Skip to content

Data Processing Agreement

DV-DPA-001 · Version 1.4 · Effective

1. Parties and purpose

This Data Processing Agreement (DPA) forms part of the agreement between Axholme ETM Ltd trading as DV Check ("DV Check") and the customer organisation identified in the account ("Customer"). It applies where DV Check processes personal data on behalf of the Customer as processor, including driver record data obtained from the DVLA Access to Driver Data (ADD) service ("DVLA Data").

DV Check is a contracted customer of the DVLA ADD service under an agreement with the Secretary of State for Transport acting through the DVLA (the "ADD Agreement"). The ADD Agreement requires this DPA to contain the terms set out in Schedule D. If anything in this DPA conflicts with the ADD Agreement, the ADD Agreement prevails.

2. Roles

The Customer is the controller of driver personal data, including DVLA Data from the point DV Check receives it. DV Check is the Customer's processor and acts as an intermediary under the Processor Model described in the ADD Agreement. In DVLA's terms the Customer is a Third-Party Customer.

DV Check is an independent controller of account, user, billing and support data, and of the records it must keep to show the DVLA that it has complied with the ADD Agreement. This DPA does not cover that processing; the Privacy Policy does.

The Customer decides the purposes of each check. DV Check provides default settings for check frequency, risk thresholds and retention; the Customer can change them in its account, and the settings in force are the Customer's documented instructions.

3. Processing instructions

DV Check will process personal data only on the Customer's documented instructions, which are this DPA, Schedule A, the Customer's account settings and each check the Customer requests, unless the law requires otherwise. DV Check will tell the Customer if it believes an instruction breaks data protection law, unless the law prevents it.

The Customer remains responsible as controller for its lawful basis, its privacy information to drivers, the declarations required by Schedule E, responding to data subject requests, and its other obligations under data protection law.

4. Permitted use of DVLA Data

DVLA Data may be requested and used only to check a driver's entitlement to drive, endorsements and disqualifications for a legitimate business need, for a person who drives in connection with the Customer's business (the "Permitted Purpose").

The Customer must not use, or ask DV Check to use, DVLA Data:

  • for identity checking of any kind;
  • to offer value-added services to a driver, or for marketing;
  • to check the record of the person making the request, or of any user's own licence (users must not view their own record);
  • for any purpose unconnected with the original enquiry, or by selling, transferring or making it available to anyone other than as this DPA allows.

The Customer must hold a valid declaration for a driver before requesting a check on them (Schedule E). DV Check will refuse a check where no valid declaration is held.

5. Confidentiality and personnel

DV Check will ensure people authorised to process Customer personal data are bound by confidentiality and trained in data protection and security. The Customer must ensure the same of its own users, give access only to people with a Permitted Purpose, and maintain appropriate vetting, training and disciplinary arrangements for them.

6. Security

Each party will keep appropriate technical and organisational measures in place under Article 32 UK GDPR and clause D2 of the ADD Agreement, taking account of the state of the art, the cost, the nature and purposes of the processing and the risks to individuals.

DV Check's measures include: encrypting DVLA Data and declarations in transit and at rest, with driving licence numbers additionally encrypted at field level; limiting access to authenticated users of the Customer's organisation, enforced in the database; two-step sign-in; an audit record of every check naming the person who requested it; submitting ADD enquiries one at a time, as the ADD Agreement requires; scanning the systems that connect to the ADD service for vulnerabilities at least annually; keeping backups in the United Kingdom; and incident response.

The Customer must keep its users' sign-in details secure, remove access promptly when a user leaves, and co-operate with any reasonable security requirement DV Check or the DVLA notifies to it.

7. Sub-processors

The Customer gives general authorisation for DV Check to use the sub-processors listed in Schedule C. DV Check will have a written contract with each one that imposes data protection obligations equivalent to this DPA and meets Articles 28 and 29 UK GDPR, and remains liable to the Customer for their performance.

