Data Processing Agreement

1. Roles, subject matter & duration

The dealership is the controller and DriveSlots is the processor. DriveSlots processes personal data to provide appointment booking, reminders and related features, for as long as the dealership uses the service.

2. Nature & purpose

Collecting and storing booking enquiries; sending confirmations, reminders and follow-ups; and showing the dealership its appointments and reports.

3. Types of personal data & data subjects

Customer name, email and phone; enquiry details (vehicle interest, budget, timing); appointment date/time/status and notes; and technical data (IP) for security. The data subjects are the dealership's prospective and actual customers who book through the service.

4. DriveSlots' obligations

• process personal data only on the dealership's documented instructions;
• ensure people authorised to process it are under confidentiality;
• apply appropriate technical and organisational security measures;
• not engage another sub-processor without the dealership's general authorisation and notice of changes (current sub-processors in §6);
• assist the dealership with data-subject requests and security obligations;
• on the dealership's choice, delete or return personal data at the end of the service, and delete existing copies unless law requires retention;
• make available information needed to demonstrate compliance.

5. Security measures

Encryption in transit (HTTPS); access restricted to authorised logins; password hashing and optional 2FA; per-dealership data isolation; automatic deletion of data older than the configured retention period (default 24 months); and audit logging.

6. Sub-processors

• Vercel — application hosting
• Neon — database hosting
• Resend — transactional email
• Firetext — SMS (if enabled)

Where a sub-processor processes data outside the UK, appropriate safeguards (e.g. UK IDTA / adequacy) will be in place.

7. Data breaches & audit

DriveSlots will notify the dealership without undue delay after becoming aware of a personal data breach affecting the dealership's data, and will make available information reasonably necessary to demonstrate compliance with this DPA.

8. Governing law

Governed by the laws of England and Wales.