BFT Vault Data Processing Notice
This Notice forms part of our Terms and Conditions of Service (clause 12). It sets out how BFT processes personal data on your behalf when you use BFT Vault with BFTi, as required by Article 28 of the UK General Data Protection Regulation (UK GDPR). Words defined in the Terms and Conditions have the same meaning here.
Our roles
You, the Client (the operator), are the controller of the personal data in your BFT Vault. BFT is your processor. You decide why the data is used; BFT processes it only to provide BFT Vault with BFTi to you.
What we process
| Item | Detail |
|---|---|
| Subject matter | Providing BFT Vault with BFTi: holding electronic copies of your compliance documents and images so that they can be processed, analysed and reported on. BFT Vault is not a document storage or record-keeping system; you keep the originals |
| Duration | Your subscription, then a Retention Period of no longer than 15 months (Terms clause 4.4) |
| Nature and purpose | Processing and analysis of the copies by BFTi, reporting, alerts, human support within your tier, and the read-only archive of copies for regulator access after your subscription ends |
| People whose data is processed | Your drivers, staff, Transport Manager, directors, contractors and Vault users |
| Types of personal data | Names and contact details; driving licence, entitlement and Driver CPC details; tachograph, drivers' hours and working-time records; defect, walkaround and training records; vehicle records linked to people; Vault user accounts and activity records |
| Special category data | Only where you upload it, for example medical fitness information. You must have a lawful basis for doing so |
What BFT will do
- Process the data only on your documented instructions. Your instructions are these Terms and Conditions, this Notice, and your use and settings of BFT Vault with BFTi. If the law requires us to process the data in another way, we will tell you first, unless the law prevents us. If we think an instruction breaks data protection law, we will tell you.
- Make sure everyone at BFT who can access the data is bound by confidentiality.
- Keep the data secure with appropriate technical and organisational measures, including encryption in transit and at rest and individual user sign-in.
- Use other processors (sub-processors) only for hosting, email and the AI service used by BFTi, under written terms that protect the data to the same standard. You authorise these sub-processors. We will give you a list on request and tell you before we add or replace one, so you can object.
- Transfer data outside the UK only with a lawful safeguard, such as UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.
- Help you respond to requests from people exercising their data rights, free of charge. If we receive a request directly, we will pass it to you promptly.
- Tell you without undue delay after becoming aware of a personal data breach affecting your data, and help you meet your own obligations, including notifying the ICO where required.
- Help you with data protection impact assessments and consultations with the ICO where relevant to the Vault.
- Give you the information you reasonably need to show that these obligations are met, and allow audits by you or your appointed auditor on reasonable notice.
When your subscription ends
While your subscription is active, including any notice period, you can download your documents free of charge. When your subscription concludes, we hold the copies for no longer than 15 months, in a closed, read-only archive, only so that a Regulatory Authority can access them (Terms clause 4.4). A Regulatory Authority with a lawful request is given access to the copies as they stand at the date and time of the request; any cost of that access is payable by you, as quoted at the time (Terms clause 4.6). At the end of that period, we securely delete the copies, unless you have re-subscribed or the law requires us to keep them.
BFTi
BFTi reviews the records in your Vault and produces flags, reports and suggested actions, and compliance scores where your subscription tier includes them, for you and your Transport Manager to check and act on. BFTi does not make decisions about your drivers or staff that have legal or similarly significant effects (Terms clause 4.8).
Your responsibilities as controller
- Have a lawful basis for the personal data you upload and tell your drivers and staff, in your own privacy notice, that their data is held in BFT Vault with BFTi.
- Upload only the data you need for compliance purposes.
- Keep your original records for as long as the law requires (Terms clause 4.4).
- Manage who in your organisation has access to your Vault, and keep sign-in details secure.
Contact
Questions about this Notice: info@bftconsulting.co.uk or 0330 179 7379. Our Privacy Policy explains how we use personal data for our own purposes: www.bftconsulting.co.uk/privacy-policy.