Data Processing Agreement
This Data Processing Agreement ("DPA") forms part of the Zerity Terms and Conditions of Service (the "Terms") between ZERITY LIMITED, Company No. 14348190, Elizabeth House, Victoria Street, Openshaw, Manchester, M11 2NX ("Zerity") and the business that subscribes to the Platform (the "Customer"). It applies whenever Zerity processes personal data on the Customer's behalf. Under clause 8.3 of the Terms, this DPA prevails over the Terms in relation to data processing matters. Capitalised terms not defined here have the meaning given in the Terms.
1. Roles
1.1 The Customer is the controller of Customer Data, including Contractor Data. Zerity is the processor.
1.2 Zerity is an independent controller only of platform action and audit logs that it creates for security, fraud prevention, system administration, and its own legal obligations, as described in the Privacy Policy. This DPA does not apply to those logs.
1.3 Zerity is not the Customer's Data Protection Officer and does not act as the Customer's representative for any purpose under Data Protection Law.
1.4 "Data Protection Law" means the UK General Data Protection Regulation, the Data Protection Act 2018, and, where applicable, the EU General Data Protection Regulation 2016/679, each as amended.
2. Customer responsibilities
2.1 The Customer warrants and undertakes that:
- it has, and will maintain, a lawful basis under Data Protection Law for all processing it instructs Zerity to perform, including any special category or criminal-offence data such as DBS results or health and safety records;
- it has given every Contractor a privacy notice that meets Articles 13 and 14 UK GDPR before their data is entered on the Platform, and that the notice covers processing through the Platform;
- its instructions to Zerity, including Platform configuration and the integrations it enables, comply with Data Protection Law;
- Customer Data is accurate and was obtained lawfully; and
- it is responsible for the acts and omissions of its Authorised Users.
2.2 The Customer is solely responsible for determining whether the Platform's technical and organisational measures in Annex II are appropriate for the Customer Data it chooses to process, and for deciding which optional features and integrations to enable.
3. Processing instructions
3.1 Zerity will process Customer Data only on the Customer's documented instructions, unless required to do so by law. In that case Zerity will inform the Customer before processing unless the law prohibits it.
3.2 The Customer's complete documented instructions are: (a) the Terms; (b) this DPA; (c) the Customer's configuration of, and use of, the Platform, including features and integrations the Customer enables; and (d) any further written instruction agreed by both parties.
3.3 Zerity will inform the Customer if, in its opinion, an instruction infringes Data Protection Law. Zerity may suspend the relevant processing until the instruction is amended or confirmed in writing, and is not liable for the consequences of that suspension.
3.4 Instructions that go beyond the functionality of the Platform may be subject to Zerity's reasonable additional charges.
4. Nature and purpose of processing
Details of the subject matter, duration, nature and purpose of processing, the types of personal data, and the categories of data subjects are set out in Annex I.
5. Confidentiality
Zerity will ensure that personnel authorised to process Customer Data are bound by contractual or statutory obligations of confidentiality and receive appropriate data protection training.
6. Security
6.1 Zerity will implement and maintain the technical and organisational measures described in Annex II. Zerity may update those measures from time to time provided the overall level of protection is not materially reduced.
6.2 The Customer is responsible for securing its own accounts and devices, including credential management, multi-factor authentication where available, and removing access for Authorised Users who leave.
7. Sub-processors
7.1 The Customer gives general written authorisation for Zerity to engage the sub-processors listed in Annex III, and any replacement or additional sub-processor appointed under this clause.
7.2 Zerity will give the Customer at least 30 days' notice of any intended addition or replacement by updating Annex III and notifying the Customer's account contact by email. The Customer may object in writing within that period on reasonable data protection grounds. If the parties cannot resolve the objection in good faith within 30 days, the Customer may terminate the affected Services on written notice as its sole remedy. Fees for Services already provided remain payable.
7.3 Zerity will impose data protection obligations on each sub-processor that are no less protective than those in this DPA, and remains liable to the Customer for the performance of its sub-processors' obligations, subject to clause 12.
7.4 Third-party services that the Customer chooses to connect to the Platform using its own account or credentials, such as accounting, banking, or verification providers, are engaged by the Customer directly. Those providers are the Customer's processors or independent controllers, not Zerity's sub-processors, and Zerity is not responsible for their processing.
8. International transfers
8.1 The Platform and Customer Data are hosted by Amazon Web Services in the Republic of Ireland (EU West 1 region). Transfers between the United Kingdom and the European Economic Area are covered by the UK adequacy regulations and the EU adequacy decision for the United Kingdom.
8.2 Zerity will not transfer Customer Data outside the United Kingdom or the European Economic Area without an appropriate transfer mechanism under Data Protection Law, such as adequacy regulations or the UK International Data Transfer Agreement or Addendum.
8.3 Where the Customer itself directs a transfer, for example by enabling an integration hosted elsewhere, the Customer is responsible for that transfer.
9. Data subject rights
9.1 The Platform's Privacy Center lets Contractors submit access, rectification, erasure, restriction, portability, and objection requests, and lets the Customer verify, manage, and respond to them. This is Zerity's primary means of assisting the Customer with data subject requests.
9.2 If Zerity receives a request directly, it will forward it to the Customer without undue delay and will not respond to the data subject on the Customer's behalf except to acknowledge receipt or as instructed.
9.3 The Customer decides how each request is answered and is responsible for meeting statutory deadlines. Assistance beyond the Platform's built-in features may be subject to Zerity's reasonable additional charges.
10. Personal data breaches
10.1 Zerity will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data, and will provide the information reasonably available to Zerity at that time, with updates as the investigation progresses.
