Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between the fleet customer ("Controller") and FuelSmart ("Processor") for the processing of personal data relating to fleet drivers.

Fleet customers: The fleet customer acts as the Data Controller. FuelSmart acts as the Data Processor, processing fleet driver personal data on behalf of and under the instructions of the Controller.

Consumer users: For individual consumer users of FuelSmart (non-fleet), FuelSmart acts as the Data Controller. This DPA does not apply to consumer data; please refer to our Privacy Policy instead.

Categories of data processed:

• Driver names and email addresses
• Fill-up history: station, fuel type, litres, price paid, date, and location
• Vehicle assignments
• Performance metrics and usage analytics

Purposes of processing:

• Fuel tracking and cost monitoring
• Fleet reporting and analytics
• Fleet management and driver oversight
• Savings analysis and optimisation

Duration: Personal data is processed for the duration of the fleet subscription plus a 12-month retention period following termination.

FuelSmart engages the following sub-processors to deliver the service:

We will provide the Controller with at least 30 days' prior written notice of any intended changes to sub-processors. The Controller has 14 days from receipt of notice to object to a new sub-processor on reasonable grounds.

FuelSmart implements the following technical and organisational measures:

• TLS 1.2+ encryption for all data in transit
• AES-256 encryption at rest (Supabase managed)
• Row Level Security (RLS) policies enforcing organisation-level data isolation
• Role-based access control with distinct permissions for admins, managers, and drivers
• Individual authentication required for all users
• API keys hashed with SHA-256 before storage
• Regular security reviews and access audits

In the event of a personal data breach, FuelSmart will notify the Controller without undue delay and in any event within 72 hours of becoming aware of the breach.

The notification will include:

• The nature of the personal data breach
• The categories and approximate number of data subjects affected
• The likely consequences of the breach
• The measures taken or proposed to address the breach and mitigate its effects

FuelSmart will cooperate fully with the Controller in investigating and resolving any breach, and will take reasonable steps to mitigate any adverse effects.

FuelSmart will assist the Controller in fulfilling data subject rights requests under applicable data protection law, including requests for access, rectification, erasure, restriction, and portability.

Access & portability: The fleet dashboard provides CSV export functionality, enabling Controllers to respond to access and data portability requests directly.

Erasure: To request deletion of driver data, contact us. Erasure requests will be processed within 30 days.

Upon termination of the fleet subscription, the Controller may export all fleet data via CSV download from the dashboard.

Following the 12-month retention period after termination, all personal data will be permanently deleted from our systems.

Earlier deletion may be requested at any time and will be carried out within 30 days.

After deletion, FuelSmart will retain only anonymised, aggregated price data and legally required billing records.

FuelSmart will provide evidence of security and compliance measures once per year upon the Controller's reasonable request.

This may include completed security questionnaires, relevant certifications, and summary audit reports.

On-site audits may be conducted by mutual agreement, subject to at least 30 days' prior written notice and at the Controller's expense.

Primary data storage is within the EU (Supabase).

Transfers to the United States (Anthropic, Stripe, Vercel) are covered by the UK International Data Transfer Agreement (IDTA) and/or EU Standard Contractual Clauses (SCCs) as appropriate.

No personal data will be transferred to any country or recipient without adequate safeguards in place.

This DPA automatically terminates when the fleet subscription ends.

Upon termination, the data return and deletion provisions in Section 7 apply. The Controller may export data and request early deletion as described above.

Confidentiality obligations survive termination of this DPA indefinitely.