ChaufferDesk Data Processing Agreement

Last updated: 23 September 2026

This Data Processing Agreement ("DPA") forms part of the ChaufferDesk Terms of Service between the business using ChaufferDesk ("Customer", "you") and Alpha Bytes (SMC-Private) Limited, trading as Byte Solutions ("we", "us"). Our full company details are in section 15.

By accepting the Terms of Service, you accept this DPA. A signed copy is available on request from privacy@chaufferdesk.com.

1. Definitions

"Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and, where applicable, the EU GDPR. Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given in the UK GDPR. "Sub-processor" means a third party we engage to process Customer personal data.

2. Roles and scope

For personal data you store in ChaufferDesk about your passengers, clients, drivers and staff, you are the controller and we are the processor. The details of this processing are set out in Annex 1.

We are a separate controller for account, billing and enquiry data, as described in our Privacy Policy.

3. Your instructions

We process personal data only on your documented instructions. Your instructions are set out in the Terms of Service, this DPA and the way you configure and use the Service. If we believe an instruction breaks Data Protection Law, we will tell you.

If the law requires us to process personal data in another way, we will tell you before doing so unless the law prohibits it.

4. Your responsibilities

You are responsible for:

• having a lawful basis for the personal data you put into ChaufferDesk
• giving your passengers, clients and drivers the privacy information the law requires
• keeping the data accurate
• not storing more sensitive data than you need. For DBS checks, record completion and expiry dates only, not certificate contents or results

5. Confidentiality

Everyone we authorise to process Customer personal data is bound by a duty of confidentiality.

6. Security

We maintain technical and organisational measures appropriate to the risk, as described in Annex 2. We may update these measures as long as the overall level of protection is not reduced.

7. Sub-processors

You give us general authorisation to use the sub-processors listed in Annex 3.

We will give you at least 14 days' notice by email before adding or replacing a sub-processor. You may object on reasonable data protection grounds within that period. If we cannot resolve your objection, you may terminate your subscription and we will refund any prepaid fees for the unused period.

We will put a written contract in place with each sub-processor that includes data protection obligations equivalent to this DPA. We remain responsible to you for our sub-processors' performance.

8. International transfers

Customer personal data is hosted in Germany. We are established in Pakistan and access Customer personal data from Pakistan. Some sub-processors are located in the United States.

Where a transfer of personal data from the UK or EEA is not covered by an adequacy decision or adequacy regulations, the transfer is made under the EU Standard Contractual Clauses (Module Two: controller to processor) together with the UK International Data Transfer Addendum. The parties agree that these clauses are incorporated into this DPA, with the information in Annexes 1 to 3 used to complete them. Where this DPA conflicts with those clauses, the clauses apply.

9. Helping you

We will promptly pass on any request we receive from a data subject about Customer personal data and will not respond to it ourselves except on your instruction. We will help you respond to such requests, mainly through the Service's features, and otherwise as reasonably needed.

We will provide reasonable help with data protection impact assessments and any consultation with a supervisory authority that relates to our processing.

10. Personal data breaches

We will notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer personal data. We will give you the information we have and keep you updated, and we will take reasonable steps to contain the breach and reduce its effects.

11. Deletion and return

When your subscription ends, you may request an export of your data within 30 days. We will then delete Customer personal data within 90 days, unless the law requires us to keep it. Copies in backups are deleted as those backups expire.

12. Information and audits

We will make available the information reasonably needed to show that we comply with this DPA, including answering reasonable written security questionnaires.

If that information is not enough, you may carry out an audit, or have an independent auditor do so, no more than once a year, on at least 30 days' written notice, during normal business hours and at your own cost. This limit does not apply after a personal data breach or where a supervisory authority requires an audit.

13. Liability

Each party's liability under this DPA is subject to the limits in the Terms of Service.

14. Order of precedence

On data protection matters, this DPA takes priority over the Terms of Service.

15. Company details

Alpha Bytes (SMC-Private) Limited, a company registered in Pakistan (registration number 0337824), trading as Byte Solutions.

Registered address: 20-A D/1, Mezzanine Floor, Liberty Tower, Block D1, Gulberg III, Lahore, Punjab, Pakistan

Email: privacy@chaufferdesk.com

Annex 1: Details of processing

Subject matter. Provision of the ChaufferDesk booking, billing and compliance platform.

Duration. The term of your subscription, plus the export and deletion periods in section 11.

Nature and purpose. Hosting, storing, organising, displaying and transmitting data to provide booking intake and management, job dispatch, invoicing, compliance and expiry tracking, fare suggestions, flight status lookups and notifications.

Categories of data subjects.

• Your passengers, clients and the people who book on their behalf
• Your drivers
• Your staff who use ChaufferDesk

Categories of personal data.

• Passengers and clients: names, email addresses, phone numbers, pickup and drop-off addresses, journey dates and times, flight numbers, booking notes, and invoice and billing details
• Drivers: names, contact details, login details, assigned jobs, driving licence and PHV licence details and expiry dates, and DBS check completion and expiry dates
• Staff: names, email addresses, roles and login activity
• Vehicle records, including registration numbers, which may relate to an individual where a vehicle is owned by a sole trader

Special category data. None intended.

Criminal offence data. Limited to DBS check completion and expiry dates where you choose to record them.

Frequency. Continuous for the duration of your subscription.

Location. Hosted in Germany. Accessed from Pakistan.

Annex 2: Security measures

• All connections to the Service are encrypted with HTTPS/TLS
• Authentication uses secure httpOnly session tokens, with rate limiting on login attempts
• Role-based access: drivers can see only their own jobs, and admins can access only their own company's account
• Each customer's data is kept separate, with separation enforced at the database query level
• The public booking endpoint uses per-customer API keys, input validation and rate limiting
• Secrets and credentials are held as runtime configuration and not stored in source code
• Production access is limited to authorised personnel
• Hosting in ISO 27001 certified data centres operated by Hetzner in Germany
• Regular database backups
• Error monitoring to detect and fix problems quickly
• Periodic security reviews of the application's code and configuration

Annex 3: Sub-processors