Data Processing Agreement

1. Roles

Customer decides why and how personal data is processed in its Ardelis workspace and acts as the controller (or “business”). Processor processes that data only on Customer’s behalf, as a processor (or “service provider”).

2. Subject matter and duration

Processing covers the hosting, storage, display and transmission of Customer Data needed to provide the Service, for the duration of the subscription and the export period that follows it.

3. Categories of data and persons

• Persons: Customer’s users; drivers, carrier and supplier contacts who book or check in; other persons named in notes or documents.
• Data: names, work contact details, booking references, vehicle and trailer identifiers entered by users, arrival and departure times, signatures, photos and notes attached to appointments.

Customer should not enter sensitive personal data in the Service.

4. Processor obligations

• Process personal data only on Customer’s documented instructions, which are these Terms, the DPA and Customer’s use of the Service’s settings.
• Not sell or share the data, and not use it for any purpose other than providing the Service.
• Ensure that persons authorized to process the data are bound by confidentiality.
• Implement appropriate technical and organizational security measures, including encrypted connections, role-based access and restricted staff access.
• Assist Customer, as reasonably possible, in responding to requests from individuals and in meeting its security obligations.
• Notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Data.

5. Sub-processors

Customer authorizes Processor to use sub-processors, such as its hosting provider, under written terms at least as protective as this DPA. Processor keeps a list available on request and will give notice of new sub-processors, allowing Customer to object on reasonable grounds.

6. Transfers

If personal data is transferred across borders, Processor will ensure a lawful transfer mechanism is in place where the law requires one.

7. Audits

Processor will make available the information reasonably needed to demonstrate compliance with this DPA and respond to reasonable written questions from Customer, no more than once a year unless required by a supervisory authority or following a breach.

8. Return and deletion

At the end of the subscription, Customer may request an export of Customer Data within thirty (30) days. Processor then deletes Customer Data, unless the law requires it to be kept.

9. Liability and precedence

The limitation of liability in the Terms of Service applies to this DPA. If this DPA conflicts with the Terms of Service regarding personal data, this DPA prevails.