This agreement applies where Operator Vault processes personal data on your behalf. It forms part of the Terms of Service — accepting the terms accepts this agreement, so no separate acceptance is required.
1. Roles
You are the controller of personal data about your drivers, staff, contacts and passengers. Operator Vault is the processor of that data.
2. Subject matter and duration
Processing continues for as long as your account is active, plus any agreed export and deletion window.
The subject matter is the provision of transport compliance record-keeping, reminders and reporting.
3. Nature and purpose of processing
Storage, organisation, retrieval, structuring, reminder generation, document classification and extraction, reporting and deletion of the records you enter.
4. Categories of data and data subjects
Data subjects: drivers, transport managers, other staff, maintenance providers and, for PSV operators, passengers named in incident reports.
Data categories: names, contact details, licence, CPC and medical expiry information, DBS check details, training records, working time and infringement records, and incident details.
5. Our obligations
We process personal data only on your documented instructions, ensure staff with access are bound by confidentiality, and apply appropriate technical and organisational security measures.
We assist you with data subject requests, security incidents, impact assessments and consultations with the ICO, so far as reasonably practical.
We notify you without undue delay after becoming aware of a personal data breach affecting your data.
6. Sub-processors
We use sub-processors for hosting, database, email delivery and document/AI processing. Each is bound by equivalent obligations. We will inform you of intended changes and give you the opportunity to object.
7. International transfers
Where personal data is transferred outside the UK, we rely on adequacy regulations or approved standard contractual clauses with the UK addendum.
8. Deletion and return
On termination we make your records available for export, then delete or return them, unless we are required by law to retain them.
9. Audit
We make available the information reasonably necessary to demonstrate compliance with this agreement and allow for audits on reasonable notice.