United Kingdom customer data terms
UK Data Processing Addendum
Effective: 10 October 2026 · Version 2026-10-10
1. Parties and application
This Data Processing Addendum (“DPA”) forms part of the agreement between the Customer and the Trukfox contracting entity identified in the applicable order form (“Agreement”). It applies where Trukfox processes Customer Personal Data on the Customer’s behalf.
The UK Trukfox provider is TRUKFOX LTD, registered in Scotland under company number SC905403, unless the Agreement expressly identifies a different provider.
For UK Data Protection Law, the Customer is controller and Trukfox is processor, except where either party independently determines purposes and means. Each party will comply with its own obligations under UK Data Protection Law.
For applicable US State Privacy Laws, the Customer is the business/controller and Trukfox is the service provider, contractor, or processor. Each party will comply with the obligations applicable to its role.
2. Definitions
“Customer Personal Data” means personal data, personal information, or equivalent regulated information contained in Customer Data.
“UK Data Protection Law” means the UK GDPR, Data Protection Act 2018, Privacy and Electronic Communications Regulations 2003 where applicable, and amendments including the Data (Use and Access) Act 2025. Terms including controller, processor, personal data, processing, personal data breach, and data subject have the meanings in UK Data Protection Law.
“US State Privacy Laws” means comprehensive US state privacy laws applicable to the Customer Personal Data and the parties, including their implementing regulations. Terms including controller, business, processor, contractor, service provider, consumer, sell, share, and targeted advertising have the meanings in the applicable law.
3. Processing details and instructions
Trukfox will process Customer Personal Data only on documented Customer instructions, including instructions expressed through authorised use and configuration of the Service, to provide, host, secure, support, maintain, and improve reliability of the Service, and to comply with law. If Trukfox believes an instruction breaches applicable Data Protection Law, it will inform the Customer unless prohibited by law.
Trukfox will not process Customer Personal Data for its own independent purposes or transfer it outside the UK except on documented instructions or where UK law requires processing. If UK law requires processing beyond the Customer’s instructions, Trukfox will tell the Customer before processing unless that law prohibits notice for an important public-interest reason.
The processing description in Schedule 1 forms part of this DPA. The Agreement, this DPA, authorised product settings, support requests, and lawful written instructions constitute the Customer’s documented instructions.
4. Confidentiality
Trukfox will ensure people authorised to process Customer Personal Data are subject to appropriate confidentiality obligations and receive access only where needed for their role.
5. Security
Taking account of available technology, implementation cost, processing scope and risk, Trukfox will maintain appropriate technical and organisational measures. Current core measures are described in Schedule 2. Trukfox may update measures provided that overall protection is not materially reduced.
6. Subprocessors
The Customer gives general written authorisation for Trukfox to use subprocessors needed to provide the Service, including hosting, storage, communications, security, monitoring, support, and payment providers. Trukfox will impose data-protection obligations appropriate to the processing and remains responsible for subprocessor performance to the extent required by law.
Trukfox will provide a current subprocessor list on request or through a published service page. For a new subprocessor that materially processes Customer Personal Data, Trukfox will give reasonable advance notice where required. The Customer may object on reasonable data-protection grounds. The parties will work in good faith; if no reasonable solution is available, either party may terminate the affected Service according to the Agreement.
When the service operator configures external AI and the company administrator enables Settings → Platform assistant, OpenAI receives eligible typed software-help prompts and limited workflow context. The company setting starts disabled and applies to its users. The application does not automatically attach workspace records, files, credentials or conversation history, and does not persist assistant conversations. Help answers are limited to approved platform guidance. Responses application-state storage is disabled for these requests, which does not eliminate provider abuse-monitoring retention. Provider data controls and applicable processing arrangements remain part of the configured service. Guided help uses no external AI provider, and order drafts require user review and the normal save process.
Every subprocessor agreement will impose, in substance, the same Article 28 data-protection obligations that apply to Trukfox under this DPA. Trukfox remains fully liable to the Customer for a subprocessor’s performance of those obligations as required by Article 28(4).
7. International transfers
Trukfox will not make or initiate a restricted transfer of Customer Personal Data from the United Kingdom without a lawful transfer mechanism. Depending on the transfer, this may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved EU Standard Contractual Clauses, or another safeguard permitted by Chapter V of the UK GDPR. Where required, the exporting party will complete and document the UK data protection test and supplementary measures. The Customer authorises transfers inherent in the documented subprocessor arrangement subject to those safeguards.
The Customer authorises processing in the United States and other locations identified in the documented subprocessor arrangement. Trukfox will require providers to apply contractual privacy and security protections appropriate to their role and the Customer’s instructions.
8. Individual rights
Taking account of the processing, Trukfox will provide reasonable assistance for Customer responses to lawful requests to access, correct, delete, restrict, object to, or port Customer Personal Data. If Trukfox directly receives a request relating to Customer Personal Data, it may direct the person to the Customer and will not independently respond except as instructed or required by law.
9. Regulatory assistance
Taking account of the processing and information available, Trukfox will reasonably assist the Customer with security obligations, breach notifications, data protection impact assessments, regulator consultations, and similar obligations under applicable Data Protection Law. Material assistance outside normal Service functionality may be charged at agreed rates where permitted.
This includes assistance reasonably required under Articles 32 to 36 of the UK GDPR and cooperation with the Information Commissioner’s Office. Trukfox will maintain records required of processors and make them available to the ICO on request where UK law requires.
