Data Processing Agreement (DPA)
_Last updated: 15 October 2026 · Version 10_
This Data Processing Agreement ("DPA") forms part of the agreement between Coachcomp Limited trading as CoachComp ("Processor") and the operator using the Service ("Controller") and applies whenever CoachComp processes personal data on the Controller's behalf.
1. Processor details
- Registered company: Coachcomp Limited, registered in England and Wales, company number 17362338
- Registered address: SY11 4EE, England
- ICO registration reference: ZC223321
- Contact: info@coachcomp.co.uk
2. Definitions
Capitalised terms follow the meanings in the UK GDPR and the Data Protection Act 2018.
3. Subject matter and duration
- Subject matter: processing personal data supplied by the Controller in connection with the CoachComp compliance platform.
- Duration: for as long as the Controller holds an active CoachComp account, plus any post-termination retention required by law.
- Hosting: the CoachComp platform is running on Amazon Web Services in the EU (Ireland region, eu-west-1) through Lovable Cloud. Stored personal data (database, files and backups) stays in that region; limited processing by listed subprocessors outside the UK/EEA is described in section 9.
4. Nature and purpose of processing
Storage, transmission, structuring, retrieval, analysis (including AI-assisted features), and deletion of Controller data for the purpose of transport-compliance management (O-licence records, drivers, vehicles, policies, audits, cases, Q&A).
5. Categories of data subjects
- Controller's staff (operator admins and users)
- Controller's drivers and other operational personnel
- Third parties named in incident, case or audit records
6. Categories of personal data
Identity data (name, contact details), employment data (licence, CPC, medical, endorsements, training records), operational data (vehicle assignments, tacho, MOT, defects, incidents), account credentials, and any additional data the Controller chooses to upload.
6.1 Data shared with AI features
When a user in the Controller's account uses an AI-assisted feature (Q&A, policy review, audit drafting or similar), CoachComp sends the minimum fields needed to answer that request to the AI providers listed in Annex A, at the Controller's documented instruction as part of using the Service, and only for the duration of that request: the question or task itself, and the text of the specific record it concerns — typically policy text, a case title and category, a check type and its notes, and the name of a driver where the request refers to that driver by name. Driving licence numbers, dates of birth, addresses and contact details, medical information, endorsements, drug and alcohol test results, and any other identity or employment fields are never transmitted to any AI provider. This is enforced in the software: no AI feature reads those fields. Free-text notes are sent as written, so users should not type sensitive personal details into notes or questions they use with AI features.
6.2 Lite plan workspaces
On the Lite plan, CoachComp does not hold driver, staff or vehicle records. The Platform blocks those records from being created, so the personal data processed for a Lite workspace is limited to the account and login details of the operator's own users, and any personal data a user chooses to type into a question, audit answer, management review or policy, or include in an uploaded document. The operator remains the controller for that content and should avoid including personal data that is not needed. If the workspace upgrades, the full categories in section 6 apply from that point.
7. Processor obligations (Art. 28 UK GDPR)
CoachComp shall:
1. Process personal data only on documented instructions from the Controller, including with respect to international transfers.
2. Ensure personnel authorised to process personal data are subject to confidentiality.
3. Implement appropriate technical and organisational measures, including encryption in transit and at rest, row-level access controls, server-side authentication, least-privilege database roles, logging and monitoring.
4. Not engage a subprocessor without general prior authorisation. A current list of subprocessors is set out in Annex A and on the public subprocessors page. CoachComp will tell the Controller about any new or replacement subprocessor by email to the workspace admins and by updating that page at least 30 days before it starts processing the Controller's data (or as soon as possible where a change is urgently needed for security or continuity). The Controller may object on reasonable data-protection grounds within that period. CoachComp will then work with the Controller in good faith to resolve the objection, for example by not using that subprocessor for the Controller's data. If it cannot be resolved, the Controller may end the subscription without penalty before the change takes effect and receive a pro-rata refund of any prepaid fees.
5. Assist the Controller, taking into account the nature of the processing, with responding to data-subject rights requests, security, breach notification, DPIAs and prior consultations.
6. Notify the Controller without undue delay after becoming aware of a personal-data breach, and in any event within 72 hours where feasible.
7. At the Controller's choice, delete or return all personal data at the end of the provision of services, save where retention is required by law.
8. Make available all information necessary to demonstrate compliance with Art. 28 and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller, on reasonable notice and subject to confidentiality.