DVLA Data is disclosed to a sub-processor only where the ADD Agreement permits it, including any DVLA approval it requires. DV Check will give the Customer reasonable prior notice of any new or replacement sub-processor, and the Customer may object on reasonable data protection grounds.

8. Location of data and overseas access

DVLA Data must not be transferred outside the United Kingdom, or accessed from outside the United Kingdom, without the DVLA's prior written approval. This applies to DV Check, its sub-processors and the Customer, and includes backup and disaster-recovery copies, support access and Customer users signing in from abroad.

Other Customer personal data (for example a driver's name and email address in a consent request) may be processed outside the United Kingdom only by a sub-processor listed in Schedule C and only with an appropriate safeguard under UK data protection law, such as adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

9. Incidents and notices

DV Check will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer personal data, with the information the Customer reasonably needs to meet its own obligations, updated as the investigation progresses.

The Customer must notify DV Check immediately, and in any case within 24 hours of becoming aware, of the events listed in Schedule F, so that DV Check can meet its own notification duties to the DVLA. Where the Customer is the controller of affected data, the Customer is responsible for notifying the Information Commissioner and data subjects as data protection law requires.

10. Data subject rights

The Customer, as controller, answers requests from drivers about checks made on its behalf. DV Check will give reasonable assistance and will pass on any such request it receives without answering it, unless the Customer authorises it to or the law requires it.

A request about the DVLA's own processing as controller (for example the content of the driver record) must be directed to the DVLA. Where the DVLA notifies DV Check that a driver has restricted processing of their record, DV Check will stop enquiries on that record immediately and tell the Customer.

Where the Customer decides to fulfil a request to erase a declaration, evidence of that request is kept, as the ADD Agreement requires (Schedule E).

11. Incorrect or mismatched results

Before relying on a result, the Customer must check that it relates to the driver it asked about and holds a declaration for. A result that does not match that driver must be disregarded and deleted from all systems and reported to DV Check, which will contact the DVLA. DV Check discards a result that fails its own matching checks and does not store it.

12. Retention and deletion

Retention is as set out in Schedule E. In summary: DVLA Data is kept only as long as necessary for the Permitted Purpose, for the period the Customer sets in its account, then deleted; declarations and the audit record of each check are kept for at least two years, as the ADD Agreement requires.

When the services end, DV Check will delete or return Customer personal data at the Customer's choice, except records the ADD Agreement or the law requires it to keep, which it will keep securely and delete at the end of the required period. Secure backups are deleted on their normal cycle and are not used in the meantime.

13. Audits, inspections and assistance

DV Check will make available the information reasonably needed to show that it meets its processor obligations, will allow and contribute to proportionate audits on reasonable notice, and will help with DPIAs and prior consultation, taking account of the information available to it.

The Customer agrees to the audits by DV Check and the DVLA co-operation obligations in Schedule F.

14. Suspension and termination

DV Check may suspend or restrict the Customer's access to checks, without notice where necessary, if:

  • a declaration is missing, expired or otherwise invalid, or the Customer's authority to request checks cannot be shown;
  • DVLA Data is, or is reasonably suspected of being, misused or used outside the Permitted Purpose;
  • the Customer breaches this DPA or fails to co-operate with an audit, investigation or inspection;
  • the DVLA suspends, withdraws or terminates DV Check's access to the ADD service, or forbids access by the Customer or any of its users.

During a suspension the Customer must not process or transfer DVLA Data it received before the suspension. After suspension or termination the Customer must keep complying with this DPA for any DVLA Data it still holds, including its proper use, retention and secure destruction, and must not use it further once the services or DV Check's ADD access have ended.

