Data processing agreement

1. Subject matter, nature and purpose

The Processor processes the personal data the Controller enters in the platform solely to deliver the contracted service: storing it, displaying it, processing it according to the features the Controller uses, sending it to the services the Controller connects and sharing it with the companies the Controller chooses.

2. Types of data and data subjects

• Controller's users: name, email, roles, access and activity logs.
• Contacts at clients, suppliers and other companies in the directory: name, job title, email, phone.
• Drivers: name, documents and driving licences with their expiry dates, absences.
• People appearing in operation documents (senders, consignees, signatories) to the extent the Controller adds them.
• The Controller must not add special categories of data unless its business requires it and it has been agreed with the Processor.

3. Processor obligations

• Process data only on the Controller's documented instructions, which are the contract, this document and the Controller's use of the platform.
• Ensure the confidentiality of the people authorised to process the data.
• Apply the security measures in section 4.
• Engage subprocessors only under the conditions in section 5.
• Help the Controller respond to data subjects' rights and meet its obligations on security, breach notification and impact assessments.
• Notify the Controller of any security breach affecting its data without undue delay and, in any case, within 48 hours of becoming aware of it.
• Make available to the Controller the information needed to demonstrate compliance and allow reasonable audits, with prior notice and without affecting other clients.

4. Security measures

• Isolation of each company's data in the database through row-level security, closed by default.
• Chained audit log of changes, security events and platform actions.
• Passwords with argon2id, expiring sessions and lockout after failed attempts.
• AES-256-GCM encryption of external service credentials.
• HTTPS encryption of communications and hosting in the European Union.
• Role-based permissions checked on the server for every action.

5. Subprocessors

The Controller authorises the Processor to engage the subprocessors published on the Subprocessors page. The Processor signs a contract with each of them with the same data protection obligations.

The Processor will give at least 15 days' notice of any new or replacement subprocessor, and the Controller may object on reasonable grounds. If no agreement is reached, the Controller may terminate the contract.

6. Disclosures between platform companies

When the Controller shares records with another company through the logictra network, the disclosure is decided by the Controller. The Processor carries it out according to the field and record rules the Controller configures, and records it in both companies' audit logs.

7. International transfers

Data is hosted in the European Union. If a subprocessor involves a transfer outside the European Economic Area, it relies on an adequacy decision or on the European Commission's standard contractual clauses.

8. End of processing

When the service ends, the Processor will return the data to the Controller in a structured format if requested within the following 30 days, and will then delete it, except what it must keep by law, which will be blocked.

9. Contact

For any matter related to this agreement: info@mail.logictra.com.