the USA, the Processor uses the International Data Transfer Addendum to the EU Standard Contractual Clauses issued by the ICO (UK Addendum) or the International Data Transfer Agreement (IDTA). Where a sub-processor is certified under the UK Extension to the EU-US Data Privacy Framework, the certification is an additional safeguard; if the UK-US data bridge ceases to apply, transfers continue on the basis of the UK Addendum or IDTA.
8.3. Transfer risk assessment
For each sub-processor established in the USA, the Processor has carried out and documents a transfer risk assessment. The Processor will provide the Controller with a summary on request.
8.4. Sub-processors transferring data outside the UK
| Sub-processor | Established in | Data stored in | Data transferred | Transfer mechanism |
|---|---|---|---|---|
| Supabase Inc. | USA | EU (Frankfurt); support access from third countries | All Platform data | UK adequacy regulations (EU); UK Addendum to the SCCs (US access) |
| Vercel Inc. | USA | Application servers in Frankfurt (EU); content delivery via a global network | Request logs, IP addresses | UK Addendum to the SCCs or IDTA (and UK Extension to the Data Privacy Framework where applicable) |
| Resend, Inc. | USA | USA | Email addresses, names, invitation tokens | UK Addendum to the SCCs or IDTA |
| Google LLC (Google Analytics) | USA | USA | Analytics data (only with cookie consent) | UK Addendum to the SCCs or IDTA and UK Extension to the Data Privacy Framework |
| Apple Inc. (MapKit, iOS app) | USA | USA | Search text typed and trip coordinates | UK Addendum to the SCCs or IDTA and UK Extension to the Data Privacy Framework |
| Google LLC (Google Maps Platform, Android app) | USA | USA | Search text typed and the user's location as the centre of a 50 km search area (Places); device IP address and visible map area (Maps SDK) | UK Addendum to the SCCs or IDTA and UK Extension to the Data Privacy Framework |
OpenStreetMap Foundation and Zoomash Ltd (WeatherAPI.com) are established in the United Kingdom: no restricted transfer. The OSRM server (FOSSGIS) processes data in Europe.
8.5. Updates
The list in 8.4 is updated under the procedure in §7.4.
§9. Data Subject Rights
9.1. Assistance in Fulfilling Rights
The Processor undertakes to assist the Controller in fulfilling data subject rights under Art. 15-21 UK GDPR:
| Right | Platform Implementation |
|---|---|
| Right of access (Art. 15 UK GDPR) | Data export to Excel/PDF available for Drivers |
| Right to rectification (Art. 16 UK GDPR) | Profile editing, trip edit requests |
| Right to erasure (Art. 17 UK GDPR) | Administrator can deactivate Drivers; contact Processor |
| Right to portability (Art. 20 UK GDPR) | |
| Right to restriction (Art. 18 UK GDPR) | Contact Processor |
| Right to object (Art. 21 UK GDPR) | Contact Processor |
9.2. Response Time
The Processor will respond to Controller requests regarding data subject rights within 10 business days.
§10. Audit and Verification
10.1. Right to Audit
The Controller has the right to verify Processor compliance with this Agreement through:
- Requesting written information and documentation
- Conducting an audit (with 30 days' advance notice, during business hours)
10.2. Audit Costs
Audit costs are borne by the Controller, unless the audit reveals significant violations - in which case costs are borne by the Processor.
10.3. Audit Confidentiality
Audit results are confidential and may not be disclosed to third parties without Processor consent.
§11. Term and Termination
11.1. Term
This Agreement remains in effect for the entire period of the Controller's use of the Aroute Platform.
11.2. Termination
The Agreement terminates:
- Upon subscription end and expiration of the grace period
(90 days for voluntary cancellation or 30 days for non-payment)(90 days for voluntary cancellation) or of the data retention period (30 days from suspension for non-payment) - Upon termination of the Terms of Service
- By mutual agreement of the parties
11.3. Data Handling After Termination
- After Agreement termination, the Processor will:
Enable data export in CSV and PDF formats during the grace periodEnable export of all data in CSV and JSON during the grace period, or during the 30-day data retention period after non-payment- Delete personal data after the grace period expires; the Processor does not archive data for the Controller, and keeping records required by law is the Controller's responsibility
Retain data required by law (e.g., invoice data - 5 years from end of tax year per Polish tax law). UK customers should retain their copies for 6 years per HMRC requirements.Retain data required by law (e.g. invoice data, until the tax liability is time-barred (Polish tax law))
- Upon Controller request, the Processor will provide a data deletion certificate.
11.4. Platform Discontinuation
- In case of Platform discontinuation by the Processor, the Controller will be notified with at least 90 days' advance notice.
- During the notice period, the Controller will be able to export all data.
- After the notice period expires, data will be permanently deleted, except for data subject to mandatory legal retention.
11.5. GPS route points
The Processor keeps detailed GPS route points for about one quarter after the trip ends and then deletes them; the trip data (start and end point, addresses, distance, odometer readings) stays until the Agreement and the grace period end.
§12. Liability
12.1. Processor Liability
The Processor is liable for damages resulting from data processing in violation of this Agreement or UK GDPR provisions.
12.2. Limitation of Liability
The total liability of the Processor is limited to the sum of subscription fees paid by the Controller in the 12 months preceding the event, unless the damage results from gross negligence or intentional misconduct.
12.3. Liability for Sub-processors
The Processor is liable for acts and omissions of sub-processors as for its own acts.
12.4. Exclusions
Nothing in this Agreement shall limit or exclude liability for: (a) death or personal injury caused by negligence; (b) fraud or fraudulent misrepresentation; (c) any other liability that cannot be limited or excluded by applicable law.
§13. Agreement Amendments
- The Processor may introduce changes to this Agreement
with 30 days' advance notice.with 14 days' advance notice - The Controller will be notified of changes by email.
- Continued use of the Platform after changes take effect constitutes acceptance of the amended Agreement.
- If the Controller does not accept the changes, they may terminate the agreement before the changes take effect.
§14. Final Provisions
14.1. Governing Law
This Agreement is governed by and construed in accordance with the laws of England and Wales.
14.2. Dispute Resolution
Any disputes arising from this Agreement shall be subject to the exclusive jurisdiction of the courts of England and Wales.
14.3. Document Hierarchy
In case of conflict between this Agreement and the Terms of Service, the provisions of this Agreement shall prevail regarding personal data protection.
14.4. Severability
If any provision of this Agreement is found to be invalid, the remaining provisions shall remain in effect.
§15. Contact
Processor (data processor):
Emversa Maciej Łukowski
ul. Sielska 17a
60-129 Poznań, Poland
Email: office@emversa.com
Supervisory Authority:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Tel: 0303 123 1113
Document generated: February 19, 2026