Schedule A: Processing details

  • Subject matter: driving licence checks through the DVLA ADD service, and the records needed to manage them.
  • Duration: for the term of the services, plus the retention periods in Schedule E.
  • Purpose: the Permitted Purpose in clause 4; managing drivers, declarations and check results; supporting the Customer.
  • Processing activities: collecting driver details and declarations; reading and keeping photos of the driver's licence and, where the role needs them, Driver CPC and tachograph cards; sending consent requests; submitting enquiries to the DVLA one at a time; receiving, storing, displaying and summarising results; scheduling re-checks; logging; support; deletion.
  • Data subjects: the Customer's drivers, and the Customer's users.
  • Personal data: driver name, date of birth, address, email and phone number; driving licence number; photos of the driver's licence, Driver CPC card and tachograph card; the declaration and its record of acceptance; DVLA Data, which is personal details, entitlements and restriction codes, endorsements, penalty points and disqualifications, and where applicable photocard, CPC and tachograph card details; audit records.
  • Special category and criminal offence data: restriction codes can reveal health information (special category data), and endorsements and disqualifications are criminal offence data. DVLA releases special category data under Article 9(2)(g) UK GDPR. The Customer must have its own lawful basis, and where applicable its own Article 9 condition and DPA 2018 Schedule 1 condition, for using them.
  • Documented instructions: this DPA, the Customer's account settings (check frequency, risk thresholds and retention period) and each check the Customer requests.

Schedule B: Electronic acceptance

This DPA is accepted electronically, at signup and again whenever a new version is published. Each acceptance records the Customer organisation (with its registered company name and number as entered in the account), the person accepting on its behalf, the version of this DPA accepted and the date and time. Records are append-only and are kept for at least as long as this DPA applies and two years after. That record stands in place of a signature, and the person accepting confirms they have authority to bind the Customer.

Schedule C: Sub-processors

  • Supabase: database and authentication. Holds DVLA Data, including backups. Hosted in London (AWS eu-west-2).
  • Vercel: application hosting. Processes DVLA Data when it is displayed. Application servers run in London.
  • Resend: sends service emails, including consent requests to drivers. Receives driver name and email address, never DVLA Data. Emails are sent from Ireland; account data, email metadata and logs are stored in the United States. Transfers rely on the UK Extension to the EU-U.S. Data Privacy Framework, with the UK Addendum to the EU Standard Contractual Clauses in Resend's DPA.
  • Cloudflare: DNS and bot protection on sign-in and sign-up forms. Sees the browser details of people using those forms; site traffic does not pass through it, and it never receives DVLA Data. Cloudflare, Inc. processes this on its global network, including in the United States. Transfers rely on the UK Extension to the EU-U.S. Data Privacy Framework, with the UK Addendum in Cloudflare's DPA as the fallback.
  • Stripe: card payments for credit purchases. Handles account billing details only, never driver data. Stripe Payments UK Ltd provides the payment service; data is also processed by Stripe, LLC in the United States under the UK Extension to the EU-U.S. Data Privacy Framework, with the UK Addendum in Stripe's Data Transfers Addendum as the fallback.
  • Purelymail: our support mailbox. Not used to hold DVLA Data; please do not email driver records to support. Operated by Add Rabbit LLC (United States) on Amazon Web Services.
  • Anthropic: reads card photos taken at consent, to extract the driver's name, date of birth and licence number and to confirm each photo shows the right card. Receives the photos, never DVLA Data. Anthropic, PBC processes them in the United States; transfers rely on the UK Addendum to the EU Standard Contractual Clauses in Anthropic's DPA.

None of the suppliers above other than Supabase and Vercel receives DVLA Data, so clause 8's first paragraph does not apply to them.

Schedule D: DVLA ADD mandatory terms

The ADD Agreement (Schedule 2, clause 4) requires the following terms in this DPA. Each applies to the Customer as it applies to DV Check, except that where the ADD Agreement requires DV Check to notify, ask permission of, share information with or co-operate with the DVLA, the Customer must instead do so with DV Check.