8. Backups and deletion
- When the Controller deletes a record, or an erasure request is completed, the data is removed from the live database immediately.
- Encrypted backups are retained for operational recovery only, are held in the same EU (Ireland, eu-west-1) region as the live Service, and are overwritten on a short rolling cycle (approximately 7 days), after which deleted data is irrecoverable.
- Erasure requests are re-applied to any restore that occurs before natural backup expiry.
9. International transfers
The Controller's stored data (the database, files and backups) is held in the EU (Ireland, eu-west-1) and is not moved out of that region. Separately, a limited set of data may be processed outside the UK/EEA by the subprocessors marked as such in Annex A, only for the specific purpose listed (for example Perplexity receives only the wording of a question to search public web pages, and Stripe processes billing details). Where personal data is transferred outside the UK, CoachComp relies on adequacy decisions or the UK International Data Transfer Addendum to the EU SCCs, or such other safeguard as is recognised by law.
10. Liability and precedence
To the extent of any conflict, this DPA prevails over other terms in relation to the processing of personal data. Nothing in this DPA limits either party's obligations under UK data-protection law.
11. Signatures
This DPA is entered into by acceptance of the Service terms and does not require a wet signature. On written request, CoachComp will provide a countersigned copy.
---
Annex A — Subprocessors
| Subprocessor | Purpose | Location |
|---|---|---|
| Lovable Cloud (Supabase) | Hosting, database, authentication, storage | EU (Ireland, eu-west-1) |
| Lovable AI Gateway (Google Gemini / OpenAI) | Model routing for AI features | EU / US (SCCs + UK IDTA) |
| Perplexity | Research citations for Q&A | US (SCCs + UK IDTA) |
| DVSA MOT History API | Vehicle MOT lookups | UK |
| Stripe | Subscription billing | EU / US (SCCs + UK IDTA) |
Annex B — Technical and organisational measures
- Encryption in transit (TLS 1.2+) and at rest (AES-256)
- Row-Level Security on all user-data tables, scoped to authenticated user or operator
- Bearer-token authenticated server functions; service-role access limited to trusted server-only paths
- Automated retention sweeps with audit logging (`retention_events`)
- Access logging, encrypted backups in the EU (Ireland) region overwritten on a rolling cycle of approximately 7 days, and staff access on a need-to-know basis
Annex C — Controller details
To be completed by the Controller on execution or as recorded in the Controller's CoachComp account.
---
Annex D — Data processing Q&A
Plain-English answers to the questions operators most often ask about how their data is handled. The formal wording of this agreement takes precedence over this annex if the two ever differ.
Where is our data hosted?
Your CoachComp account runs on Lovable Cloud, which in turn runs on Amazon Web Services in the EU (Ireland region, eu-west-1). Your database, uploaded files and backups are stored there and are not moved out of that region. A few listed services process small, specific pieces of data elsewhere when you use them — see "Does any data leave the Ireland region?" below.
Where are database backups stored?
In the same EU (Ireland) region as the live service. Backups are encrypted and are never copied outside it.
Where are disaster-recovery copies stored?
In the same region. We do not maintain a separate disaster-recovery site in another country — recovery is from the encrypted backups held in Ireland.
Are driver licence numbers ever sent to any AI provider (Lovable AI Gateway, Google, OpenAI or Perplexity)?
No. No AI feature in CoachComp ever reads or transmits a driving licence number. Section 6.1 above lists the only fields AI features can carry.
Can Lovable Cloud or CoachComp staff read our database?
The hosting provider operates the managed service as a listed subprocessor, and its staff access is limited to operating and supporting the service. CoachComp's own access is on a need-to-know basis, and only ever to help you. Your data is also protected by per-workspace access controls, so no other customer can see it.
How is our data encrypted, and who controls the encryption keys?
Data is encrypted in transit (TLS 1.2+) and at rest (AES-256). The encryption keys are managed by the hosting platform on AWS — neither you nor CoachComp holds the raw keys, which keeps key handling out of both companies' hands.
What happens to our data if we cancel CoachComp?
You export everything first (Settings → Your data → Download JSON), then submit an erasure request from the same page. Deletion from the live database is immediate; encrypted backups are overwritten on a roughly 7-day rolling cycle, after which your data is irrecoverable. Your O-licence business records are yours — export them and keep them.