10. Personal data incidents
Trukfox will notify the Customer without undue delay after becoming aware of a confirmed personal data breach affecting Customer Personal Data. The notice will include information reasonably available about the nature, likely consequences, affected information, mitigation, and contact point. Notification is not an admission of fault. The Customer remains responsible for regulatory and individual notifications unless law assigns that duty to Trukfox.
11. Return and deletion
During the subscription, the Customer may access and export information through available Service functionality. After termination, Trukfox will delete or return Customer Personal Data according to the Agreement and Customer instructions, unless law requires retention. Data may remain temporarily in protected backups until overwritten under normal cycles and will remain subject to this DPA.
Offline-capable clients hold encrypted device copies, prepared protected paperwork and pending changes. Drivers use a signed offline allowance, normally seven days and configurable by the service operator from one to 30 days; other permitted cached workspace reads require a valid session and are limited to 24 hours. A disconnected device cannot immediately receive an account revocation. The server checks current account status and permissions before session renewal or synchronisation. Saved bytes may remain until eviction, sign-out or device/site-data clearing. Pending changes older than 30 days require review and are not automatically deleted. Explicit sign-out clears local work, including the native delivery queue and unsynced changes; another-account login is blocked while unsynced work remains. Native receipt history is bounded, with receipts older than 30 days pruned on subsequent successful delivery; browser site-data clearing alone does not clear a separate native queue.
12. Information and audits
Trukfox will make information reasonably necessary to demonstrate compliance available to the Customer. No more than once annually, unless required by a regulator or following a material incident, the Customer may request a reasonable remote audit. On-site audits require reasonable advance notice, confidentiality, normal business hours, non-disruption, and reimbursement of reasonable costs. Audits must not expose other customers’ information, Trukfox security secrets, or unrelated confidential data.
13. US service-provider and contractor terms
Where US State Privacy Laws apply, Trukfox certifies that it understands and will comply with these restrictions. Trukfox will not sell or share Customer Personal Data; retain, use, or disclose it outside the direct business relationship and permitted business purposes; combine it with personal information from another source except where law permits; or use it for targeted advertising or to infer characteristics about individuals.
The Customer may take reasonable and appropriate steps to help ensure Trukfox uses Customer Personal Data consistently with the Customer’s obligations and may require remediation of unauthorised use. Trukfox will notify the Customer if it determines it can no longer meet applicable service-provider, contractor, or processor obligations.
13. UK processor commitments
Nothing in the Agreement relieves Trukfox of its direct statutory responsibilities as a processor. Trukfox will make available all information reasonably necessary to show compliance with Article 28, contribute to proportionate audits and inspections, and immediately inform the Customer if, in Trukfox’s opinion, an instruction infringes UK Data Protection Law.
The Customer warrants that its instructions, disclosures, retention choices, access permissions, and use of the Service comply with UK Data Protection Law. The Customer is responsible for transparency notices, lawful bases and conditions, data-subject responses, accuracy, and determining whether a data protection impact assessment is required.
14. Conflict, liability, and duration
If this DPA conflicts with the Agreement on processing Customer Personal Data, this DPA controls. Liability under this DPA is subject to the Agreement’s exclusions and limits to the fullest extent permitted by law. This DPA remains effective while Trukfox processes Customer Personal Data.
Schedule 1 — Processing description
| Subject and purpose | Providing a multi-company trucking operations platform, account administration, security, support, document storage, reporting, offline work, optional email-document ingestion, and optional prompt-based help and order drafting. |
|---|---|
| Duration | The subscription term plus limited exit, backup, legal-retention, and deletion periods. |
| Operations | Collection, receipt, hosting, encrypted device storage, organisation, retrieval, display, matching, transmission and deferred synchronisation, optional AI prompt processing, support access, security analysis, export, deletion, and backup. |
| Individuals | Customer staff, administrators, drivers, dispatchers, managers, customers, customer contacts, suppliers, senders, recipients, and other people identified in operational records or documents. |
| Data | Names, business emails, phones, roles, login and audit information, customer contacts, routes, locations, order and vehicle details, instructions, timestamps, fees, notes, documents, signatures or images in uploaded paperwork, mailbox identifiers, senders, subjects, and attachments. |
| Sensitive data | Not intentionally required. The Customer must not submit special-category, criminal-offence, medical, biometric, Social Security, financial-account, or similarly sensitive data unless expressly agreed and lawfully protected. |
Schedule 2 — Core security measures
- Unique user identities, hashed passwords, role-based access, account deactivation, and token-version session revocation.
- Company-scoped database queries and protected document endpoints designed to maintain tenant separation.
- AES-256-GCM encryption of saved mailbox app passwords with a separately managed service secret.
- Account-scoped AES-GCM encryption of permitted offline records and queued evidence. Native delivery queues use device Keychain or Keystore keys and are excluded from normal app backups.
- Server authorization and duplicate/conflict checks when pending changes sync. Optional AI requires an explicit user choice, sends a limited prompt payload, validates permitted actions and cannot save records without the normal user workflow.
- Input validation, file-type and size controls, authentication checks, audit records, and bounded email-processing records.
- HTTPS in production through the hosting edge, controlled deployment secrets, and persistent data storage.
- Operational logging, mailbox health monitoring, backups and recovery controls appropriate to the selected hosting plan.
- Access limited to authorised personnel and providers with a business need and confidentiality duties.
- Incident investigation, credential reset, account suspension, and Customer notification procedures.
Contact
DPA and privacy questions may be sent to privacy@trukfox.com. Security incidents should be sent to security@trukfox.com.