Data Processing Agreement

We’re finalising this agreement with our solicitors. Questions in the meantime: [email protected].

This Data Processing Agreement (“DPA”) forms part of the agreement between MissionDuty (“Processor,” “MissionDuty”) and the Customer identified in that agreement (“Controller”), and applies whenever MissionDuty processes personal data on the Controller’s behalf via the MissionDuty platform.

1. Subject matter & duration

MissionDuty processes personal data entered into the platform by or on behalf of the Controller for the duration of the Controller’s subscription, plus the post-termination retention/export period set out in our Terms of Service.

2. Nature & purpose of processing

Storage, retrieval, and display of fleet, driver, and workshop records to provide the MissionDuty service as configured by the Controller — including compliance tracking, workshop job management, stock control, AI-assisted search and reporting (where the Controller enables them), and AI-assisted support (see Section 6).

3. Categories of data subjects

• The Controller’s employees and users of the MissionDuty platform (administrators, technicians).
• The Controller’s drivers.
• Where relevant, third parties named in incident, defect, or compliance records (e.g. a member of the public involved in a recorded incident).

4. Categories of personal data

• Identity & contact data — name, payroll number, licence details.
• Employment/role data — depot, team, training and CPC records, incident history.
• Special category data — driver medical records (D4 medical, eyesight certification) where the Controller chooses to record these.
• Location data — vehicle/journey positions.
• Images — defect, incident, and document photographs; job-card sign-off signatures.
• Account data — login email, hashed password, passkey public keys and device labels, hashed backup codes, sign-in status.
• Driver declarations and working time — fit-to-drive declarations, driving and other work periods, and tachograph data where connected.
• Licence check history — the dates each driver’s licence was checked.
• Procurement mailbox data — where a user connects their mailbox, the sender, subject, date, short preview and attachment list of supplier replies carrying a request reference.
• Security logs — sign-in and security events with IP address and browser details.

5. Processor obligations

MissionDuty will:

• Process personal data only on the Controller’s documented instructions (including via the Controller’s own configuration of the platform), unless required to do otherwise by law.
• Ensure personnel with access to personal data are subject to confidentiality obligations.
• Implement appropriate technical and organisational security measures — see Section 7.
• Not engage a sub-processor without the Controller’s prior general authorisation (given by this DPA for the sub-processors listed in Section 6), and will give at least 30 days’ notice of any new sub-processor, during which the Controller may object on reasonable grounds.
• Impose on each sub-processor, by written contract, data protection obligations no less protective than those in this DPA, and remain liable to the Controller for each sub-processor’s performance of them.
• Tell the Controller straight away if, in MissionDuty’s opinion, an instruction would break UK data protection law.
• Assist the Controller in responding to data subject rights requests, insofar as this is possible given the nature of processing.
• Assist the Controller in meeting its UK GDPR obligations around security, breach notification, and data protection impact assessments, taking into account the information available to MissionDuty.
• Notify the Controller without undue delay — and in any case within 48 hours of becoming aware — of any personal data breach affecting the Controller’s data.
• At the end of the engagement, return the personal data by letting the Controller download all of it for 30 days, then delete it and existing copies, subject to any legal requirement to retain it. Copies in backups are deleted as those backups expire, within 35 days, and are never restored for the Controller in the meantime.
• Make available information reasonably necessary to demonstrate compliance with this DPA, and allow for audits (including inspections) conducted by the Controller or an auditor it mandates, on reasonable notice.

6. Sub-processors

The Controller authorises MissionDuty to engage the following sub-processors:

• DigitalOcean — web application, API and database hosting, file storage and backups, in the region the Controller chose at signup (London, United Kingdom, for UK customers). Web traffic passes through DigitalOcean’s content delivery network. DigitalOcean’s own sub-processors are listed in its data processing agreement.
• Anthropic — AI processing. Based in the United States; see Section 8.
  • Using the Controller’s own API key, only where the Controller has added one: “Ask MissionDuty” search, reading vehicle documents and supplier quotations, and the AI fleet admin (unless the Controller has chosen OpenAI for it).
  • Using MissionDuty’s account, for every Controller: the in-app support assistant (what a user types into it), first responses to support requests (the request’s text), matching new feature requests against the shared roadmap, and Claude-assisted review of support and feature requests. The privacy policy lists what each sends.
  • To check the AI features work well, MissionDuty keeps a record of each AI answer (which feature, timing, outcome, usage and the user’s feedback). Text is kept only for features on MissionDuty’s account, with personal details removed, for 90 days; never for anything run on the Controller’s own key.
• OpenAI — AI processing for the AI fleet admin, only where the Controller has added its own OpenAI API key and chosen it. Based in the United States; see Section 8.
• GoCardless — payment processing by Direct Debit (billing contact and payment data only, not fleet or driver data).
• Resend — sign-in, password reset, account and security emails to users, sent from mail.missionduty.co.uk through its European (Ireland) region. US-owned; see Section 8.
• HERE Technologies — journey route and timing planning: each journey’s stop locations and departure time, and for an HGV its size and weight. No names or driver details.

Not sub-processors of MissionDuty, but services the Controller’s users reach through it: map tiles and styles are loaded by the user’s browser from OpenFreeMap (built on OpenStreetMap data), which receives the browser’s IP address; and a connected mailbox is the Controller’s own Microsoft 365 or Google account, reached with the user’s permission.

7. Security measures

Technical and organisational measures currently in place include:

• Every sign-in needs more than a password. The Controller chooses, for its own users, one or more of: a passkey (WebAuthn) that requires the user’s fingerprint, face or device PIN; a password with a one-time code from an authenticator app; or the Controller’s own Microsoft Entra ID single sign-on, under the Controller’s Entra policies. A password alone never gives access.
• Passwords and authentication secrets stored using industry-standard hashing (bcrypt); integration credentials and authentication secrets encrypted at rest (AES-256-GCM). Passkeys are stored as public keys only; the private key never leaves the user’s device.
• Tenant data isolation — every request is scoped to the requesting organisation, and access to another Controller’s data is prevented by design and tested on every change.
• Role-based access control, so a Controller can restrict which of its own users can see or change which categories of data.
• Audit logging of data-changing actions, retained for accountability and incident investigation.
• Encrypted transport (TLS) for all data in transit.
• Rate limiting and standard HTTP security headers on the API.
• Uploaded files encrypted by MissionDuty with a separate key for each file before storage.
• Backups kept for 35 days in the Controller’s region; nightly backups encrypted to a key held offline and stored separately from the live system; a restore is tested every month.

8. International transfers

Personal data is hosted with sub-processors as listed in Section 6. Where a sub-processor (currently Anthropic and OpenAI) is based outside the UK, transfer is made under the safeguards in that sub-processor’s data processing terms, which MissionDuty is confirming with its solicitors and will name here.

9. Liability

Liability under this DPA is subject to the limitations set out in the Terms of Service.

10. Contact

Data protection queries: [email protected]
MissionDuty