Data Processing Agreement | DealerKit Help Support

Last updated: 1 July 2026

This Data Processing Agreement (“DPA”) is incorporated into and supplements the Agreement entered into between Dealerkit (referred to as “Dealerkit” in the Terms and as “Dealerkit” or “Processor” in this DPA) and the Customer (referred to as “Customer” in the Terms and “Customer” or “Controller” in this DPA) on the basis of the Dealerkit Terms of Service (“Terms”) in relation to the provision of the Services (specifically the Dealerkit Dealer Management Software) by Dealerkit to the Customer.

VARIABLES
Parties’ relationship	Controller to Processor
Parties’ roles	Customer will act as the Controller (as defined in Section 1 of this DPA). Dealerkit will act as the Processor (as defined in Section 1 of this DPA).
Term	This DPA will commence on the Effective Date as set out in the Terms and will continue for the Term as set out in the Terms.
Breach Notification Period	Without undue delay and no later than 72 hours after becoming aware of a personal data breach.
Sub-processor Notification Period	A reasonable timeframe before the new sub-processor is granted access to Personal Data.
Liability Cap	Each party’s aggregate liability under this DPA will not exceed the liability caps as per the Terms.
Governing Law and Jurisdiction	As per the Terms.
Data Protection Laws	All laws, regulations and court orders which apply to the processing of Personal Data in the United Kingdom (UK). This includes UK GDPR and the Data Protection Act 2018 each as amended from time to time.
Services related to processing	As described in the Terms.
Duration of processing	For the Term of this DPA.
Nature and purpose of processing	Collection, storage and deletion for the purposes of providing the Services under the Terms.
Personal Data	The types of personal data processed are: Customer’s personnel Identity Data: includes first name, last name and profile picture. Contact Data: includes email address (work) and mobile telephone number. Employment Data: includes location of employment/shift and estimated commission. Performance Data: includes active deals, closed deals, closed deals revenue, average net profit, total profit, total margin, performance rating versus other personnel. and any other personal data that may be shared by the Controller or their personnel using the user interface of the Software (such as via the diary or inbox functions), which may include special categories of personal data. Customers and potential customers of the Customer (“Dealership Customers”) Identity Data: includes first name, last name, title and date of birth. Contact Data: includes email (personal), telephone numbers, residential address, history of SMSs sent and received, history of emails sent and received, history of telephone calls and history of in-person visits. Financial Data: includes bank account details and payment card details. Transaction Data: includes details about payments to and from the Dealership Customer and other details of products and services they have purchased from the Customer. Employment Data: includes name of employer. Vehicle Data: includes registration number. and any other personal data that may be shared by the Controller or their personnel using the user interface of the Software (such as via the diary, notes, comments, inbox or document upload functions), which may include special categories of personal data. Customer’s supplier/partner (when operating as a sole trader) Identity Data: includes first name, last name and profile picture. Contact Data: includes email (work or personal), telephone numbers, residential address, history of SMSs sent and received, history of emails sent and received, history of telephone calls and history of in-person visits. Trading Data: includes location of operations. Financial Data: includes bank account details. Transaction Data: includes history of payments. and any other personal data that may be shared by the Controller or their personnel using the user interface of the Software (such as via the diary or notes functions), which may include special categories of personal data. Customer’s supplier/partner personnel Identity Data: includes first name, last name and profile picture. Contact Data: includes email (work), telephone numbers, residential address, history of SMSs sent and received, history of emails sent and received, history of telephone calls and history of in-person visits. Employment Data: includes name of employer and location of employment. and any other personal data that may be shared by the Controller or their personnel using the user interface of the Software (such as via the diary or notes functions), which may include special categories of personal data.
Data subjects	The individuals whose Personal Data will be processed are: Customer’s personnel Dealership Customers Customer’s supplier/partners (when operating as a sole trader) Customer’s supplier/partner personnel
Special provisions	None.
Transfer Mechanism	N/A

ANNEX 1

Security measures. Technical and organisational measures to ensure the security of Personal Data

Technical measures

The pseudonymisation and encryption of personal data
The ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services
The ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident
Ensuring that data processing systems cannot be accessed or used without proper authorisation
Preventing unauthorised reading, copying, modification, or removal of personal data during both storage and transmission
Maintaining the ability to identify and verify recipients of personal data transfers

Organisational measures

A process for regularly testing, assessing and evaluating the effectiveness of the security measures
Enabling retrospective auditing to determine whether personal data has been entered, modified, or deleted, and by whom.

ANNEX 2
Sub-processors. Current sub-processors

Sub-processor	Activity
Digital Ocean	Infrastructure provider
Amazon Web Services	Infrastructure provider
Google Cloud	Infrastructure provider
Wasabi	Infrastructure provider
Cloudflare	Infrastructure provider
OpenAI	LLM provider
Anthropic	LLM provider
Pusher (Message Bird)	Communications provider
RemoveBG	Image editing provider
Twilio	Communications provider
MailGun (Sinch)	Communications provider
Postmark	Communications provider
Meta (WhatsApp)	Communications provider
Loqate	Address verification provider
Xero	Financial integration partner
Sage	Financial integration partner

DPA TERMS

What is this agreement about?

