Explainers
What Is Third-Party Risk Management (TPRM)? A Practical Guide
Solomon Amos · 2 Nov 2026 · 10 min read
No public evidenceSurfSight and GDPR
CertReports found no public GDPR evidence for SurfSight as of unknown date. This does not mean the vendor is non-compliant. It means CertReports found no public evidence at the last check.
Evidence
ExpiredInactive
as of 2 Nov 2026 · confidence 100%- Kind
- Listing
- Issued or listed
- 11 Apr 2019
- Scope
- SurfSight software platform protects enterprises' staff and vehicles on the road through our dashcam cloud service. SurfSight collects and processes videos, location data, and driving events from dashcam devices installed in an organization’s vehicles (cars or trucks), and lets such organizations - our customers - keep sight of the driving safety of their staff and the operation of their vehicles, and protect their interests in case of accidents or insurance claims. In the process, personal data is also collected on the platform. Like most businesses, we also collect and process personal information of our website visitors, business contacts, and customers. Our purpose in processing personal data on SurfSight is to provide our services to our customers according to our agreements with them and applicable law. We also use the data collected on SurfSight to ensure our products and services are working as intended; to analyze, measure and understand how our services are used; to improve our products and services; to develop new features, products, and services; to protect our company, staff, customers and users, as well as drivers, passengers, and the general public; and to comply with any applicable law and assist law enforcement agencies under any applicable law. For the delivery of our services, we share all user, device, and platform data on SurfSight (inc. identifiable information of drivers, passengers and other people) with the customer who is the Data Controller with respect to such data (owning the SurfSight devices which collect the data). We also share Customer’s representatives contact details to all the customer’s users and others who might need such details, to comply with any applicable law. We process data on our servers and computers, cloud CRM services, support systems and services, billing systems, SMS gateways, Email and SMS communication services, and backup systems. We may share some data with our staff, consultants, resellers, affiliates, and other third-party business partners for research and analysis, cooperation opportunities, joint promotions, sales, and events. We also use additional processors for various processing activities needed for the performance of SurfSight, our Websites, our other products and services, our operations, and our business, and share information with such processors on a need basis. Such processors include hosting and backup providers , analytics providers , website technology, advertising technology, telecommunication services, media transmission services, and security technology. We limit the information we share with each processor based on the business need in using such processor, to protect personal information while still effectively benefiting from the services of such processor. More elaborate details on our purposes, personal information we collect, and the sharing of information can be found in our Privacy Policy.
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 2 Nov 2026 | SurfSight: Inactive | Live pagesha256 a9cde0a34c |
What GDPR means, and what it does not
"GDPR compliant" is a claim, not a certification. The verifiable facts are a public DPA, SCC usage, an EU representative, data residency options and a Data Privacy Framework listing.
Read the GDPR guide and browse all vendors with evidenceQuestions buyers ask
Is SurfSight GDPR compliant?
There is no GDPR certification in general use. The verifiable facts are a public data processing agreement, standard contractual clauses, an EU representative and a Data Privacy Framework listing. See the legal artefacts and the DPF row on this page, each with its capture date.
How does CertReports verify this?
Every state carries a capture date, a source and a snapshot link. Registry rows come from the official registry data; vendor statements come from the vendor’s own page or trust centre; nothing is inferred. Vendors can dispute any row and corrections ship within two business days.
Change history
- 18 Sep 2026First indexed by CertReports1 evidence row across 1 framework entered the index.
Alternatives with GDPR evidence
Similar vendors (shared product tags) whose GDPR row is verified or vendor-stated, ranked by similarity.
No same-category vendor has GDPR evidence in the index yet.
Understand GDPR evidence
All articlesHow-to
Vendor Security Questionnaire Questions Answered by Public Evidence
Solomon Amos · 26 Sep 2026 · 8 min read