This is a template, not a signed contract. There is no single official "ICO DPA template" — the ICO publishes guidance on what UK GDPR Article 28 requires a processor agreement to contain, and this document is drafted against that guidance for Racso's actual data flows (described in our Privacy Policy). It has not been reviewed by a solicitor. Before relying on this as a binding contract — for either party — please have it reviewed by your own legal advisor. To get a countersigned copy, email hello@racsosolutions.co.uk.
1. Parties
This Data Processing Agreement ("DPA") is between:
- The Controller — the car dealership business that holds a Racso account ("you", "the Customer"); and
- The Processor — Racso Solutions, a sole trader operating in the United Kingdom ("Racso", "we").
This DPA forms part of, and is incorporated into, our Terms & Conditions. If there's a conflict between this DPA and the Terms on data protection matters, this DPA takes priority.
2. Subject matter and duration
Racso processes personal data on your behalf for as long as your Racso account is active, plus the post-closure retention period set out in our Privacy Policy (currently 30 days, to allow export, then deletion).
3. Nature and purpose of processing
Racso processes personal data to: receive and respond to SMS messages from your leads; qualify leads via an automated conversation; check and reserve test-drive appointment slots; send same-day SMS reminders; look up a vehicle registration against the DVLA's public vehicle data, where you use that feature; and display all of the above to your staff in the Racso dashboard.
4. Types of personal data processed
- Lead's phone number
- Lead's name, if given during the SMS conversation
- The content of SMS messages exchanged between the lead and the Racso bot
- Vehicle interest, budget, and timeframe, as stated by the lead
- Appointment date, time, and status
- Your staff's login credentials (email/username, hashed password) and account activity
Racso does not intentionally collect special category data (e.g. health, religion, ethnicity) about leads, and asks you not to configure custom qualifying questions that would solicit it.
5. Categories of data subjects
- Your leads — members of the public who have texted your dealership's Racso number
- Your staff — the individuals you give dashboard logins to
6. Racso's obligations as processor (UK GDPR Article 28)
Racso agrees to:
- Process personal data only on your documented instructions (including this DPA and our published Terms), unless required to do otherwise by UK or EU law — in which case we'll tell you before processing, unless the law prohibits telling you
- Ensure everyone with access to the data is bound by confidentiality
- Implement appropriate technical and organisational security measures (encryption in transit, access controls, see our Privacy Policy §6)
- Not engage a sub-processor without your general authorisation (given by this DPA for the sub-processors listed in §7 below), and to flow down the same data protection obligations to any sub-processor we do use
- Assist you, taking into account the nature of the processing, in responding to data subject rights requests (access, erasure, portability, etc.) and in meeting your own obligations around security, breach notification, and data protection impact assessments
- Notify you without undue delay after becoming aware of a personal data breach affecting your leads' data
- At your choice, delete or return all personal data to you at the end of the relationship, and delete existing copies (subject to any legal requirement to retain it — see our Privacy Policy's retention table)
- Make available to you the information reasonably necessary to demonstrate compliance with this Article, and allow for and contribute to reasonable audits, including inspections, conducted by you or an auditor you mandate — with reasonable notice and during business hours
7. Authorised sub-processors
You authorise Racso to engage the following sub-processors, each processing only what's needed for its specific function:
| Sub-processor | Function | Location |
|---|---|---|
| Twilio | SMS sending and receiving | USA (SCC-covered) |
| Railway | Application and database hosting | USA (SCC-covered) |
| Google (Gmail) | Sending booking-confirmation and digest emails | USA (SCC-covered) |
| DVLA Vehicle Enquiry Service | Vehicle registration lookups (no personal data sent — see §4) | UK |
We'll give you at least 30 days' notice before adding or replacing a sub-processor that processes your leads' personal data, so you have the chance to object on reasonable data-protection grounds.
8. International transfers
Where a sub-processor above is located outside the UK/EU, Racso relies on Standard Contractual Clauses (SCCs) or an equivalent recognised transfer mechanism with that sub-processor.
9. Liability
Liability under this DPA follows the limitation of liability set out in our Terms & Conditions §9, except to the extent that liability cannot lawfully be limited (for example, liability arising from Racso's own breach of UK GDPR as a processor).
10. Term and termination
This DPA remains in effect for as long as Racso processes personal data on your behalf under your Racso account, and terminates automatically when that processing ends (see §2).
11. Governing law
This DPA is governed by English law, consistent with our Terms & Conditions.
12. Requesting a countersigned copy
Email hello@racsosolutions.co.uk with your business name and account email to request a version of this DPA signed by both parties.
See also: Privacy Policy · Terms & Conditions · Refund Policy · Cookie Policy