This Data Processing Agreement ("DPA") forms part of the MV Workshop Platform Terms.
1. Parties and status
The DPA is between the Customer identified in the Contract (the "Controller") and MV TECHNOLOGY SYSTEMS LTD trading as MV Workshop (the "Processor"). Terms such as controller, processor, personal data, processing, data subject, personal data breach and supervisory authority have the meanings given in applicable UK data-protection law.
2. Scope and roles
The Controller determines the purposes and essential means of processing Customer Data. The Processor processes Customer Data on the Controller's documented instructions to provide, secure, maintain and support MV Workshop. MV may act as an independent controller for its own business contact, billing, security, fraud-prevention, support and legal records; those activities are covered by the MV Workshop Privacy Notice rather than this DPA.
3. Controller obligations
The Controller must ensure its processing instructions are lawful; identify a valid Article 6 lawful basis; identify and document any required Article 9 condition or other condition where special-category or criminal-offence information is processed; give individuals appropriate privacy information; handle rights and complaints; apply data minimisation; set appropriate retention periods and access permissions; and not instruct MV to process information unlawfully or outside the agreed service.
4. Documented instructions
MV will process personal data only on the Controller's documented instructions, including the Contract, configuration selected by authorised administrators and subsequent written instructions capable of being retained, unless UK law requires otherwise. If MV believes an instruction infringes applicable law it will inform the Controller unless prohibited and may pause the affected processing.
5. Confidentiality and personnel
MV will ensure persons authorised to process Customer Data are bound by confidentiality and receive appropriate security and data-protection instructions. Access will be limited to people who need it for their role.
6. Security
Taking account of the state of the art, implementation cost, nature, scope, context and purposes of processing and risks to individuals, MV will implement appropriate technical and organisational measures. These include tenant separation, role-based access, managed authentication, encryption in transit, supplier-supported encryption at rest, logging, backup and recovery arrangements, input validation, secure file handling, incident processes and privileged-access controls appropriate to the production service.
The Customer remains responsible for security of its devices, local networks, user administration, password hygiene and authorised access.
7. Subprocessors
The Controller gives general written authorisation for subprocessors listed in the current MV Workshop Subprocessor Register. MV will impose appropriate data-protection obligations on subprocessors and remains responsible to the Controller for their performance of those obligations. MV will provide reasonable notice of a material new or replacement subprocessor where practicable. The Controller may raise a reasonable data-protection objection; the parties will work in good faith to address it.
8. International transfers
MV will not make a restricted transfer of Customer Data except on the Controller's instructions and using a lawful transfer mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved EU Standard Contractual Clauses or another mechanism recognised by UK law.
9. Data subject rights
Taking account of the nature of processing, MV will provide reasonable technical and organisational assistance so the Controller can respond to requests for access, rectification, erasure, restriction, portability, objection and relevant automated-decision rights. If MV receives a request directly relating to Customer Data it will normally forward it to the Controller without undue delay and will not respond substantively unless authorised or legally required.
10. Personal data breaches
MV will notify the Controller without undue delay after becoming aware of a confirmed personal data breach affecting Customer Data and, where feasible, aims to provide initial notification within 24 hours. Information may be supplied in phases and will include what is reasonably available about the breach, affected data, likely consequences and containment/remediation. MV will maintain an incident record and reasonably assist with risk assessment, ICO notification and communication to affected people where required.
11. Compliance assistance
Taking account of the nature of processing and information available, MV will reasonably assist the Controller with security obligations, breach response, DPIAs and prior consultation with the ICO. Additional bespoke work outside normal self-service support may be chargeable where the need was not caused by MV's breach.
12. Audit and information
MV will make information reasonably necessary to demonstrate Article 28 compliance available to the Controller, including relevant policies, supplier information and assurance where available. A Controller audit must be proportionate, protect other customers and security, and normally use remote documentation before any on-site request. Unless a material breach is found, the Controller bears its own audit costs.
13. Return and deletion
On termination, the Controller may use available export functionality during the normal 30-day exit window. MV will then delete or anonymise live Customer Data unless UK law requires retention. Copies in protected backups may remain until the next scheduled deletion cycle, normally not more than 90 days, and remain beyond ordinary use.
14. Records and regulator cooperation
MV will maintain records required of it as processor and cooperate with the ICO or other competent supervisory authority where legally required. Each party will provide the other with reasonable information needed to respond to a regulator about processing covered by this DPA.
15. Processing Schedule
Subject matter: hosting and operation of MV Workshop and related support.
Duration: Subscription Term plus agreed export and deletion period.
Nature: collection, recording, organisation, storage, retrieval, consultation, transmission, display, alteration, backup, export, restriction, deletion and support.
Purposes: workshop customer administration; vehicles/trailers; PMI and maintenance inspections; defects and rectification; planner/bookings; job cards; labour/parts; invoicing where enabled; reminders; document storage; signatures; operator handoff/integrations; security and support.
Data subjects: Customer owners, directors, administrators, office staff, mechanics, contractors; operator-customer contacts; drivers or other individuals named in maintenance/defect documents; supplier and invoice contacts.
Personal data categories: identity/contact data; role and account data; authentication/audit data; signatures; vehicle assignment and workshop records; photographs/documents; job and labour records; invoice/billing contact information; communications; IP/device data.
Special-category data: not intended as a standard MV Workshop field. It may arise if the Controller uploads incident, injury or other documents containing such information; the Controller must ensure a lawful condition and minimise such data.
Criminal-offence data: not intended as a standard field but may appear in uploaded records; the Controller remains responsible for lawful processing.
Frequency: continuous and event-driven during the Subscription Term.
Controller instructions: Contract, account configuration, authorised user activity and documented written instructions.
Return/deletion: export during exit window, then live deletion/anonymisation; protected backup expiry under the retention schedule.
16. Technical and organisational measures summary
Governance; tenant isolation with organisation identifiers and Row Level Security or equivalent; unique user accounts; least privilege; role permissions; privileged access controls; secure managed authentication; TLS; supplier-supported encryption at rest; secrets kept out of client code; code/dependency review; audit logging; backup and recovery; data minimisation; retention/deletion controls; supplier due diligence; incident response; confidentiality and security awareness.
17. Liability and precedence
Liability under this DPA is subject to the liability provisions in the Platform Terms to the extent permitted by law. If this DPA conflicts with the Platform Terms on a data-protection matter, this DPA prevails.