Data Processing Agreement

1. Definitions

1.1 "Controller" means the party that determines the purposes and means of processing Personal Information. "Processor" means the party that processes Personal Information on behalf of the Controller. "Personal Information" means any information about an identifiable individual contained in Customer Data. "Data Subject" means the individual to whom Personal Information relates. "Sub-processor" means any third party engaged by the Provider to process Personal Information. "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Information processed under this Agreement. "Data Protection Law" means all law applicable to the processing of Personal Information under this Agreement, including the Personal Information Protection and Electronic Documents Act (Canada), applicable provincial privacy legislation, and, where applicable, United States state privacy legislation.

2. Roles of the parties

2.1 In respect of Personal Information within Customer Data, the Customer is the Controller and the Provider is the Processor.

2.2 The Customer is solely responsible for the lawfulness of the Personal Information it provides and of its instructions; for having a lawful basis for collection; for providing Data Subjects, and in particular its Drivers, with any notice Data Protection Law requires; and for obtaining any consent Data Protection Law requires, including in respect of the recording of Driver location.

2.3 The Provider is itself a controller of information concerning the Customer's account, billing and administration, which is governed by the Privacy Policy and not by this Agreement.

3. Details of processing

3.1 Subject matter and purpose. The provision of the Service to the Customer, including the recording of orders, the assignment of work to Drivers, the capture of Delivery Records, the sending of notifications on the Customer's behalf, and invoicing.

3.2 Categories of Data Subjects. The Customer's Drivers; the Customer's customers and their personnel; Recipients; and the Customer's own Authorised Users.

3.3 Categories of Personal Information. Names, telephone numbers, electronic mail addresses, postal and delivery addresses, Driver identifiers, Driver location while on shift, delivery status and history, photographs taken as proof of delivery, signatures captured on screen, and notes entered by Authorised Users. The Customer shall not submit special categories of information, including health, biometric, financial account or government identification information, save to the extent incidental to a delivery.

3.4 Duration. For the term of the Agreement and thereafter for the periods set out in clause 11.

4. Processing on instructions

4.1 The Provider shall process Personal Information only on the Customer's documented instructions. The Customer's use and configuration of the Service, and requests made through it or in writing, constitute its complete instructions.

4.2 Where the Provider is required by law to process Personal Information otherwise than on the Customer's instructions, it shall inform the Customer before processing, unless that law prohibits it from doing so.

4.3 The Provider shall inform the Customer if, in its opinion, an instruction infringes Data Protection Law, and may suspend performance of that instruction until it is confirmed or modified.

4.4 The Provider shall not sell Personal Information, shall not use it for advertising, shall not use it to train machine learning models, and shall not retain, use or disclose it for any purpose other than performing the Service, save as required by law.

5. Confidentiality of personnel

5.1 The Provider shall ensure that every person it authorises to process Personal Information is bound by an obligation of confidentiality, whether contractual or statutory, and has access only to the extent necessary for the performance of their duties.

6. Security

6.1 The Provider shall implement technical and organisational measures appropriate to the risk, taking account of the nature of the Personal Information and the state of the art. The measures in place include:

• Tenant separation, enforced by the database on every read and write and not by the application alone.
• Role-based access, under which a Driver reaches only work assigned to them and a customer of the Customer reaches only its own orders and only the fields intended for it.
• Private storage of photographs, released only by short-lived signed link checked against the requester's entitlement to the delivery concerned.
• Encryption in transit for every connection to the Service.
• Minimisation of diagnostic data, under which Recipient names, delivery notes, signatures, photographs and credentials are removed on the device before any diagnostic report is transmitted.
• Scheduled deletion of records past the retention periods in clause 11.

6.2 The Provider may update these measures from time to time, provided that the overall level of protection is not materially reduced.

6.3 The Customer is responsible for the security of its own credentials, devices and Authorised Users, and for maintaining its own copies of Customer Data. The Provider does not warrant against loss or corruption of data and gives no guarantee of recovery.

7. Sub-processors

7.1 The Customer gives general authorisation to the Provider to engage Sub-processors. The Sub-processors engaged at the date of this Agreement are listed in clause 16.

7.2 The Provider shall impose upon each Sub-processor, by written contract, data protection obligations providing no less protection than those in this Agreement, and remains responsible to the Customer for each Sub-processor's performance of those obligations.

7.3 The Provider shall give account holders not less than thirty (30) days' notice before engaging a new Sub-processor that will process Personal Information. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected Subscription on notice, and the Provider shall refund the unused portion of any prepaid Term. Absent objection, the Sub-processor is deemed approved.

8. Location of processing and transfers

8.1 Customer Data, including stored photographs, is hosted in Canada.

8.2 Certain Sub-processors operate outside Canada and receive limited Personal Information in the course of their function. While held or processed in another jurisdiction, Personal Information is subject to the laws of that jurisdiction and may be accessible to its courts, law enforcement and national security authorities. The Provider shall use contractual means to require a comparable level of protection.

