Legal

Data Processing Agreement

Last updated: 1 April 2026

1. Parties

2. Subject Matter and Duration

This DPA governs the processing of personal data by Garage Desk Ltd (as processor) on behalf of the subscribing garage (as controller) for the purpose of providing the GarageDesk service.

This DPA runs for the duration of the subscription and terminates when the subscription ends, subject to the data deletion obligations set out in Section 12.

3. Nature and Purpose of Processing

The processing carried out by Garage Desk Ltd under this DPA includes:

• Receiving and storing inbound WhatsApp messages from members of the public contacting the garage
• Using AI (Claude by Anthropic) to engage in automated conversation to collect enquiry details
• Performing automated vehicle registration lookups via the DVLA Vehicle Enquiry Service API
• Generating indicative AI diagnoses based on described symptoms
• Storing enquiry data in a secure database for display in the garage’s dashboard
• Enabling garage staff to view, respond to, and manage enquiries via the dashboard
• Sending outbound WhatsApp messages to customers on the garage’s behalf

4. Types of Personal Data

The personal data processed under this DPA comprises:

No special category data (as defined in Article 9 UK GDPR) is intended to be processed. Subscribers must not use the service to collect health, financial, or other special category data from their customers.

5. Data Subjects

The data subjects are members of the public who contact the subscribing garage via WhatsApp, including:

• Individuals who message the garage’s WhatsApp number directly
• Individuals who submit their phone number via the garage’s website enquiry widget
• Individuals who called the garage and were followed up by GarageDesk after a missed call

6. Processor Obligations (Article 28 UK GDPR)

Garage Desk Ltd, as the data processor, shall:

7. Sub-Processors

The controller provides general written authorisation for Garage Desk Ltd to engage the following sub-processors. Garage Desk Ltd will ensure each sub-processor is bound by a written agreement containing equivalent data protection obligations:

We will notify the controller of any intended changes to sub-processors (additions or replacements) at least 14 days in advance by email, giving the controller the opportunity to object. If the controller objects in writing within 14 days and we cannot reasonably accommodate the objection, either party may terminate the subscription with immediate effect and we will refund a pro-rata portion of any prepaid fees.

8. Data Breach Notification

In the event of a personal data breach involving data processed under this DPA, Garage Desk Ltd shall notify the controller without undue delay and no later than 24 hours of becoming aware of the breach.

The notification will include, as far as is possible:

• A description of the nature of the breach, including where possible the categories and approximate number of data subjects and personal data records affected
• The name and contact details of our data protection contact
• A description of the likely consequences of the breach
• A description of the measures taken or proposed to address the breach

The controller is responsible for determining whether to report the breach to the ICO (within 72 hours of the controller becoming aware) and/or to notify affected data subjects. Garage Desk Ltd will provide all reasonable assistance with the controller’s investigation and response.

9. Data Subject Rights Assistance

Where Garage Desk Ltd receives a request directly from a data subject in relation to data processed on the controller’s behalf, we will:

• Promptly forward the request to the controller (within 2 business days)
• Not respond to the data subject without the controller’s instruction
• Provide the controller with all information and assistance needed to respond within the statutory timeframe

Garage Desk Ltd will provide assistance with data subject rights requests within 15 calendar days of a request from the controller.

10. Security Measures

Garage Desk Ltd implements the following technical and organisational security measures:

• Encryption of all data in transit using TLS 1.2 or higher
• Database encryption at rest
• Role-based access controls — dashboard data is accessible only to the subscribing garage’s authorised users
• Multi-factor authentication for administrative access
• Regular security reviews and vulnerability assessments
• Staff confidentiality obligations and data protection training

11. International Transfers

Where personal data is transferred outside the UK to sub-processors (Twilio, Anthropic), such transfers are governed by International Data Transfer Agreements (IDTAs) or equivalent Standard Contractual Clauses as approved by the ICO, providing appropriate safeguards in accordance with Chapter V UK GDPR.

Supabase stores data within the EU under an EU-hosted configuration and no transfer outside the EU/UK occurs for database storage.

12. Deletion on Termination

On termination of the subscription (for any reason), Garage Desk Ltd shall, at the controller’s election:

• Delete all personal data processed on the controller’s behalf within 30 days of the termination date; or
• Return the data to the controller in a structured, machine-readable format (CSV) within 30 days, following which we will delete all copies.

The controller must submit their election (deletion or return) within 14 days of the termination date. If no election is made, we will delete the data. We will provide written confirmation of deletion on request.

We may retain data beyond 30 days where required to do so by applicable law, in which case we will notify the controller and restrict processing of that data to the minimum required.

13. Controller Obligations

The controller (subscribing garage) acknowledges and agrees to:

• Having a lawful basis under UK GDPR for processing end-customer personal data via GarageDesk
• Maintaining an accessible privacy policy that informs customers about the use of WhatsApp, AI, and GarageDesk’s sub-processors
• Ensuring staff who access the GarageDesk dashboard are authorised to do so
• Not instructing Garage Desk Ltd to process personal data in a manner that would infringe UK GDPR or any applicable law
• Promptly notifying Garage Desk Ltd of any changes to the controller’s instructions that may affect processing

14. Governing Law

This DPA is governed by the laws of England and Wales. Any disputes arising from this DPA shall be subject to the exclusive jurisdiction of the courts of England and Wales.

15. Contact

For questions about this DPA or to exercise your rights under it, contact: