This agreement covers the personal data that Amarine One (formerly Amarine Transport Systems), a trading name of Amarine Trans Ltd (“the Platform”, “we”), handles when your company (“the Operator”, “you”) uses the platform. It forms part of the Terms of Service and applies from the moment any personal data is placed on the platform.
0. Which role applies where
This is not one relationship, and saying so plainly matters more than saying it simply.
For the Operator’s own records, the Platform is a processor. This is everything the Operator collects to run its transport operation: the compliance documents it requires, vehicle checks, incidents, infringements, training and invoices. The Operator decides why and how; the Platform acts on its instructions and for no purpose of its own.
For a driver’s personal wallet, the Platform is a controller. A driver may hold an account with no employer at all, put their own documents in it, choose which companies see them, withdraw that choice, and keep everything when they leave. The Platform decides the purpose and means of that service, so it carries the responsibility for it. This is set out in section 11 and in the driver’s own privacy notice.
Where a driver shares a wallet document with the Operator, the Operator’s copy is the Operator’s record and this agreement applies to it. The same photograph can be processed twice, for two purposes, by two parties. The Platform keeps the two separable.
Sections 1 to 10 concern the processor relationship.
1. What is processed, and about whom
About the Operator’s drivers, the Operator’s office staff who hold accounts, and, where the Operator uses those parts of the platform, the staff of its garages and its own customers (names and contact details on bookings and invoices).
About drivers:
- Identity and contact details: name, driver reference, email address, telephone number, and the details printed on documents they provide.
- Compliance documents and photographs of them: driving licence, passport or identity card, Driver CPC card, digital tachograph card, DVLA and right-to-work check codes, the results of checks the Operator makes on gov.uk, and any other document the Operator requires, together with values read from them such as numbers, categories and expiry dates.
- A profile photograph, used only as an avatar. No facial recognition or biometric identification is performed, ever. No photograph on the platform is processed to identify anybody, so none is biometric data.
- Daily operational records: walkaround vehicle checks and their declarations, defect reports, fuel records, expenses and photographs of receipts.
- Incident reports, which may include photographs, the details of other parties, and information about injuries.
- Drivers’ hours infringements from tachograph analysis, the driver’s written explanation, their answers to knowledge checks, and their electronic signature.
- Where the driver invoices the Operator: invoice records and bank account details.
- Technical records: sign-in events, IP addresses, device and browser information, push notification tokens, and an audit trail.
Special category data. Information about injuries in an incident report is data concerning health and is special category data under Article 9. The Platform does not ask for it as a category of its own; it arises inside records the Operator needs.
Identity documents such as passports are not special category data, and neither is nationality. They are high-risk identity documents and are held under the strictest controls the Platform applies, which is a matter of security rather than of Article 9.
2. Purpose and instructions
The Platform processes this data only to provide the service, and will not use it for any other purpose or to train any machine learning model.
The Operator’s use of the platform, together with any written instruction it gives, is its documented instruction. The Platform will tell the Operator if, in its opinion, an instruction infringes data protection law.
3. People with access
Only Platform personnel who need access to run and support the service have it. They are bound by confidentiality. Access is logged.
4. Sub-processors
- Supabase: database, file storage and server functions. United Kingdom (London).
- Hostinger: hosting of the website and of the web applications’ pages. United Kingdom, with backups in Germany. No personal data from the platform is stored there.
- Resend: the platform’s emails, such as invitations, reminders, invoices and inspection sheets. A United States company. See section 5.
- OpenAI: reading uploaded and emailed documents, receipts and tachograph analysis letters, and answering questions in the assistants. United States. See section 5.
- Anthropic: an alternative provider for the assistants only. United States. Named here because it is present in the platform and may be enabled; the Operator will be told before it is.
- Apple and Google: delivery of push notifications. They receive the notification and a device token, not the underlying records.
- Cloudflare: protection of the public registration form against automated abuse.
The Platform will give reasonable prior written notice before adding or replacing a sub-processor, and not less than 15 days, except where a change is forced on the Platform sooner by its own supplier or by a security need, in which case notice will be given as early as it can be.
The Operator may object on reasonable data protection grounds. If it does, the Platform will offer a reasonable alternative, or switch off the affected feature for that Operator, or, if neither is possible, the Operator may end the affected part of the service without penalty.
5. Transfers outside the United Kingdom
Document reading and the assistants send content to OpenAI in the United States, and the platform’s emails are sent through Resend, a United States company.
Mechanism. Each transfer is made under safeguards recognised by UK law: for OpenAI, the EU Standard Contractual Clauses as modified by the UK International Data Transfer Addendum, Module Three, under OpenAI’s data processing addendum; for Resend, the UK Extension to the EU-US Data Privacy Framework or the International Data Transfer Addendum. The Platform keeps a copy of the terms it accepted.