Can we get a complete export and then have everything permanently deleted?
Yes — both are on the same page (Settings → Your data). Admins and transport managers get a full download of the workspace's records, including the complete compliance history and document download links; the erasure request anonymises your user profile and deletes your records (except records the law requires to be kept, which are kept or anonymised as set out in the Data Retention Policy), and erasure is re-applied to any backup restore that happens before the backup cycle expires.
Is there a current signed DPA covering our particular account?
Yes — this document. It is accepted as part of the Service terms, and each member of your team's acceptance is recorded in your account with the date and time. If you need a copy countersigned by CoachComp for your files, write to info@coachcomp.co.uk.
Exactly what does each AI feature send away?
- Compliance Q&A: just the question you type, plus public gov.uk/DVSA research used to answer it.
- Workspace advisor (answers about your own data): your question, plus the text of the record it concerns — policy text, case titles and categories, check types and notes, and a driver's name only when your question names that driver.
- Policy review: the policy text only.
- Audit summaries: template names, counts and case references.
- Incident triage: only what you type into the incident form, plus your policy text.
- Web research (Perplexity): only the question wording, to search public gov.uk/DVSA pages.
Never sent to any AI provider: licence numbers, dates of birth, addresses or contact details, medical information, endorsements, or drug and alcohol test results (see section 6.1).
Does any data leave the Ireland region?
Your stored records never do — the database, files and backups stay in Ireland. When you use certain features, a small and specific piece of data is sent to a listed subprocessor for that one task: AI features send only the fields described in section 6.1; Perplexity receives only the wording of a question to search public gov.uk/DVSA pages (US-based, covered by the UK International Data Transfer Addendum); Stripe processes billing details. Each is listed in Annex A with its location and safeguard.
Is our data used to train AI models?
No. The AI providers used through the gateway do not train their models on data sent from CoachComp.
Can we delete a single driver's record and be sure it is gone?
Yes — the same rule as full erasure: the record is removed from the live database immediately, is gone from backups at the end of the roughly 7-day cycle, and erasure is re-applied if a restore happens in between.
Who else can see our data inside CoachComp?
Only the members of your own workspace, with access scoped by their role. Other customers' workspaces are fully isolated. CoachComp staff see your data only when you ask us to help, on a need-to-know basis.
What is your ICO registration?
CoachComp's registration reference is ZC223321 (listed in section 1 above).
Where do driving licence checks come from, and how often are they done?
CoachComp does not check licences with the DVLA automatically. Licence details and check dates are exactly what your team records or imports — CoachComp does not interpret them, it only works out reminder dates from them. You choose how often to check (for example through the DVLA's online service) and record the result. See section 9.1 of the Terms.
What if CoachComp shows the wrong licence status because of its own error?
We will fix it as a priority once we know, tell you what happened and help you check affected records. Liability is covered by the single cap in section 11 of the Terms.
Does the liability cap apply to data breaches, security incidents, data loss and incorrect information?
Yes. One cap (the fees you paid in the 12 months before the event giving rise to the claim) applies to all claims, except where the law does not allow liability to be limited. It does not reduce either party's legal data-protection duties.
Does the export contain our complete compliance history?
Yes. Admins and transport managers can download everything from Settings → Your data: drivers, vehicles, discs, Driver Quality checks, training, cases and actions, tasks, audits, policies and versions, management reviews, activity trails, agreement records, and download links for every stored document (links last 7 days).
Can drug, alcohol and medical records have separate access from ordinary driver records?
Driver Quality (which holds alcohol, drug, eyesight and health checks) is a separate area that admins can switch on or off for each role and each person in Settings, independently of the Drivers list. A finer split inside Driver Quality is not available today; tell us if you need it.
What are your uptime and recovery targets?
99.5% availability per month, recovery within 24 hours, and no more than 24 hours of data lost in a major incident. These are targets, not guarantees (section 10 of the Terms).
How will we hear about new subprocessors, and what if we object?
By email to your workspace admins and on the public subprocessors page, at least 30 days in advance. If you object and we cannot resolve it, you can leave without penalty and get a pro-rata refund (section 7, point 4).
What happens if CoachComp stops trading or withdraws the platform?
You get at least 90 days' notice of a planned withdrawal with export available throughout. If the company stops trading, we will keep the platform available read-only for at least 30 days so you can export. We recommend downloading an export now and then for your own records.