8.3 The Provider shall provide the Customer with such information as it reasonably requires to conduct any privacy impact assessment Data Protection Law requires of it in respect of such transfers.

9. Assistance

9.1 Taking account of the nature of the processing, the Provider shall assist the Customer, by appropriate technical and organisational measures and insofar as possible, to respond to requests from Data Subjects to exercise their rights. Where the Customer cannot action a request itself through the Service, the Provider shall assist within ten (10) business days of a written request.

9.2 Where a Data Subject request is received directly by the Provider, the Provider shall not respond to it save to refer the Data Subject to the Customer, and shall notify the Customer without undue delay.

9.3 The Provider shall provide reasonable assistance with any privacy impact assessment and with any consultation with a regulator that the Customer is required by Data Protection Law to undertake in connection with the Service.

9.4 The Provider may charge reasonable fees for assistance under this clause 9 that exceeds what is proportionate, save where the assistance arises from the Provider's own breach.

10. Security Incidents

10.1 The Provider shall notify the Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Security Incident affecting Customer Data.

10.2 The notification shall describe, to the extent then known, the nature of the Security Incident, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed. Information not available at the time of notification shall be provided in phases as it becomes available.

10.3 The Customer, as Controller, is responsible for determining whether a Security Incident gives rise to a real risk of significant harm, for reporting to the Office of the Privacy Commissioner of Canada or any other regulator, and for notifying affected individuals. The Provider shall provide the information reasonably required for that purpose.

10.4 Notification of a Security Incident is not an acknowledgment of fault or liability.

10.5 A suspected Security Incident may be reported to support@ayzendispatch.com.

11. Retention, return and deletion

11.1 During the term, the Customer may delete most records through the Service. Delivered orders and their Delivery Records cannot be deleted on demand, because they form the record relied upon when a delivery is disputed.

11.2 Regardless of Account status, delivery history is retained for seven (7) years; account requests and customer notifications for two (2) years; and delivery photographs for thirty (30) days, after which they are deleted from both working and backup storage.

11.3 Following termination, the Customer may request an export of Customer Data within thirty (30) days. Thereafter the Provider shall delete Customer Data within a reasonable period, save to the extent that retention is required by law or permitted by clause 11.2, in which case the Provider shall continue to protect it under this Agreement.

12. Information and audit

12.1 On reasonable written request, and not more than once in any twelve (12) month period save following a Security Incident, the Provider shall make available the information reasonably necessary to demonstrate compliance with this Agreement.

12.2 Any audit or inspection shall be conducted on at least thirty (30) days' notice, during business hours, without unreasonable disruption, at the Customer's cost, and subject to obligations of confidentiality. The Provider does not currently hold SOC 2 or ISO 27001 certification.

13. United States privacy law

13.1 Where United States state privacy law applies, the Provider acts as a "service provider" or "processor" as defined in that law, and shall not: (a) sell or share Personal Information; (b) retain, use or disclose it for any purpose other than the business purposes specified in this Agreement, or outside the direct business relationship between the parties; or (c) combine it with personal information received from any other source, save as that law permits.

13.2 The Provider certifies that it understands the restrictions in clause 13.1 and will comply with them, and shall notify the Customer if it determines that it can no longer meet its obligations under that law.

14. Liability

14.1 Each party's liability arising out of or in connection with this Agreement, whether in contract, tort or otherwise, is subject to the exclusions and limitations of liability in clause 13 of the Terms, and the aggregate cap in that clause applies to all claims under this Agreement and the Terms together.

15. Precedence and duration

15.1 Where this Agreement and the Terms conflict on the handling of Personal Information, this Agreement prevails. In every other respect, including liability, the Terms prevail.

15.2 This Agreement continues for so long as the Provider processes Personal Information on behalf of the Customer.

16. Sub-processors

16.1 The following Sub-processors are engaged as at the date of this Agreement. Each receives only the information required for its function.

• Supabase: database hosting, file storage and authentication. Processes all Customer Data. Hosted in Canada.
• Cloudflare: hosting and delivery of the web applications. Processes network traffic; does not store Customer Data.
• Resend: transactional electronic mail. Processes recipient addresses and message content.
• Stripe: subscription payment processing. Processes the Customer's billing information only.
• Mapbox: address geocoding and map display in the driver application. Processes delivery addresses and requests for the map area displayed.
• Sentry: diagnostic reporting from the driver application, minimised as described in clause 6.1.
• Expo: build and push notification delivery for the driver application.
• Google (Firebase Cloud Messaging): final delivery of push notifications to Android devices. Processes the device token and notification text, which identifies an order number only.

16.2 References in this Agreement to the "Provider" are to the contracting entity identified in clause 23 of the Terms of Service. Questions concerning this Agreement: support@ayzendispatch.com.