Data Processing Agreement

1. Scope and roles

The Provider processes personal data on behalf of the Customer only to provide TIR40 (the “Service”). For that data (“Customer Personal Data”) the Customer is the controller and the Provider is the processor. The subject matter, duration, nature and purpose of the processing, and the types of data and data subjects, are set out in Annex 1. The Provider is the controller of its own account and website data, which its Privacy Policy covers.

2. Instructions

The Provider processes Customer Personal Data only on the Customer's documented instructions — which are the Terms, this DPA, and the Customer's use of the Service's features and settings — unless EU or Member State law requires otherwise, in which case the Provider tells the Customer beforehand unless the law forbids it. The Provider tells the Customer if it believes an instruction infringes data-protection law.

3. Confidentiality

The Provider ensures that everyone it authorises to process Customer Personal Data is bound by confidentiality, and that access is limited to what is needed to run and support the Service.

4. Security

The Provider applies appropriate technical and organisational measures under Article 32 GDPR, at least those in Annex 2, and may update them provided the overall level of protection is not reduced.

5. Sub-processors

• The Customer gives general authorisation to use the sub-processors listed in Annex 3.
• The Provider will give the Customer at least 30 days' notice (in the app or by email) before adding or replacing a sub-processor. The Customer may object on reasonable data-protection grounds within that time; if the parties cannot resolve it, the Customer may terminate the affected Service.
• The Provider imposes on each sub-processor data-protection obligations no less protective than this DPA and remains responsible for their performance.

6. International transfers

Customer Personal Data is stored in the European Union (Ireland). Where the Provider or a sub-processor transfers it outside the EU/EEA, this happens only under a valid transfer mechanism under Chapter V GDPR, such as the European Commission's Standard Contractual Clauses or an adequacy decision.

7. Assistance

Taking into account the nature of the processing, the Provider helps the Customer, by appropriate measures (including the export and delete functions in the Service), to respond to requests from data subjects, and to meet its obligations on security, breach notification, data-protection impact assessments and consultation with authorities. If a data subject contacts the Provider directly about Customer Personal Data, the Provider refers them to the Customer.

8. Personal-data breaches

The Provider notifies the Customer without undue delay, and where possible within 48 hours, after becoming aware of a personal-data breach affecting Customer Personal Data, and gives the information it then has: what happened, the likely consequences, the data and people affected, and the measures taken or proposed. The Customer decides whether and how to notify the authority and the people concerned.

9. Return and deletion

While the account is active the Customer can export its data and delete records itself in the Service. When the agreement ends the Provider deletes Customer Personal Data within 30 days, unless EU or Member State law requires it to be kept. Copies in encrypted provider backups are overwritten in the normal backup cycle (up to 7 days). On request the Provider confirms the deletion in writing.

10. Information and audits

The Provider makes available the information needed to show compliance with Article 28 GDPR and allows for audits, including inspections, by the Customer or an auditor the Customer appoints. Audits are announced at least 30 days ahead, happen no more than once a year (unless a breach requires otherwise), run during business hours without disrupting operations or exposing other customers' data, and are done under confidentiality. The Provider may first satisfy the request with documentation, such as its sub-processors' audit reports and certifications.

11. The Customer's responsibilities

• The Customer is responsible for having a lawful basis for the data it enters, and for giving the required information to data subjects — in particular to drivers, about the position captured when a driver taps “Arrived” or shares their location, and about working-time records.
• The Customer enters only the data it needs, and does not use the Service to store special categories of data (Article 9 GDPR) or criminal-offence data.
• The Customer controls who has access to its workspace, and with which role.

12. Liability, precedence and term

Each party's liability under this DPA is subject to the limits in the Terms of Service, without affecting data subjects' rights or any liability that cannot be limited by law. If this DPA and the Terms conflict on data protection, this DPA prevails. It lasts as long as the Provider processes Customer Personal Data, and is governed by the law that governs the Terms.

Annex 1 — Details of the processing

Annex 2 — Security measures

• Separation of tenants: every company's data is isolated from other companies' data by row-level security in the database, and server actions re-check the user's company and role.
• Access control: sign-in with individual accounts, roles (administrator, manager, dispatcher), and a closed sign-up requiring an access code; passwords are stored only as hashes by the sign-in provider.
• Driver links: no login, but each link contains a long random code, is limited to one job, and only shows what that job needs.
• Encryption: connections to the Service and between the Service and its providers are encrypted in transit; the database and file storage are encrypted at rest by the hosting provider.
• Files: uploaded documents sit in private storage, organised per company, readable only through the signed-in application.
• Audit trail: changes to loads and other key records are logged with user and time.
• Availability: provider-managed database backups; EU-region hosting.
• Personnel and vendors: access limited to what is necessary; sub-processors bound by data-processing agreements.
• Data minimisation: no analytics or advertising trackers; AI features only receive what a user sends or uploads to them (for example an order document, pasted email text, a CMR photo, or the notes of a load that a driver opens on their link).

Annex 3 — Sub-processors