Version 2026-11-02b · Autovio Ltd · Company No. 17547009 · 89 Fengate, Peterborough, PE1 5BA, United Kingdom · post@autovio.uk
This data processing agreement forms part of the terms of Autovio Dealer and applies when Autovio Ltd ("Processor") processes personal data on behalf of the dealer ("Controller"), as required by Article 28 UK GDPR / GDPR.
Purpose: providing Autovio Dealer – agreements and signing, customer and vehicle records, leads, invoices, reports and export. Data subjects: the dealer's customers, sellers, buyers, contact persons and staff. Data: names, contact details, addresses, company numbers, vehicle and agreement details, signatures, IP address and device at signing, BankID name and date of birth, vehicle photos. No special category data is expected. Duration: for as long as the customer relationship lasts, then deletion under section 7.
The Processor processes the data only on the Controller's documented instructions (these terms and the use of the service) and will inform the Controller if an instruction infringes data protection law. Everyone with access is bound by confidentiality.
The Processor implements measures under Article 32, including encrypted transport (HTTPS), separation of each dealer's data, role-based access with deactivation, log-in throttling, signature audit logs, daily backups and regular security reviews.
The Controller authorises these sub-processors: Fly.io (hosting and storage, London), one.com (email), Criipto/Idura (BankID), Stripe (the dealer's own payments only). New sub-processors are notified at least 30 days in advance and the Controller may then terminate. The Processor imposes equivalent obligations on sub-processors.
Data is stored in the United Kingdom. Any transfer outside the UK/EEA takes place only with a valid transfer mechanism.
The Processor assists with data subject requests, impact assessments and security. Personal data breaches are notified to the Controller without undue delay and at the latest within 48 hours of discovery. The Processor provides the information needed to demonstrate compliance and allows audits on reasonable notice.
On termination the Controller can export all agreements and invoices. The data is deleted 90 days after termination, and from backups within a further 60 days, unless law requires retention.
Terms of service · Privacy policy · Data processing agreement