Data Processing Addendum

1. Parties, roles and documented instructions

Provider and Customer are the actual parties identified in the signed Order Form. Customer acts as controller/business of its carrier records, or as a processor with authority from its own controller. Provider acts as processor/service provider, or subprocessor, for those records. Provider processes only on documented instructions in the agreement and subsequent authorized written instructions, except where applicable law requires otherwise. Provider must inform Customer if it believes an instruction violates applicable data-protection law.

2. Processing details and permitted scope

The purpose is to deliver the agreed carrier workflow. Processing may include collecting, recording, organizing, storing, displaying, transmitting, securing, exporting and deleting records. Processing lasts for the agreed service and limited return, deletion or lawful-retention period. The signed order must confirm the enabled categories, locations, retention schedule and actual recipients before processing begins.

• People: authorized staff, drivers, carrier contacts, and people identified in customer, facility or load records.
• Data: names and business contact details; company membership and roles; load, stop, facility and equipment information; authorized financial facts; BOL/POD, scale tickets and other approved evidence.
• Operational information: permitted driver-action location and accuracy, requested routing/mileage information, access/device information and security or audit records associated with the agreed workflow.
• Sensitive categories: government identifiers, medical, biometric, account credentials or other highly sensitive information are excluded unless specifically approved in the order and a protected workflow.

3. Purpose limits and confidentiality

Provider must not sell or share Customer personal data for cross-context behavioral advertising, use it for unrelated advertising or model training, or retain, use or disclose it outside the agreed service and permitted instructions. Where service-provider laws apply, Provider must comply with their restrictions on combining data and using it outside the direct business relationship. Any de-identified use requires a lawful agreed basis and measures against re-identification. Personnel with access must be bound by confidentiality and receive access only for authorized duties.

4. Security measures and responsibilities

Provider must maintain measures appropriate to the agreed processing, including secure transport, role and company access controls, private-evidence authorization, credential protection and controlled operational access. Customer must manage its users and connected-service permissions and minimize submitted data. A description of implemented controls does not itself certify compliance. Before activation, the security schedule must identify verified recovery, backup, incident and deletion arrangements and any data-specific requirements.

5. Subprocessors and optional services

Customer may authorize the core providers identified in the agreed provider schedule. Provider must confirm suitable written processor terms, confidentiality and security obligations and remains responsible for its processor duties when it engages subprocessors. Provider must give written notice of intended additions or replacements, provide a reasonable opportunity to raise documented data-protection objections and seek an appropriate resolution before the affected processing proceeds. If no acceptable resolution is available, the parties must arrange cessation of the affected service and lawful data handling. Emergency measures required by law or security must be communicated as soon as practical. The order must set the working notice process and contacts.

6. Rights requests, assessments and review

Taking into account the nature of processing and available information, Provider must reasonably assist Customer with lawful access, correction, deletion, portability and other applicable rights requests, security assessments and regulator inquiries. Requests concerning carrier-controlled records must be referred to Customer unless law requires a direct response. Provider must make compliance information available and permit reasonable assessments or independent review required by applicable law, under confidentiality and safeguards for other customers. Customer may take reasonable steps to verify and address unauthorized processing.

7. Security incidents and unlawful processing

Provider must notify Customer without undue delay after becoming aware of a personal-data security incident affecting the agreed processing, and meet any mandatory legal deadline. The parties must agree the incident contact and any additional timing requirement before activation. Provider must provide available information about affected data, likely consequences, containment and remediation, update Customer as material facts become known, and reasonably assist Customer’s response. Provider must notify Customer if it can no longer meet applicable processing obligations and cooperate in stopping and addressing noncompliant processing.

8. Return, deletion and required retention

At the end of services, Provider must follow Customer’s lawful choice to return or delete personal data, including copies, except to the extent applicable law requires retention. The signed order must state the verified export method and window, deletion process and timing, backup cycle and any retained categories and basis. Retained data must be restricted to the required purpose and protected until deletion. Provider must give an appropriate completion confirmation. Customer-controlled Drive files and optional integrations require an explicit responsibility and handoff plan; disabling application access alone does not delete them.

9. Locations, transfers and order of precedence

Before processing, Provider must disclose and confirm the relevant hosting regions and international access or transfers in the provider schedule. No U.S.-only or single-country residency promise is made here. If a transfer mechanism or additional regulated-data arrangement is required, the parties must put it in place before that processing. This DPA controls personal-data processing over conflicting general terms; a specific signed data-protection amendment may change it only as applicable law permits. Commercial scope is governed by the signed order.

10. Activation prerequisites and contact

Provider must verify its upstream provider agreements, processing inventory and ability to carry out these duties before the DPA is activated. Publishing this review draft does not establish those facts or make the service ready for customer activation. Customer and Provider must retain the applicable versions and signed record. Questions and review requests can be sent to carrierhelm.admin@gmail.com.