Data Processing Agreement

• The dealership (“you”) — the business with a MotorPortal HQ account — is the controller of the personal data it puts into, or collects through, MotorPortal HQ.
• MotorPortal HQ (Anay Makwana, trading as MotorPortal HQ — “we”, “us”) is the processor of that data.
• Where we use personal data for our own purposes — such as your account, billing and platform security — we act as a controller, as explained in our privacy notice. This agreement doesn’t cover that data.

Special category data (such as health information) and criminal offence data should not be put into MotorPortal HQ. See our Acceptable Use Policy for other data you shouldn’t store.

We will only process the personal data on your documented instructions. Your instructions are these terms and the settings and actions you use in MotorPortal HQ. We will not process it for any other purpose unless the law requires us to — in that case we’ll tell you first, unless the law forbids it.

We’ll tell you straight away if we think an instruction breaks data protection law.

You are responsible for having a lawful basis for the data you put into MotorPortal HQ and for giving the people concerned the information the law requires, such as your own privacy notice.

Anyone we authorise to process the personal data is bound by a duty of confidentiality, and only has access where needed to provide or support the service.

We take appropriate technical and organisational measures to protect the personal data, taking into account the risks involved. These currently include:

• encrypted connections (HTTPS) for all traffic;
• separation of each dealership’s data, with staff permissions checked on our servers;
• passwords stored only as secure one-way hashes, and connection tokens for HMRC, Xero and QuickBooks encrypted at rest;
• private documents available only through short-lived, signed links;
• rate limiting, an activity log and standard web security protections; and
• hosting with established providers whose main database and file storage are in London.

You are responsible for the security of your own devices and logins, for giving staff only the access they need, and for removing access when someone leaves.

• You give us general authorisation to use sub-processors to provide the service. The current list is on our sub-processors page.
• We’ll tell you before we add or replace a sub-processor, by email or in the app, giving you a reasonable opportunity to object.
• If you object on reasonable data protection grounds, we’ll work with you to find a solution. If we can’t, you may cancel your subscription before the change affects your data.
• We put a written contract in place with each sub-processor that gives your data the same level of protection as this agreement, and we remain responsible to you for their performance.

MotorPortal HQ gives you tools to handle most requests yourself: you can export a customer’s data, correct it, anonymise a customer, delete a customer who has no sales, and delete enquiries. If someone contacts us directly about data you control, we’ll pass the request to you promptly and won’t respond to it ourselves unless you ask us to. Where you need more help, we’ll provide reasonable assistance.

Taking into account the information available to us, we’ll give you reasonable help with your security obligations, data protection impact assessments and any consultation with the Information Commissioner’s Office.

If we become aware of a personal data breach affecting your data, we’ll tell you without undue delay. We’ll give you the information you need to decide whether to report it to the ICO or tell the people affected — including what happened, the data and people likely to be involved, the likely consequences and what we’re doing about it — and we’ll send further details as we learn them.

When your account closes, we’ll offer you an export of your data. After that, we’ll delete or anonymise the personal data we process for you, unless the law requires us to keep it — for example, financial records that must be kept for as long as the law requires accounting and VAT records to be kept. Anything we must keep stays protected under this agreement and is deleted when the legal requirement ends.

We’ll make available the information you reasonably need to show that we meet our obligations under this agreement, and allow for and contribute to reasonable audits and inspections by you or an auditor you appoint. We’ll agree the timing and scope with you in advance, and audits must respect the confidentiality and security of other dealers’ data.

Some of our sub-processors are based in, or process data in, the United States (see the sub-processors page). Where personal data is transferred outside the UK, we rely on the UK’s approved transfer mechanisms, such as the UK International Data Transfer Addendum or the UK–US data bridge where the provider is certified.

Questions about this agreement or how we process data for you: anaymakwana@icloud.com.