Data Processing Addendum

1. Definitions

• Customer Data means data submitted to the floDock service by or for Customer and its authorised users, including bookings, appointments, gate and yard moves, trips and delivery status, driver work activity, dock and gate proof, inspections, weigh records, messages, attached files, photos and short video clips, location stamps on captures, trip location while a trip is active in floDock Partner, and similar operational records.
• Data Protection Laws means all laws applicable to the processing of personal information under the Agreement, which may include the EU and UK GDPR, the California Consumer Privacy Act as amended (CCPA), other US state privacy laws, and Canada’s PIPEDA and provincial equivalents.
• Personal Information, controller, processor, business, service provider, data subject, processing and personal data breach have the meanings given in Data Protection Laws.
• Subprocessor means a third party engaged by floDock to process Customer Data.

2. Roles and scope

This Data Processing Addendum (“DPA”) forms part of the agreement between floDock Inc.(“floDock”) and the company that subscribes to the floDock service (“Customer”) under an order form, subscription agreement or our Terms of Service (the “Agreement”). It sets out how floDock processes personal information contained in Customer Data on Customer’s behalf. floDock Labs LLC is an affiliated company that publishes the floDock Partner, Yard and Go mobile apps; authorised users may access Customer Data through those apps, and floDock Inc. remains the processor under this DPA. Customer may request a signed copy, or the EU Standard Contractual Clauses and UK Addendum where required, by emailing hi@flodock.com.

For Customer Data, Customer is the controller (or business) and floDock is the processor (or service provider). Customer may itself be a processor for another controller, in which case floDock is a sub-processor and Customer warrants that it has the authority to give the instructions in this DPA. This DPA does not apply to personal information for which floDock is the controller, such as account sign-in data, website visitor data and technical data described in the Privacy Policy.

Details of processing. Subject matter: provision of the floDock yard management service. Duration: the term of the Agreement plus the deletion period in section 9. Nature and purpose: hosting, storage, transmission, display and backup of Customer Data to operate yard, dock, gate and carrier workflows and messaging for Customer. Categories of data subjects: Customer’s employees, contractors, carriers, partners, facility staff and drivers who interact with Customer’s yards. Categories of personal information: names, work contact details, user identifiers, roles, booking and movement records, optional phone numbers and profile photos, messages and files, photos and short clips that users choose to attach for work, trip location shared in floDock Partner while a trip is active, and location stamps on floDock Yard gate-in, check-out and proof captures, and, for evidence links a customer shares, the recipient’s email address, one-time code attempts and an access log. The service does not ask users for health, financial or biometric information, and floDock does not collect government ID numbers for its own purposes.

3. Customer’s instructions and responsibilities

floDock will process Customer Data only on Customer’s documented instructions, which consist of the Agreement, this DPA, Customer’s configuration and use of the service, and any further written instructions floDock agrees to. floDock will inform Customer if, in its opinion, an instruction infringes Data Protection Laws, without any obligation to carry out a legal review. Customer is responsible for the accuracy, quality and legality of Customer Data, for the means by which it was obtained, for providing all notices and obtaining all consents required to collect it, and for configuring the service and user access appropriately.

4. Confidentiality

floDock limits access to Customer Data to personnel who need it to provide the service, who are bound by confidentiality obligations and who receive appropriate training.

5. Security

floDock implements technical and organisational measures appropriate to the risk, taking into account the state of the art, the costs of implementation and the nature of the processing. Current measures include encryption of data in transit (HTTPS), hashed storage of credentials, role-based access within the service, revocable device sessions, server request logs, and backups taken on a regular schedule. floDock may update these measures provided the overall level of security is not materially reduced. Customer acknowledges that floDock is an early-stage company and does not currently hold third-party security certifications; any additional security commitments must be agreed in writing. See also our Security page.

6. Subprocessors

Customer authorises floDock to use the Subprocessors listed on our subprocessors page. floDock will impose on each Subprocessor data protection obligations no less protective than those in this DPA, and remains responsible for their performance. floDock will update the subprocessors page before engaging a new Subprocessor for Customer Data and, where Customer has asked for notices, will notify Customer by email. Customer may object on reasonable data protection grounds within 30 days of the notice. If the parties cannot resolve the objection within a further 30 days, either party may terminate the affected service and floDock will refund any prepaid, unused fees for the terminated service. This is Customer’s sole remedy for an objection.