1.1 Purpose. The parties are entering into this Data Processing Agreement for the purpose of processing Personal Data (as defined above).

1.2 Definitions. Under this DPA:

(a) adequate country means a country or territory that is recognised under Data Protection Laws from time to time as providing adequate protection for processing Personal Data, and

(b) Controller, data subject, personal data breach, process/processing, Processor and supervisory authority have the same meanings as in the Data Protection Laws.

2. What are each party’s obligations?

2.1. Controller obligations. Controller instructs Processor to process Personal Data in accordance with this DPA, and is responsible for providing all notices and obtaining all consents, licences and legal bases required to allow Processor to process Personal Data.

2.2. Processor obligations. Processor will:

(a) only process Personal Data in accordance with this DPA and Controller’s instructions (unless legally required to do otherwise),

(b) Not sell, retain or use any Personal Data for any purpose other than as permitted by this DPA and the Terms,

(d) use the technical and organisational measures described in Annex 1 when processing Personal Data to ensure a level of security appropriate to the risk involved,

(e) notify Controller of a personal data breach within the Breach Notification Period and provide assistance to Controller as required under Data Protection Laws in responding to it,

(f) ensure that anyone authorised to process Personal Data is committed to confidentiality obligations,

(g) without undue delay, provide Controller with reasonable assistance with:

(i) data protection impact assessments,

(ii) responses to data subjects’ requests to exercise their rights under Data Protection Laws, and

(iii) engagement with supervisory authorities,

(h) if requested, provide Controller with information necessary to demonstrate its compliance with obligations under Data Protection Laws and this DPA,

(i) allow for audits at Controller’s reasonable request, provided that audits are limited to once a year and during business hours except in the event of a personal data breach, and

(j) return Personal Data upon Processor’s written request or delete Personal Data by the end of the Term, unless retention is legally required.

2.3. Warranties. The parties warrant that they and any staff and/or subcontractors will comply with their respective obligations under Data Protection Laws for the Term.

3. Sub-processing

3.1. Use of sub-processors. Controller authorises Processor to engage other processors (referred to in this section as sub-processors) when processing Personal Data. Processor’s existing sub-processors are listed in Annex 2.

3.2. Sub-processor requirements. Processor will:

(a) require its sub-processors to comply with equivalent terms as Processor’s obligations in this DPA,

(b) ensure appropriate safeguards are in place before internationally transferring Personal Data to its sub-processor, and

3.3 Approvals. Processor may appoint new sub-processors provided that they notify the Controller in writing in accordance with the Sub-processor Notification Period.

3.4. Objections. Controller may reasonably object in writing to any future sub-processor. If the parties cannot agree on a solution within a reasonable time, either party may terminate this DPA.

4. International personal data transfers

4.1. Instructions. Processor will transfer Personal Data outside the UK, the EEA or an adequate country only on documented instructions from Controller, unless otherwise required by law.

4.2. Transfer mechanism. Where a party is located outside the UK, the EEA or an adequate country and receives Personal Data:

(a) that party will act as the data importer,

(b) the other party is the data exporter, and

4.3. Additional measures. If the Transfer Mechanism is insufficient to safeguard the transferred Personal Data, the data importer will promptly implement supplementary measures to ensure Personal Data is protected to the same standard as required under Data Protection Laws.

4.4 Disclosures. Subject to terms of the relevant Transfer Mechanism, if the data importer receives a request from a public authority to access Personal Data, it will (if legally allowed):

(a) challenge the request and promptly notify the data exporter about it, and

(b) only disclose to the public authority the minimum amount of Personal Data required and keep a record of the disclosure.

5. Other important information

5.1 Survival. Any provision of this DPA which is intended to survive the Term will remain in full force.

5.2 Order of precedence. In case of a conflict between this DPA and other relevant agreements, they will take priority in this order:

(a) Transfer Mechanism,

(b) DPA,

5.3. Notices. Formal notices under this DPA must be sent in writing in accordance with clause 13.10 of the Terms.

5.4. Third parties. Except for affiliates, no one other than a party to this DPA has the right to enforce any of its terms.

5.5 Entire agreement. This DPA supersedes all prior discussions and agreements and constitutes the entire agreement between the parties with respect to its subject matter and neither party has relied on any statement or representation of any person in entering into this DPA.

5.6. Amendments. Any amendments to this DPA must be agreed in writing.

5.7. Assignment. Neither party can assign this DPA to anyone else without the other party's consent.

5.8. Waiver. If a party fails to enforce a right under this DPA, that is not a waiver of that right at any time.

5.9. Governing law and jurisdiction. The Governing Law applies to this DPA and all disputes will only be litigated in the courts of the Jurisdiction.

Acceptable Use Policy

Changes to our Terms of Service

Changes to our Privacy Policy and our new Acceptable Use Policy