Data Processing and DPA

For most operational data held in the platform, the client organisation will generally act as controller because it decides why the data is collected, how workflows are configured, and what outcomes are pursued.

Velra Agency Ltd trading as UrbanTrack will generally act as processor for that client operational data by hosting, storing, securing, and processing it on the client's instructions.

In some limited contexts, Velra may act as controller for its own website, billing, support, security logging, or account administration data.

A Data Processing Agreement is available as part of onboarding, procurement, or contractual setup for client organisations using UrbanTrack.

The DPA is intended to address processing subject matter, duration, categories of data, categories of data subjects, confidentiality, security, sub-processors, assistance, deletion or return, and audit-related provisions.

UrbanTrack may rely on hosting, storage, email, security, and support providers to operate the platform.

If optional analytics or measurement tooling is introduced later, the DPA and related disclosures should be updated to reflect that live processor list.

Where personal data may be processed outside the UK, the contractual and transfer safeguards used should be addressed in the DPA or procurement documents.

UrbanTrack supports role-based access, auditability, tenant-aware scope controls, and environment-level security measures as part of the service.

During the contract lifecycle, we can support reasonable client enquiries about security, data subject request handling support, and processor obligations within the agreed contractual framework.

If your organisation needs a DPA, privacy annex, sub-processor information, or procurement-ready data protection wording, contact support@urbantrack.app or support@urbantrack.app.

The final DPA template should be reviewed by counsel and kept aligned with the live service and supplier stack.