Smart Buy Data Processing Agreement
This DPA forms part of the Terms where LBM Developments Limited (“Processor”) processes personal data for the subscribing business (“Controller”). LBM acts independently as controller for account administration, billing, security and legal duties under the Privacy Notice.
1. Processing
Purpose: host, secure, retrieve and display account material and run requested checks. Duration: subscription plus deletion, backup and legal retention. People: Controller staff, contractors, customers or vehicle contacts entered by users. Data: ordinary contact/identity information, registrations, vehicle records, photographs, notes and activity. Smart Buy is not intended for unnecessary special-category or criminal-offence data.
2. Instructions
Processor acts only on documented instructions in the Terms, configuration, authorised actions and support requests unless UK law requires otherwise, and will flag an apparently unlawful instruction.
3. Confidentiality and security
Authorised personnel are bound by confidentiality. Measures appropriate to risk include access controls, business separation, secure sessions/transport, restricted credentials, webhook verification, audit logs, monitoring and recovery.
4. Sub-processors and transfers
Controller authorises providers needed for hosting/databases, payments, communications/support, security and requested data/valuation/marketplace functions. Processor imposes appropriate terms, provides current information on reasonable request and gives required notice of material changes. Restricted transfers use a lawful UK safeguard.
5. Assistance and incidents
Processor will reasonably assist with rights requests, security, breaches, impact assessments and regulators, and notify Controller without undue delay after learning of a breach affecting Controller data. Controller remains responsible for lawful basis, notices, data accuracy/minimisation, users and instructions.
6. Return, deletion and audit
On closure, eligible Controller data may be returned or deleted subject to legal retention, disputes, fraud prevention and backups. Processor will provide information reasonably needed to demonstrate compliance. Audits must be proportionate, protect others and confidential systems, use existing reports first, and occur on reasonable notice; Controller bears cost unless a material Processor breach is found.
7. Priority and law
This DPA prevails over conflicting processing terms. English law and the Terms’ jurisdiction apply. Contact admin@brakerbase.co.uk.