Data processing agreement

This agreement governs how NEXLANE LTD ("we") processes personal data on behalf of the dealership that uses NextDMS ("you"). You are the controller and we are the processor within the meaning of Article 28 of the UK General Data Protection Regulation (UK GDPR).

The agreement is part of the terms of service and is accepted with them. It applies for as long as we process personal data for you. If the terms of service and this agreement conflict on a matter of data protection, this agreement prevails.

We process personal data to provide NextDMS to you under the terms of service: we store and organise the data you record, show it to your dealership's team members, produce documents from it, send emails on your behalf, collect signatures, pass adverts, enquiries and checks to and from the platforms and public bodies you connect, run your dealer website, read receipts and back up the data.

We use the data for our own purposes in two cases only. We produce anonymous statistics that identify no person and not your dealership. We also use uploaded receipts to improve our document reading, after obscuring the personal data in them. This happens on our own servers; the receipts are not passed to anyone outside our company. We are the controller for that processing.

You decide which personal data we process by what you record in NextDMS. Typically it is:

Contacts

Names, company, address, phone, email, date of birth, VAT number, bank details, internal notes and documents.

Sales and purchases

Sale orders, invoices, payments, VAT deposits with their deposit agreements, export evidence, part exchanges, seller declarations, handover records.

Vehicles

Registration, VIN, V5C reference, number of previous owners, photos and vehicle documents that name the keeper.

Test drives

Driver, driving licence number and expiry, time and mileage, plate, whether the driver was accompanied, insurance excess and condition notes.

Enquiries and leads

Contact details, messages, consent time, the vehicle enquired about, and for leads from Autotrader any part exchange, finance application and delivery details.

Signatures

Name, email address, signature image, time, IP address and browser of the signer.

Expenses and receipts

Suppliers with bank details, images of receipts.

Dealer website

Content, reviews with the reviewer's name, enquiries from visitors.

Imported records

Records you move into NextDMS from your previous system.

Identity documents

Copies of driving licences, passports and ID cards, where you upload them.

Activity

What your team members do in NextDMS, with the time.

The data subjects are your customers and prospective customers, sellers and suppliers, contacts at your business partners, test-drive drivers, signers, visitors and reviewers of your dealer website, and your team members.

You are responsible for the lawfulness of the processing, for informing the data subjects and for having a lawful basis for each processing operation.

You record driving licence details, and keep copies of driving licences, passports and ID cards, only where you have a lawful basis and only as far as you need them. You do not record penalty points, endorsements or other information about offences, nor health data or other special categories of personal data (Articles 9 and 10 UK GDPR), unless a law requires it. If you make or receive cash payments of £10,000 or more, you are a high value dealer under the Money Laundering Regulations 2017; registering with HMRC and keeping your due-diligence records are your duties.

We process the personal data only on your documented instructions. Your instructions are the terms of service, this agreement, your settings and actions in NextDMS, and instructions you give us by email. If we think an instruction infringes data protection law, we tell you and may suspend it until you confirm or change it.

If a law of the United Kingdom requires us to process the data in another way, we tell you before we do so, unless that law prohibits it.

Everyone at our company who works with your data is bound to confidentiality. We access your data only as far as running NextDMS, fixing faults, security or your request to our support requires.

We take the technical and organisational measures required by Article 32 UK GDPR, described in the section "Security measures". We may adapt them to the state of the art as long as the level of protection does not fall.

You authorise us to engage sub-processors. Those we engage are named in the "List of sub-processors". We bind each of them by contract to the same data protection obligations we owe you, and we remain liable to you for them as for ourselves.

We announce a new or replacement sub-processor at least 14 days in advance by email to your dealership's admins. You may object in writing within 14 days of the announcement on reasonable data protection grounds. If we cannot resolve the objection, either of us may terminate the contract with effect from the change.

Platforms, marketplaces and public bodies to which you send data through NextDMS, such as Autotrader, Cazoo, your previous system's provider, the DVLA, the DVSA, HMRC and the European Commission's VIES service, are not our sub-processors. They receive the data on your instructions and process it as controllers under their own terms.

We and our sub-processors transfer personal data outside the United Kingdom only where Chapter V UK GDPR allows it. The basis is stated under the "List of sub-processors".

If a data subject contacts us, we pass the request to you and do not answer it ourselves. NextDMS lets you view, correct, export and delete data. Where that is not enough, we help you.

We also help you with the security of processing, personal data breaches, data protection impact assessments and prior consultation of the Information Commission (Articles 32 to 36 UK GDPR), as far as our processing is concerned. We may charge at cost for help that goes beyond the functions of NextDMS and is not caused by our own failure.

If we become aware of a personal data breach affecting your data, we tell you without undue delay, with the information you need to report it to the Information Commission (Article 33(3) UK GDPR) as far as we have it. We take the steps needed to contain the harm.

While the contract runs, you delete data yourself in NextDMS.

When the contract ends, you receive your data under the section "Data export and switching" of the terms of service. We then delete all data of your dealership. It remains in our backups until they expire and is not used. You meet your own retention duties, such as for invoices and VAT records, with the export.

We give you the information you need to verify our compliance with this agreement. If that is not enough, you, or an auditor bound to confidentiality who is not our competitor, may audit us once a year on at least 30 days' notice during business hours. The audit is at your cost, including our time, unless it reveals a breach by us.

Towards data subjects, you and we are liable under Article 82 UK GDPR. Between you and us, the liability provisions of the terms of service apply.

NextDMS runs on our own servers in the United Kingdom or the European Union. We engage these sub-processors:

DigitalOcean, LLC, USA

Storage of photos, documents and other files. Location: United Kingdom or European Union.

Amazon Web Services EMEA SARL, Luxembourg

Storage of backups. Location: United Kingdom or European Union.

Cloudflare, Inc., USA

Delivery of the platform, hosting of dealer websites, spam protection for forms.

Resend, Inc., USA

Sending emails, such as signature requests and appointment reminders to your customers.

Transfers to the European Union rely on the United Kingdom's adequacy regulations. Transfers to the USA rely on the UK Extension to the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the International Data Transfer Addendum to the European Commission's standard contractual clauses.

Premises

Only authorised people have access to the rooms that house our servers.

Sign-in

Personal accounts with passwords; passwords stored only in a form that cannot be reversed; limited sign-in attempts; sessions expire.

Access

Roles and permissions per dealership, which you assign; each dealership's data kept apart from every other's; our staff access data only as their task requires.

Transfer

Data transferred only encrypted; files only through links that expire; login details for platforms and public bodies stored encrypted.

Input

A record of who created, changed or removed which data and when; a tamper-evident record of every signature.

Availability

Daily backups, stored encrypted in a separate location; monitoring of the systems with alerts.

Separation

Separate environments for development, testing and production; a test mode with its own data for each dealership.

Review

Regular software updates and reviews of the measures; contracts under Article 28 UK GDPR with every sub-processor.