Data Processing Addendum

    Last updated: July 2026

    This Data Processing Addendum (DPA) applies when SafeTripAlert processes personal data on behalf of a customer acting as a controller (for example a company deploying SafeTripAlert to protect field staff). For personal use, our Privacy Policy governs instead.

    1. Roles

    Customer is controller; SafeTripAlert is processor. Each party complies with GDPR, UK GDPR, NDPA, and other applicable law.

    2. Scope of processing

    • Subject-matter: providing the SafeTripAlert service.
    • Duration: term of the customer's subscription.
    • Nature and purpose: location sharing, notifications, safety alerts.
    • Data types: account identifiers, location, safety events, trusted-contact details.
    • Data subjects: authorised users and the trusted contacts they nominate.

    3. Subprocessors

    Approved subprocessors: cloud hosting/database/auth/functions, map tile provider, WhatsApp/SMS gateway. We give 30 days' notice before adding or replacing a subprocessor.

    4. International transfers

    Transfers outside the EEA / UK / Nigeria are covered by the EU Standard Contractual Clauses (2021/914), the UK IDTA, and supplementary technical measures (TLS in transit, AES-256 at rest, tokenised tracking links, RBAC).

    5. Security measures

    • TLS 1.2+ in transit; AES-256 at rest.
    • Row-level security on every user-facing table.
    • Least-privilege role separation.
    • Human-verification token gate on account creation.
    • Automatic revocation of tracking tokens on journey completion.
    • Continuous security scanning and dependency auditing.

    6. Breach notification

    We notify the customer without undue delay and within 72 hours of becoming aware of a personal-data breach affecting the customer's data.

    7. Data-subject requests

    We assist the customer in responding to data-subject requests through admin tooling and, on request, direct export or deletion.

    8. Return & deletion

    On termination we delete or return customer personal data within 30 days, unless retention is required by law.

    9. Audit

    Annual audit summaries on request. On-site audits available under reasonable notice and confidentiality terms.

    To countersign this DPA, contact legal@safetripalert.com.