This Data Processing Addendum ("DPA") forms part of the Terms of Service and Subscription Agreement between Devtech LLC ("Provider" or "Processor") and the Customer, and applies whenever Provider processes personal data on Customer's behalf in providing the Service. It is intended to satisfy the requirements of the California Consumer Privacy Act as amended (CCPA/CPRA), other U.S. state privacy laws, the EU and UK General Data Protection Regulations (GDPR), and comparable laws ("Data Protection Laws").
1. Roles and scope
Customer is the controller (or "business") of End User personal data it enters into or collects through the Service ("Customer Personal Data"); Provider is the processor (or "service provider"/"contractor"). Provider is an independent controller of account-holder data and usage data as described in the Privacy Policy. Processing details: subject matter — provision of the Service; duration — the term plus the retention period; nature and purpose — hosting, storage, transmission, display, notification, routing, payment facilitation and reporting as instructed through the Service's features; data subjects — Customer's clients and prospects, their contacts, Customer's employees, drivers and contractors, and partner haulers; categories — identifiers and contact details, service addresses and jobsite details, order and payment records, signatures, photos, notes, and driver location and time records.
2. Provider obligations
Provider will: (a) process Customer Personal Data only on Customer's documented instructions, which are the Terms, this DPA and Customer's use of the Service's features, unless required by law (in which case Provider will inform Customer unless prohibited); (b) not sell or share Customer Personal Data, retain, use or disclose it outside the direct business relationship or for any purpose other than providing the Service, or combine it with data from other sources except as permitted for service providers under the CCPA; (c) ensure personnel are bound by confidentiality; (d) implement the technical and organizational measures in Section 5; (e) assist Customer, taking into account the nature of processing, in responding to data-subject requests and in meeting security, breach-notification, impact-assessment and consultation obligations; (f) notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data, with the information reasonably available; (g) at the end of the Service, delete or return Customer Personal Data as described in the Privacy Policy retention schedule, unless law requires retention; (h) make available information necessary to demonstrate compliance and allow for and contribute to audits, including inspections, conducted by Customer or an auditor mandated by Customer, no more than once a year on 30 days' notice (or after a breach), subject to confidentiality; (i) notify Customer if it determines it can no longer meet its obligations under Data Protection Laws, and Customer may then take reasonable steps to stop and remediate unauthorized use.
3. Subprocessors
Customer authorizes Provider to engage the subprocessors listed below and to add or replace subprocessors with at least 15 days' notice (by email to the account owner or by updating this page); Customer may object on reasonable data-protection grounds, and if the objection cannot be resolved Customer may terminate the affected Service with a prorated refund. Provider imposes data-protection obligations on subprocessors no less protective than this DPA and remains liable for their performance.
| Subprocessor | Purpose | Location |
|---|---|---|
| Supabase, Inc. | Database, authentication, file storage | United States (us-east) |
| DigitalOcean, LLC | Application hosting | United States |
| Stripe, Inc. | Payment processing, connected accounts (independent controller for its own purposes) | United States |
| Google LLC (Maps Platform, Sign-In, Firebase/Play services) | Geocoding, maps, routing, sign-in, push notifications | United States / global |
| Twilio Inc. (or equivalent carrier provider) | SMS/MMS and voice delivery | United States |
| Resend, Inc. (or Customer-configured SMTP provider) | Transactional email | United States |
| Apple Inc. | Push notifications (iOS) | United States |
| Error and performance monitoring provider | Crash and error reports | United States |
4. International transfers
Where Customer Personal Data originating in the EEA, UK or Switzerland is transferred to Provider in the United States, the parties enter into the EU Standard Contractual Clauses (Commission Decision 2021/914), Module Two (controller to processor) and, where applicable, Module Three (processor to processor), with the UK International Data Transfer Addendum and the Swiss amendments, which are incorporated by reference. Clause 7 (docking) applies; Clause 9 option 2 (general authorization) with the notice period in Section 3; Clause 11 optional language does not apply; Clause 17 option 1 with Irish law; Clause 18 Irish courts; Annex I is completed by Section 1 and the parties' account details; Annex II by Section 5; Annex III by Section 3. Provider will notify Customer if it receives a legally binding request from a public authority for Customer Personal Data, unless prohibited, and will challenge unlawful requests.
5. Security measures
Provider maintains: logical tenant isolation with database row-level security; encryption in transit (TLS 1.2+) and at rest; hashed credentials, optional and (for administrators) mandatory multi-factor authentication; role-based access control and per-user permission grants; logged, least-privilege administrative access with audit trails; daily encrypted backups with tested restoration; secure software development practices including dependency and vulnerability monitoring; environment separation; an incident-response plan; and confidentiality obligations and security training for personnel. A current summary is available on request.
6. Customer obligations
Customer is responsible for the lawfulness of its instructions, for providing notices and obtaining consents required from End Users and drivers, for the accuracy of Customer Personal Data, for configuring the Service's privacy-relevant settings (location reporting, retention, messaging consent), and for its users' compliance.
7. Liability and order of precedence
Each party's liability under this DPA is subject to the limitations in the Subscription Agreement (or the Terms of Service for trial Customers). In a conflict, this DPA controls over the Terms and Subscription Agreement with respect to processing of Customer Personal Data, and the Standard Contractual Clauses control over this DPA.
8. Term
This DPA applies for as long as Provider processes Customer Personal Data. Contact for the DPA and data-protection inquiries: [email protected].