Legal basis and purpose (B1, B2, B3)

  • DVLA releases data as necessary for a task in the public interest or in the exercise of its official authority; special category data under Article 9(2)(g). Drivers are told of this through the declaration.
  • The Customer must use DVLA Data only for the Permitted Purpose (clause 4), must not use it for identity checking or value-added services, must hold a signed declaration before each enquiry, must not let staff view their own record, and must tell DV Check of any change in its business need or processes that affects how checks are used.
  • The Customer must be registered with the Information Commissioner, and with HMRC and Companies House where applicable, and comply with data protection law.

Key staff (C1)

  • The Customer must give DV Check the names and contact details of the people responsible for its use of DVLA Data, and tell DV Check immediately of any change.

Statutory obligations and publicity (Part F, G2)

  • The Customer must not offer inducements to the DVLA or anyone acting for it; must take reasonable steps to prevent fraud and tell DV Check immediately if it suspects fraud; must not unlawfully discriminate; and must comply with health and safety law.
  • The Customer must tell DV Check immediately of anything that could bring publicity reflecting badly on the DVLA or the ADD service.
  • The Customer must not state or imply that the DVLA endorses, licenses, partners with or has a direct connection with it, that it has a direct link into or feed from the DVLA's database, or that its services are provided on the DVLA's behalf. It may say only that driver record data is sourced from the DVLA's Access to Driver Data (ADD) service through DV Check. Any other wording needs prior written DVLA approval, obtained through DV Check.

Transfer, insolvency and change of control (H1.1, H1.2, H2, H3)

  • The Customer must not assign or sub-contract its rights under this DPA, or let anyone else use the service on its behalf, without DV Check's prior written approval, and remains responsible for anyone it does sub-contract to.
  • The Customer must tell DV Check immediately in writing of any insolvency event (including a voluntary arrangement, winding-up resolution or petition, administration or receivership), and must seek DV Check's prior written approval to any change of control.

Suspension and termination (J2-J7.1)

  • The DVLA may terminate the ADD Agreement for material breach or under its other termination rights, and may suspend DV Check's access to the ADD service, including on a Customer's default, insolvency or cyber security incident. Checks for the Customer then stop.
  • During any suspension the Customer must co-operate with any investigation, audit or review the DVLA requires, and must not process or transfer DVLA Data received before the suspension.
  • After suspension or termination the Customer must keep complying with its obligations for DVLA Data it holds, including proper use, retention and secure destruction.

Accuracy (B6.2)

  • The DVLA cannot warrant the accuracy of its data. Results that do not relate to a driver for whom the Customer holds a declaration must be disregarded and deleted (clause 11).

Reviews and meetings (C2)

  • On reasonable notice the Customer must attend meetings and give DV Check the reports and information it reasonably needs about the Customer's requests for and use of DVLA Data, including its security, retention and destruction arrangements, audits, incidents and staff training.

Data protection (Part D and Schedule 2 clauses 1-3)

  • Both parties must comply with data protection law and ICO guidance. The Customer is the controller of DVLA Data it receives and is responsible for its compliance; it answers data subject requests about its own processing and directs requests about the DVLA's processing to the DVLA.
  • Security (D2, other than the reference to HM Government Security Policy Framework): appropriate protective measures; notify DV Check within 24 hours of any security default or any cyber security incident, whether or not it affects DVLA Data; and do not make DVLA Data available to third parties unconnected with the enquiry.
  • Up-to-date anti-virus protection, and co-operation if malicious software is found (D3).
  • No transfer of, or access to, DVLA Data outside the United Kingdom without prior written DVLA approval, including backup and disaster-recovery sites (D4, clause 8).
  • Confidentiality: DVLA Data is disclosed only to the Customer, to processors under a written contract with equivalent terms, with prior written DVLA approval, or where the law requires (Schedule 2, clause 3).
  • Retention and destruction (D6): keep DVLA Data only as long as necessary, destroy it securely when no longer needed, keep declarations for at least two years from each enquiry, and produce retained records, including mismatched enquiries, when required.
  • Vetting and disciplinary policies, and internal compliance checks at least annually (D7, D8).
  • Audits (D9.2), data loss events (D10.1), DVLA inspection (D11.2, D11.6(c)) and complaints (D12): as set out in Schedule F.
  • Declarations: as set out in Schedule E (ADD Agreement Schedule 4).

