Data processing agreement

Parties, purpose and duration

The customer is the controller; the DS Prime operator is the processor. Processing provides DS Prime and KFZ Prime for driver, fleet, operations, performance and payroll management for the main contract’s duration.

Data subjects and data categories

Subjects: customer drivers/employees, dispatchers/admin users, and accident or third-party contacts where recorded. Data: master/contact records; working hours, attendance, leave and sickness notifications (health data only as absence status); performance/quality metrics; vehicle, telematics and locations; inspection/accident photos and documents; payroll analyses.

Processor obligations

Process only on documented customer instructions. Bind authorized persons to confidentiality. Support data subject requests and Articles 32–36 GDPR obligations. Report data breaches within 24 hours of awareness. Delete/return data within 30 days of contract end unless retention applies. Provide compliance information and support inspections/audits.

Storage and international transfers

Database/files are stored in Frankfurt am Main, Germany (EU), eu-central-1. The processor is based in the UAE without an adequacy decision. EU Standard Contractual Clauses under Commission Implementing Decision (EU) 2021/914, Module 2 (Controller to Processor), form an annex. The SCC document is to be provided by legal counsel. The TOM annex is described below.

Technical and organisational measures

HTTPS/TLS transport and encryption at rest; company-level database access isolation; role-based owner/admin/dispatcher/fleet access and access logging; hashed passwords and encrypted server-side integration credentials; regular backups; separate test/production environments; significant manual-change logs; documented security incident process.

Sub-processors

Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992: database/storage/authentication, Frankfurt storage. Lovable: hosting and transactional email (legal name/address awaiting completion). Google/Gemini through Lovable AI Gateway: requested AI analysis. Mapbox Inc., Washington, D.C., USA: maps. Stripe Payments Europe, Ltd., Dublin, Ireland: customer billing/payment processing. GeoTab Inc./Kenjo GmbH: only if connected.

Equivalent data protection duties apply under Article 28(4) GDPR. Customers are notified of changes in advance and may object for an important data-protection reason.

Conclusion and final provisions

The agreement is concluded by confirmation during signup; version and acceptance time are saved. In privacy conflicts, this DPA takes precedence over the main contract. German law applies.