Enterprise data processing
Final draft, version 1.1
CONTRACTUAL TERMS FOR PROCESSOR ACTIVITIES
Enterprise data processing addendum
This addendum forms part of the enterprise agreement where RacingEdge processes personal data on the enterprise's behalf. It takes precedence for that processing. It does not convert independent-controller activities, including RacingEdge account administration or a provider's own regulated checks, into processor services. Applicable data-protection law includes the UK GDPR and Data Protection Act 2018 as amended.
C1 Scope and instructions
This addendum applies to Storage, Events, Dealership and Suppliers where the enterprise is controller and RacingEdge is processor for C7 activities. RacingEdge processes data only on documented lawful instructions, including transfers, unless law requires otherwise; it notifies the enterprise where permitted. It informs the enterprise if an instruction appears to infringe applicable data-protection law. The enterprise supplies lawful instructions, necessary notices and authority for collection and sharing. Each subscribed module must be included in the agreed processing schedule.
C2 Confidentiality and security
RacingEdge restricts access to personnel bound by confidentiality and applies appropriate technical and organisational measures under applicable data-protection law. The agreed security schedule must describe actual access control, encryption where appropriate, tenant separation, logging, secure development, incident handling, backup, restoration and regular assessment. Controls must address sensitive identity documents and vehicle-location information without promising a certification or capability not in place.
C3 Subprocessors and transfers
The enterprise authorises the subprocessors listed in the agreed register. RacingEdge gives advance notice of additions or replacements and a reasonable opportunity to object on data-protection grounds, with timing stated in the order. The parties seek a workable alternative; if none is available, they agree an orderly exit from the affected service. Subprocessors are bound by equivalent relevant obligations, and RacingEdge remains responsible for their performance of those obligations. Restricted transfers require the agreed lawful mechanism and assessment.
C4 Requests incidents and assistance
RacingEdge promptly passes relevant individual requests to the enterprise, assists it with rights responses, security, impact assessments and regulator consultation, and does not independently answer on its behalf unless instructed or legally required. It notifies the enterprise of a personal-data breach without undue delay after awareness, supplies available information and updates, and cooperates in containment and required notifications. The incident contact and operational escalation targets are recorded in the order; they must allow the controller to meet its legal deadlines.
C5 Audit and accountability
RacingEdge provides information needed to demonstrate compliance and permits and contributes to reasonable audits and inspections by the enterprise or its authorised auditor. Normal planning, confidentiality and protection of other customers apply, but must not prevent a necessary regulatory or incident-related audit. Any agreed charges must not frustrate statutory cooperation.
COMPLETE WITH EACH ENTERPRISE ORDER
Enterprise processing schedule
C6 Return and deletion
At the end of the processing service, the enterprise chooses return or deletion of its personal data, with secure export and deletion of copies unless law requires retention. The enterprise order records the export format, return window, active deletion period and backup cycle before processing begins. An omitted schedule does not authorise indefinite retention; the parties must complete it before the affected processing starts. Retained backups must remain protected and outside ordinary use until deleted. The schedule must not permit indefinite retention or allow account closure to strand a customer's money or essential transaction evidence.
| C7 Processing particulars | Agreed scope |
|---|---|
| Subject and duration | Enterprise customer and vehicle administration for the subscribed module, for the contract term and agreed return/deletion period. |
| Nature of processing | Collection, storage, access, search, organisation, authorised sharing, document extraction where enabled, communication, export, correction and deletion. |
| Purpose | Operate the enterprise's selected storage, dealer, supplier, transport or event workflows under its instructions. No independent advertising or model-training purpose is included. |
| People concerned | Customers and owners, prospective customers, authorised drivers/collectors, enterprise staff, supplier contacts and event participants. |
| Data categories | Contact and account identifiers; vehicle and condition records; documents/media; bookings; custody reports; messages; transaction references; permissions and audit records. |
| Excluded or restricted data | Special-category data, criminal-offence data and biometric identification are not routine inputs. Do not enable them without a defined lawful basis, additional safeguards and an amended schedule. |
| Controller rights and duties | Decide purposes and lawful instructions; provide notices, maintain accuracy and authorisation; answer rights requests; oversee retention and lawful sharing. |
| Contacts and vendors | The enterprise order identifies the controller and incident contacts and incorporates the approved subprocessor, location and transfer-safeguard register. RacingEdge can be contacted through Contact us on racingedge.com. |
C8 Enterprise sharing and staff permissions
A company connection, invitation or paid subscription does not authorise access to all owner records. Limit staff and connected organisations to the cars, bookings and documents needed. Maintain a record of grants, revocations and material edits. If a business determines its own purpose for a disclosure, it must provide the appropriate notice and lawful basis as controller; an owner's app click does not cure an unlawful disclosure.
Required attachments to the enterprise order: completed processing schedule; current subprocessor/transfer register; implemented security measures; incident contacts; export/deletion timings. These are substantive contract details, not optional website boilerplate.