Assessment. The Platform has carried out, and keeps under review, a transfer risk assessment (the Information Commissioner’s “data protection test”) for these transfers, and will make it available to the Operator on request.
Measures actually in place, rather than a general assurance:
- Requests to OpenAI are sent with store: false, so no copy of the response is kept by the vendor.
- What is sent is the item being read and no more. Employment history, infringement history, bank details, other drivers’ data and the rest of the Operator’s records never go with it.
- Reading a compliance document also sends the driver’s reference code at the Operator, so that the reading can be matched to the right record. Reading a receipt or a wallet document sends neither the driver’s name nor the Operator’s.
- The assistants are different, and are described separately. When somebody asks a question, what is sent is their question in their own words, their name, the Operator’s name, the records the question needs, and a photograph if they attach one. A question is free text: it can contain whatever the person chooses to write, including information about their own health if they mention it. Drivers are told this in their privacy notice. An Operator that does not want this may have the assistants switched off.
- What Resend receives is the email itself: the address it goes to, what it says and any document attached to it, such as an invoice.
- Content is sent over encrypted connections and is not written to any intermediate store by the Platform.
- The data is not used to train models, under the terms accepted.
The Operator may ask the Platform to switch off the features that make the OpenAI transfer. Document details are then entered by hand and the assistants are unavailable; nothing else is affected.
All other processing takes place in the United Kingdom or the European Economic Area.
6. Security
- Access is denied by default at the database level and granted only by named rules. A driver can reach only their own records; an Operator only its own.
- Documents and photographs are held in private storage, never publicly addressable, and released only through links that expire within minutes.
- Data is encrypted in transit and at rest.
- Office accounts support two-step sign-in.
- Changes are written to an audit trail that cannot be edited.
- Every release is tested against an automated suite that includes the access boundaries themselves.
7. Personal data breaches
The Platform will tell the Operator without undue delay after becoming aware of a personal data breach affecting the Operator’s data: what happened, who is affected, the likely consequences and what has been done, so that the Operator can meet its own obligations.
8. Helping the Operator meet its obligations
The Platform will help the Operator with requests from drivers exercising their rights, with data protection impact assessments and consultation with the Information Commissioner, and with showing compliance with Article 32. Most driver requests the Operator can answer directly from its own screens.
9. Retention, return and deletion
The Platform keeps data for as long as the Operator instructs, and the Operator is responsible for setting retention periods that meet its own legal duties.
A standing instruction, which the Operator gives and may lift. Records that UK transport law requires an operator to keep, including drivers’ hours records and working time records, are not deleted on request while their statutory period is running. This is the Operator’s own instruction to the Platform, given by accepting this agreement, so that a deletion made in error cannot destroy evidence the Operator is required to hold.
The Operator may lift it at any time by confirming in writing that it holds the records elsewhere or that the period has passed. The Platform will then delete them. The Platform does not decide the Operator’s retention periods and does not keep data against instruction, except where a law that applies directly to the Platform requires it to.
When the service ends, the Operator can ask for a copy of its records in a machine-readable form for 30 days, as the Terms of Service say. After that the Platform deletes them within 90 days, except for anything the law requires it to keep.
10. Audit
The Platform will make available the information needed to show compliance with Article 28, and will allow and contribute to audits by the Operator or an auditor it appoints, on reasonable notice and no more than once a year unless a breach or a regulator requires otherwise.
11. The driver’s wallet, where the Platform is controller
A driver’s wallet is a service the Platform provides to the driver, not to the Operator. The Platform, not the Operator, decides its purpose and means: a driver may hold it with no employer, decides what goes in it, decides which companies may see it, may withdraw that at any time, and keeps it when they leave.
The Platform is therefore a controller for the wallet itself, and the driver’s privacy notice sets out the lawful basis, the retention and how a driver exercises their rights over it.
Where a driver shares a wallet document with the Operator, the Operator receives its own copy for its own compliance purposes. That copy is the Operator’s record, the Operator is its controller, and sections 1 to 10 apply to it. Ending a share stops future access; it does not reach into records the Operator already holds and is required to keep.
12. Liability, priority and duration
Liability arising out of or in connection with this agreement is subject to the limits and exclusions in the Terms of Service.
Nothing in this agreement limits either party’s obligations under UK GDPR or the Data Protection Act 2018, affects the powers of the Information Commissioner, or affects a data subject’s rights under Article 82.
If this agreement and the Terms of Service conflict on a matter of data protection, this agreement prevails.
It lasts as long as the Platform processes personal data for the Operator. Sections 7, 9 and 11 survive its end.
13. Contact
The platform is operated by Amarine Trans Ltd, company number 10622582, registered office 104 Barclay Street, Leicester, England, LE3 0JB.
Data protection enquiries: privacy@amarineone.co.uk. Anything else: support@amarineone.co.uk.
By accepting, you confirm you have authority to enter into this agreement on behalf of your company.