10.2 Notification of, or response to, a breach is not an admission of fault or liability by Zerity.
10.3 The Customer is responsible for deciding whether to notify the Information Commissioner's Office, any other regulator, or data subjects, and for making those notifications.
11. Assistance, records, and audits
11.1 Taking into account the nature of the processing and the information available to it, Zerity will provide reasonable assistance to the Customer with data protection impact assessments and prior consultation with a supervisory authority. Assistance beyond a reasonable level may be subject to Zerity's reasonable additional charges.
11.2 Zerity will make available the information reasonably necessary to demonstrate compliance with Article 28 UK GDPR. Zerity will satisfy this obligation in the first instance by providing its security documentation, policies, and any third-party assessment reports it holds.
11.3 Where those materials are insufficient to demonstrate compliance, the Customer may conduct, or appoint an independent auditor bound by confidentiality to conduct, an audit no more than once in any 12-month period, on at least 30 days' written notice, during normal business hours, at the Customer's cost, and in a way that does not disrupt Zerity's business or compromise the security or confidentiality of other customers' data. An additional audit is permitted where required by a supervisory authority or following a personal data breach affecting the Customer's data.
12. Liability
12.1 Each party's liability under or in connection with this DPA is subject to the exclusions and limitations in clause 14 of the Terms, which apply to this DPA as if set out in full here. This DPA does not create any liability that would be excluded or capped under the Terms.
12.2 Zerity is liable under Data Protection Law only where it has failed to comply with obligations specifically directed at processors, or has acted outside or contrary to the Customer's lawful instructions.
12.3 The Customer indemnifies Zerity against all claims, fines, penalties, costs, and losses arising from: (a) the Customer's breach of clause 2; (b) any instruction that infringes Data Protection Law; (c) any failure by the Customer to provide a compliant privacy notice to Contractors; or (d) any processing directed by the Customer through integrations it has enabled.
12.4 Each party is responsible for any administrative fine imposed on it by a supervisory authority to the extent the fine relates to its own breach. Nothing in this DPA requires either party to indemnify the other for a fine that cannot lawfully be indemnified.
13. Return and deletion
13.1 For 30 days after termination or expiry of the Terms, the Customer may export Customer Data using the Platform's export facilities.
13.2 After that period, Zerity will delete Customer Data within 90 days, except to the extent that retention is required by law, is needed to resolve a dispute or to enforce the Terms, or where data remains in routine backups until those are overwritten in the ordinary course. Retained data stays subject to this DPA.
13.3 Zerity may retain aggregated or anonymised data that does not identify any individual.
14. Term and general
14.1 This DPA takes effect when the Customer accepts the Terms and continues until Zerity has ceased to process Customer Data.
14.2 Zerity may update this DPA to reflect changes in Data Protection Law or in the Platform. Material changes will be notified to the Customer's account contact by email and take effect 30 days after notice.
14.3 This DPA is governed by the laws of England and Wales. The courts of England and Wales have exclusive jurisdiction.
14.4 If the Customer requires an executed copy of this DPA, or a version with additional terms, contact office@zerity.co.uk.
Annex I - Details of processing
| Subject matter | Provision of the Platform for onboarding, compliance, fleet, invoicing, payment, safety, and related services to the Customer. |
|---|---|
| Duration | The term of the Terms plus the return and deletion period in clause 13. |
| Nature | Collection, storage, organisation, structuring, retrieval, use, disclosure by transmission to recipients the Customer authorises, and erasure, by automated means. |
| Purpose | Delivering the Services selected and configured by the Customer. |
| Data subjects | Contractors and Drivers engaged by the Customer; the Customer's Authorised Users; contacts at the Customer's clients, depots, and suppliers. |
| Personal data | Identity and contact details; business, tax, and IR35 status records; right-to-work and identity documents; driving licence and DVLA check results; DBS results where the Customer enables them; vehicle, booking, inspection, incident, health and safety, and training records; bank details, invoices, payments, charges, and disputes; delivery, attendance, and performance data; photographs, documents, signatures, and communications submitted for those purposes. |
| Special category and criminal-offence data | Only where the Customer chooses to process it, for example DBS results or health information in incident reports. The Customer must satisfy an Article 9 or Article 10 condition before doing so. |
Annex II - Technical and organisational measures
- Hosting on Amazon Web Services in the Republic of Ireland, with logically separated databases per Customer.
- Encryption of data in transit using TLS and at rest using AWS managed encryption for databases, object storage, and backups.
- Role-based access control within the Platform; access to production systems limited to authorised Zerity personnel under least-privilege principles, with multi-factor authentication.
- Audit logging of administrative and security-relevant actions.
- Automated backups retained within the same hosting region.
- Error and performance monitoring with alerting.
- Secure development practices including code review, automated testing, and dependency monitoring.
- A documented information security management system and security breach reporting procedure.
- Confidentiality obligations and data protection training for personnel.
Annex III - Sub-processors
Zerity engages the following sub-processors to host and deliver the Platform.
| Sub-processor | Purpose | Location |
|---|---|---|
| Amazon Web Services EMEA SARL | Cloud hosting, database, object storage, content delivery, backups | Republic of Ireland (EU West 1) |
| Resend, Inc. | Transactional email delivery | United States (with appropriate transfer safeguards) |
| Twilio Inc. | SMS delivery | United States (with appropriate transfer safeguards) |
| Functional Software, Inc. (Sentry) | Error and performance monitoring | European Union |
| Amplitude, Inc. | Product usage analytics | European Union |
Services the Customer connects using its own account, such as accounting, banking, e-signature, identity, or licence-check providers, are engaged by the Customer under clause 7.4 and are not listed here.
ZERITY LIMITED, Company No. 14348190, Elizabeth House, Victoria Street, Openshaw, Manchester, M11 2NX, United Kingdom.