Schedule E: Declarations and retention

Declarations

  • A check may be made only on a driver who has given a declaration that is valid on the date of the check. DV Check collects it electronically from the driver on the Customer's behalf. A declaration made for another intermediary is not valid and must not be used.
  • The declaration must present to the driver, and record that they read: the registered company names of DV Check (Axholme ETM Ltd) and of the Customer; the purpose of the checks, and whether CPC or tachograph information is required; the driver's surname, first name, date of birth, address and driver number; and DVLA's fair processing wording.
  • A declaration is valid for at most three years from the date it was given, and ends earlier when the driver stops driving for the Customer. The Customer must archive a driver in its account as soon as they stop driving for it, and must not request further checks on them under that declaration. A new declaration is needed after expiry, if the registered company name of DV Check or the Customer changes or either is restructured, or if the DVLA changes the required wording.
  • Declarations are encrypted in transit and at rest, kept so that the declaration behind any check can be found quickly, and accessible only to authenticated users with a Permitted Purpose. The Customer must tell DV Check immediately of any change to its registered company name or structure.
  • If a driver tells the Customer that their details must not be processed further, the Customer must stop requesting checks, archive the driver and confirm this to the driver in writing.

Retention

  • DVLA Data (the check result): kept for the retention period the Customer sets in its account (from 7 to 365 days after the driver is archived; 30 days unless changed), then deleted. The Customer, as controller, decides and justifies the period.
  • Declarations: kept for at least two years from the date of the last check made under them, however long they were valid for.
  • Audit record of each check (who requested it, when, for which driver and under which declaration): kept for two years, separately from the result, so it survives deletion of the result.
  • Card photos: destroyed with the DVLA Data for that driver, or at once when an erasure request is fulfilled, leaving a record of when. Photos from a declaration that is never completed are deleted after 24 hours.
  • Evidence of a fulfilled request to erase a declaration: kept, as the ADD Agreement requires.
  • These minimum periods continue after the services end and after any deletion request.

Schedule F: Audits, incident reports and regulatory co-operation

Audits by DV Check

  • DV Check must audit every Customer at least once in the first calendar year it acts for them, and annually after that. The Customer must co-operate, including by answering questionnaires and providing evidence of its declarations, access controls, retention and use of DVLA Data within a reasonable time.
  • DV Check keeps the audit evidence and may give it to the DVLA, and must report to the DVLA any default by the Customer it discovers, on audit or otherwise.

What the Customer must report to DV Check

Immediately, and in any case within 24 hours of becoming aware:

  • any personal data breach or other data loss event involving DVLA Data;
  • any cyber security incident, whether or not it affects DVLA Data, and any breach of the security requirements of this DPA;
  • any suspected misuse of DVLA Data or of the service, or suspected fraud;
  • any audit by the Information Commissioner, or other check, audit or review, relevant to its processing of DVLA Data, and its outcome;
  • any breach of this DPA, any circumstances that could bring adverse publicity on the DVLA or the ADD service, and any security concern.

DVLA inspection and complaints

  • The DVLA, or an agent acting for it, may inspect compliance at any time, usually on seven days' notice through DV Check, and in exceptional circumstances (such as a suspected serious breach) may need access to the Customer's premises. The Customer must co-operate fully, give access to relevant premises, equipment, evidence and staff, and act on the findings.
  • The DVLA may forbid access to DVLA Data by any of the Customer's users, or in exceptional circumstances by the Customer, and its decision is final. DV Check will give effect to it immediately.
  • If the DVLA investigates a complaint about the Customer's use of DVLA Data, the Customer must provide the information the DVLA reasonably requires, through DV Check.

See also our Privacy Policy and how driver data is protected.