Skip to content
FleetPro UK

Home · Version 1.1 · Effective 29 September 2026

Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the contract between Operator Labs Ltd ("Processor", "we", "us") and the customer organisation that uses FleetPro UK ("Controller", "you"). FleetPro UK is a software product of Operator Labs Ltd, not a separate company.

This DPA applies where Operator Labs processes personal data on your behalf in providing FleetPro UK, as required by UK GDPR Article 28. It does not apply where Operator Labs acts as an independent controller (for example free trial sign-ups or our own account administration), which is described in our Privacy Policy.

1. Definitions

"UK GDPR", "personal data", "processing", "controller", "processor", "data subject", and "personal data breach" have the meanings in the UK GDPR and Data Protection Act 2018. "Customer Personal Data" means personal data processed by Operator Labs on your documented instructions in FleetPro UK.

2. Roles

  • You are the controller of Customer Personal Data (for example driver and staff compliance records you enter or generate in the service).
  • Operator Labs is the processor for that Customer Personal Data when providing FleetPro UK.
  • Where you use DVLA Access to Driver Data via FleetPro UK, you remain the controller of the enquiry and result; Operator Labs processes the check on your instructions under the applicable DVLA processor arrangements.

3. Subject matter, duration, nature and purpose

  • Subject matter: hosting and operation of FleetPro UK for transport / workshop compliance and related workflows.
  • Duration: for the term of your subscription or access, plus any retention period required by this DPA or law.
  • Nature and purpose: storage, retrieval, transmission, display, analysis and deletion of Customer Personal Data as needed to provide the features you use (accounts, driver and vehicle records, inspections, defects, tachograph review, licence checks, messaging, reporting, support).
  • Types of personal data: may include identity and contact data; licence and professional qualification data; National Insurance numbers and dates of birth where you record them; employment/depot assignments; eyesight and induction records; accident/incident narratives including injury descriptions; DVLA endorsement and related offence data where you run ADD checks; location data you submit; photos, signatures and documents; tachograph-related identifiers; technical logs and push tokens.
  • Special category / criminal offence data: may include health-related eyesight or injury information and DVLA endorsement/conviction data. You determine the Article 6 basis and Article 9 / DPA 2018 conditions and instruct us to process only where lawful.
  • Categories of data subjects: your authorised users, drivers, employees, contractors, and individuals named in records you upload (for example witnesses or third parties in incident reports).

4. Instructions

Operator Labs shall process Customer Personal Data only on your documented instructions, including as configured in the service and as set out in these Terms / this DPA, unless required by UK law. If we believe an instruction infringes UK data protection law, we will inform you (unless the law prohibits that notice).

5. Confidentiality

Persons authorised to process Customer Personal Data are subject to confidentiality obligations.

6. Security

Taking into account the state of the art, costs, and the nature of the processing, Operator Labs shall implement appropriate technical and organisational measures to protect Customer Personal Data, including measures described in our Information Security Policy and Information Handling Procedure (organisation isolation, access control, encryption in transit, restricted handling of raw DVLA responses, and related controls).

7. Subprocessors

You authorise Operator Labs to engage subprocessors to provide the service. Current material subprocessors include those listed in our Privacy Policy (for example Supabase, Vercel, Stripe, Resend, Expo, and map providers where used). We will impose data-protection obligations on subprocessors no less protective than this DPA in substance.

We will update the Privacy Policy (or notify you) when adding or replacing material subprocessors. You may object on reasonable data-protection grounds; if we cannot accommodate the objection, either party may terminate the affected service.

8. International transfers

Where Customer Personal Data is transferred outside the UK, Operator Labs shall ensure an appropriate transfer mechanism under UK data protection law (for example UK IDTA or adequacy). The primary database for FleetPro UK is hosted in London, United Kingdom; application hosting and some subprocessors may process data in other countries as described in the Privacy Policy.

9. Assistance with data subject rights

Taking into account the nature of processing, Operator Labs shall assist you by appropriate technical and organisational measures, insofar as possible, to respond to data subject requests under UK GDPR. Requests received by us that clearly relate to your role as controller will be referred to you without undue delay, and we will not respond as controller unless legally required.

10. Breach notification

Operator Labs shall notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and provide information reasonably available to help you meet your notification obligations. Our internal handling steps are summarised in the Information Handling Procedure.

11. Deletion and return

On termination of the service, at your choice Operator Labs shall delete or return Customer Personal Data, and delete existing copies, unless UK law requires storage. Standard retention behaviours in the product (for example DVLA licence-check records retained for 12 months from check date, DVLA enquiry audit rows retained for 24 months, or driver/vehicle retention windows) apply unless you instruct otherwise in writing and the instruction is technically feasible.

12. Audits and information

Operator Labs shall make available information necessary to demonstrate compliance with Article 28, and allow audits by you or an agreed auditor, on reasonable notice, during business hours, no more than once per year (unless required by a competent authority or following a personal data breach), subject to confidentiality and without compromising other customers' security. Remote questionnaires and existing security documentation will be preferred where sufficient.

13. Controller warranties

You warrant that:

  • You have a lawful basis (and any required Article 9 / criminal-offence conditions) for the processing you instruct.
  • You have provided required privacy information to data subjects.
  • Instructions you give us will not cause us to breach UK data protection law.

14. Liability

Liability under this DPA is subject to the limitations and exclusions in the Terms of Service, except that nothing limits either party's liability where UK law does not allow limitation for data-protection obligations.

15. Order of precedence

If there is a conflict between this DPA and other terms relating to processing of Customer Personal Data, this DPA prevails for that subject matter.

16. Governing law

This DPA is governed by the laws of England and Wales.

17. Contact

Data-protection enquiries and DPO contact (Rhys Hughes): support@fleetprouk.co.uk.

Operator Labs Ltd maintains a record of processing activities and a data protection impact assessment for FleetPro UK. Copies are available to customers or the ICO on request.