Data processing terms

1. Roles

1.1 In these terms, "you" is the organisation that uses Trivet and "we" is Trent GECO Limited. They form part of our terms of service. Where they conflict on data protection, these terms win.

1.2 For the personal data you put into the app ("your data"), you are the controller and we are your processor. Words such as "personal data", "processing" and "personal data breach" mean what they mean in the UK GDPR.

1.3 You are responsible for having a lawful basis for what you record, for telling people about it, and for the accuracy of what you enter. For driving licence checks this includes a condition under the Data Protection Act 2018, Schedule 1.

2. The processing

3. Your instructions

3.1 We process your data only on your documented instructions. Your instructions are these terms and what you and your members do in the app: the records you make, the settings you choose and the features you turn on.

3.2 If the law requires us to process your data in another way, we will tell you first, unless the law forbids that.

3.3 We will tell you straight away if we think an instruction breaks data protection law.

4. Confidentiality

4.1 Everyone at our company who can access your data is bound to keep it confidential. Our team can only see it when one of your admins turns on support access, for a set time of up to 7 days that you can end at any time, or when we must, to keep the service running or to meet a legal duty.

5. Security

5.1 We keep in place measures appropriate to the risk, including:

• encryption in transit and at rest, with driving licence numbers and check results encrypted again under keys in Google Cloud’s key management service, rotated every 90 days;
• separation of each organisation’s data, with every read and write checked against the person’s membership and role, and denied by default;
• passwordless sign-in, bot protection, and a recent sign-in for sensitive actions such as revealing a licence number or deleting an organisation;
• an audit log of significant actions, kept 6 years;
• no names, email addresses, licence numbers or vehicle registrations in our application logs (the hosting platform’s request logs record IP addresses, kept 30 days);
• database backups every day (kept 14 days) and week (kept 8 weeks), with point-in-time recovery for 7 days, all in London;
• secrets kept in a secrets manager; changes reach the live service only through tested, approved releases.

5.2 We review these measures as the service changes, and won’t reduce the overall level of protection.

6. Sub-processors

6.1 You give us general authorisation to use the sub-processors on our sub-processor list.

6.2 Before we add or replace one, we will email your owner and admins at least 30 days ahead and update the list. If you object on reasonable data protection grounds, tell us within that time. We will try to address your concern; if we can’t, you can end the service before the change and we will refund any prepaid fees for the time left.

6.3 Each sub-processor is bound by a written contract with data protection obligations that give at least the protection in these terms. We remain responsible to you for what they do.

7. Transfers outside the UK

7.1 Your database, files and backups are stored in London. Where a sub-processor processes your data outside the UK, as shown on the list, we make sure a transfer safeguard recognised by UK law is in place, such as UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.

8. Helping with people’s requests

8.1 The app lets you find, correct, export and delete people’s data yourself, including an export of a single driver’s data and of everything your organisation holds.

8.2 If someone asks us directly about your data, we will pass the request to you without undue delay and won’t answer it ourselves unless you ask us to.

8.3 Where the tools aren’t enough, we will give you reasonable help to answer a request within the time the law allows.

9. Breaches, assessments and the regulator

9.1 If we become aware of a personal data breach affecting your data, we will tell your owner and admins without undue delay, and within 48 hours of becoming aware of it. We will give you what we know (what happened, the data and people affected, the likely consequences and what we are doing) and add to it as we learn more, so that you can decide whether to report it to the Information Commission (ICO) within the 72 hours the law allows you.

9.2 We will give you reasonable help with your security obligations, data protection impact assessments and any consultation with the regulator, taking into account what we know as your processor. For driving licence checks, the app includes starter templates for both.

10. When the service ends

10.1 Before the service ends you can export everything your organisation holds as a ZIP file of CSV lists and original documents. Each export is kept for 24 hours.

10.2 When your owner asks for the organisation to be deleted, or when the service ends for another reason, we delete your data 30 days later. It is gone from our backups within 8 weeks after that.

10.3 We keep a copy of the audit log, which holds account IDs and what happened but no names, for the rest of its 6 years, as our own record for security and in case of legal claims. We keep nothing else unless the law requires it.

11. Showing that we comply

11.1 We will give you the information you reasonably need to show that we meet these terms, including a written summary of our security measures and answers to a reasonable questionnaire once a year.

11.2 If that isn’t enough, or after a breach, or if the regulator requires it, you or an auditor you appoint may audit us, on at least 30 days’ notice, during working hours, under a confidentiality agreement and at your own cost. As we are a small company, we ask that this is no more than once a year unless there has been a breach.