Data Processing Agreement

This Data Processing Agreement (DPA) applies when a business customer (the “Customer”) uses the TAM Freight Service to arrange deliveries to or from individuals and, in doing so, gives TAM Freight (the “Provider”) personal data about those individuals, such as recipient names, addresses, phone numbers and delivery signatures. For that data the Customer is the controller (or business) and the Provider is the processor (or service provider).

For data the Provider collects for its own purposes, such as account, security, payment and driver verification data, the Provider is an independent controller and the Privacy Policy applies. This DPA forms part of the Terms of Service and applies to a Customer from the moment it uses the Service.

• Subject matter and duration: providing the delivery marketplace for as long as the Customer has an account, plus the retention periods in the Privacy Policy;
• Nature and purpose: storing, displaying to the assigned driver, transmitting and deleting delivery details in order to carry out deliveries and keep records;
• Types of data: names, addresses, phone numbers, delivery notes, delivery photos and signatures, and delivery status history;
• Data subjects: the Customer’s recipients, senders and contacts, and the Customer’s staff who use the Service.

The Provider processes the Customer’s personal data only on the Customer’s documented instructions, which are this DPA, the Terms and the Customer’s use of the Service, unless the law requires otherwise, in which case the Provider will tell the Customer first where it is allowed to. The Provider will tell the Customer if it believes an instruction breaks data protection law.

People who may access the data are bound by confidentiality, and staff access is limited to what their role needs and is recorded in an audit trail.

• Encryption of data in transit and encryption of payout details inside the application before storage;
• Row-level access rules so each account sees only its own records, plus role and verification checks on every action;
• Rate limiting, sign-in risk scoring and automatic session revocation for suspicious activity;
• An append-only audit trail of sign-ins, staff decisions and changes to loads, money and verification;
• Private storage for delivery photos, shown through short-lived links;
• Timeouts, circuit breakers and request budgets on calls to other services, and regular backups with a quarterly restore test.

The Provider may update these measures if the overall level of protection is not reduced.

The Customer gives general authorization for the Provider to use these sub-processors:

• Supabase: database, authentication and file storage;
• Vercel: hosting and delivery;
• Stripe: card payments;
• Didit: driver identity verification (driver data only);
• Resend: sending service emails.

The Provider has a written agreement with each sub-processor that gives the same level of protection and remains responsible for their performance. The Provider will give notice of a new sub-processor, by email or in the app, at least 14 days before it starts processing the Customer’s data, and the Customer may object on reasonable data protection grounds within that time.

Where personal data from the EU, EEA, UK or Switzerland is transferred to a country without an adequacy decision, the parties rely on the standard contractual clauses approved for that purpose, which are incorporated into this DPA, with the Customer as exporter and the Provider (or its sub-processor) as importer.

Taking into account the nature of the processing, the Provider will help the Customer answer requests from individuals exercising their rights, and with security, breach notification, impact assessments and consultations with regulators, in each case so far as the Customer cannot do so itself through the Service. Where a request reaches the Provider directly, the Provider will pass it on without undue delay.

The Provider will tell the Customer without undue delay, and in any case within 72 hours, after becoming aware of a breach affecting the Customer’s personal data, and will give the information it has to help the Customer meet its own duties, updating it as the facts become known.

On reasonable written request, no more than once a year unless a breach has occurred, the Provider will give the Customer the information needed to show compliance with this DPA, and will allow and contribute to an audit by the Customer or a mutually agreed independent auditor, during business hours, with reasonable notice and subject to confidentiality.

When the Customer ends the account, the Provider will delete or anonymize the Customer’s personal data within the retention periods in the Privacy Policy, and the Customer can export its data from Settings before then. Records the Provider must keep by law, such as financial transactions, are kept only for that purpose.

Each party’s liability under this DPA is subject to the limits in the Terms of Service. If this DPA and the Terms conflict on the processing of personal data, this DPA prevails. To ask a question, request a signed copy or give notice under this DPA, contact support@tamfreight.com.