7. Assistance

Taking into account the nature of the processing, floDock will assist Customer with reasonable technical and organisational measures to respond to data subject requests, and with Customer’s obligations relating to security, breach notification, data protection impact assessments and consultation with supervisory authorities. If floDock receives a request directly from a data subject relating to Customer Data, it will direct the data subject to Customer and will not respond substantively without Customer’s authorisation unless legally required. floDock may charge reasonable fees for assistance that goes beyond the self-service features of the product.

8. Personal data breaches

floDock will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Data, and will provide information reasonably available to it to help Customer meet its own notification obligations, supplementing the notice as more information becomes known. floDock’s notification of or response to a breach is not an acknowledgement of fault or liability.

9. Deletion and return

During the term, individual users can delete their accounts as described on the account deletion page, and Customer may ask floDock to delete Customer Data. Within 90 days after termination or expiry of the Agreement, floDock will, at Customer’s written request made before the end of that period, make Customer Data available to Customer in a format floDock reasonably determines, and will then delete Customer Data remaining in the service, except for copies that must be retained by law, that are needed to resolve a dispute, or that persist in backups until they age out on floDock’s normal backup schedule. Such copies remain subject to this DPA. Records associated with individual users who deleted their accounts are handled as described on the account deletion page.

10. Audits

On written request no more than once in any 12-month period, floDock will make available information reasonably necessary to demonstrate compliance with this DPA, by responding to a written security questionnaire and providing summaries of relevant policies and any third-party assessments it holds. Where Data Protection Laws grant Customer an audit right that cannot be satisfied this way, Customer may conduct an audit on reasonable prior notice, during business hours, no more than once per year unless required by a supervisory authority or following a breach, at Customer’s expense, through an independent auditor bound by confidentiality, and without disrupting floDock’s operations or exposing other customers’ data.

11. International transfers

floDock processes Customer Data in the United States and in the locations shown on the subprocessors page. Where Customer Data protected by EU, UK or Swiss law is transferred to a country without an adequacy decision, the parties agree that the European Commission’s Standard Contractual Clauses (Module 2 or Module 3, as applicable), and for UK data the UK International Data Transfer Addendum, are incorporated by reference and apply to the transfer, with Customer as data exporter and floDock as data importer, and with the processing details in section 2 and the measures in section 5 forming the annexes. The parties will execute these documents separately on request.

12. US state law terms

To the extent the CCPA or another US state privacy law applies, floDock acts as a service provider or processor and will: process Customer Data only for the business purposes described in the Agreement; not sell or share Customer Data; not retain, use or disclose Customer Data outside the direct business relationship with Customer or for any purpose other than providing the service, except as permitted by law; not combine Customer Data with personal information from other sources except as permitted for service providers; comply with applicable obligations and provide the same level of privacy protection as the law requires of Customer; notify Customer if it can no longer meet these obligations; and allow Customer to take reasonable steps to stop and remediate unauthorised use. floDock certifies that it understands these restrictions.

13. Canada

Where PIPEDA or a provincial equivalent applies, floDock will protect Customer Data with safeguards comparable to those Customer must apply, will use it only to provide the service, and will assist Customer in responding to access and correction requests and in notifying breaches that create a real risk of significant harm.

14. Liability and precedence

Each party’s liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, and the parties’ total aggregate liability under the Agreement and this DPA together will not exceed the cap in the Agreement. If there is a conflict between this DPA and the Agreement, this DPA prevails with respect to the processing of personal information; the Standard Contractual Clauses prevail over this DPA where they apply. This DPA is governed by the law and jurisdiction of the Agreement unless Data Protection Laws require otherwise.

15. Changes

floDock may update this DPA to reflect changes in Data Protection Laws, Subprocessors or the service. We will post the updated version here with a new “Effective” date and, for material changes, give Customers notice as described in the Agreement. Updates will not reduce the overall level of protection provided to Customer Data.

Contact

floDock Inc. (processor under this DPA) and floDock Labs LLC (publisher of the floDock mobile apps), Fort Mill, South Carolina 29707, USA. Privacy and processing questions: hi@flodock.com.