This Data Processing Agreement ("DPA") forms part of the agreement for TransComp between Pay To Tech Ltd, trading as TransComp ("TransComp", "we", "us" or "Processor") and the business customer using the Service ("Customer" or "Controller").
It applies where the Customer is a controller and TransComp processes personal data on the Customer's documented instructions in providing the Service. If the Customer is itself a processor for another controller, the Customer confirms that it is authorised to appoint TransComp as a sub-processor and will meet the corresponding obligations.
1. Definitions and Scope
"Data Protection Law" means applicable UK data-protection law, including the UK GDPR and the Data Protection Act 2018. Terms such as controller, processor, personal data, data subject, personal data breach and processing have the meanings given in Data Protection Law.
The Customer determines why and how it uses TransComp to manage its drivers, employees, vehicles, compliance tasks, documents and associated records. TransComp processes Customer Personal Data only to provide, secure, support and improve the Service in accordance with this DPA, the Customer agreement and documented lawful instructions from the Customer, unless required by law.
2. Processor Obligations
TransComp will:
- Process Customer Personal Data only on the Customer's documented instructions, unless UK law requires otherwise.
- Ensure that people authorised to process Customer Personal Data are bound by confidentiality obligations.
- Implement appropriate technical and organisational measures, taking account of the nature of the processing and the risks involved.
- Not sell Customer Personal Data or use it for TransComp's own unrelated marketing.
- Notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, and provide reasonable information and assistance available to us.
- Provide reasonable assistance, taking account of the nature of processing, with data-subject requests, data-protection impact assessments, prior consultation and security enquiries.
- Make information reasonably necessary to demonstrate compliance with this DPA available to the Customer, subject to confidentiality, security and reasonable notice requirements.
3. Customer Obligations
The Customer will:
- Ensure it has a lawful basis and provides appropriate privacy information for Customer Personal Data entered into the Service.
- Keep its user accounts, permissions and instructions accurate and secure.
- Respond to data-subject requests and determine whether a request should be actioned.
- Not instruct TransComp to process Customer Personal Data in a way that breaches Data Protection Law.
4. Sub-processors
The Customer authorises TransComp to use sub-processors where reasonably necessary to provide the Service, such as managed hosting, database, email, notification, payment and support providers.
TransComp will impose written data-protection obligations on sub-processors that are materially no less protective than those in this DPA. We will provide available information about material sub-processors on reasonable request. Where a proposed material change to a sub-processor would materially affect Customer Personal Data, the Customer may raise a reasonable data-protection objection; the parties will work in good faith to find a practical solution.
5. International Transfers
TransComp will not transfer Customer Personal Data outside the United Kingdom except where permitted by Data Protection Law and subject to an appropriate transfer mechanism or safeguard where required.
6. Return and Deletion
The Customer should export its operational data within 15 days after cancellation or termination. After that period, TransComp may delete or irreversibly anonymise Customer Personal Data, except to the extent retention is required or permitted by law, necessary for a legal claim, or retained temporarily in backups until they are overwritten through the normal backup-rotation process.
7. Audits
Where reasonably necessary to demonstrate compliance with this DPA, the Customer may request relevant information or an audit no more than once in any 12-month period, on at least 30 days' written notice, during normal business hours and at the Customer's cost. Any audit must protect the security, confidentiality and continuity of the Service and must not give access to another customer's information.
8. Processing Details
| Subject | Details |
|---|---|
| Duration | For the Customer agreement and the limited post-termination period described in section 6. |
| Nature and purpose | Hosting, storing, organising, displaying, supporting and securing transport-compliance and fleet-management records, and providing notifications and reports. |
| Categories of data subjects | Customer users, Transport Managers, operators, drivers, employees, contacts and other individuals whose information the Customer chooses to enter. |
| Categories of personal data | Account and contact details, role and employment-related details, driver-licence and CPC information, tachograph and working-time data, vehicle and compliance records, inspection/defect information, documents, notes and audit activity. |
| Processing operations | Collection from the Customer, storage, retrieval, consultation, organisation, reporting, transmission to authorised users or service providers, backup and deletion/anonymisation. |
9. Contact
Pay To Tech Ltd
Company number: 16050393
Registered address: 407 Manchester Road, M43 6QF, United Kingdom
Data-protection contact: info@transcomp.co
Last updated: 27 Sep 2026