Data Processing Agreement

1. Parties and how this agreement applies

This Data Processing Agreement ("DPA") is between the customer named in the order form ("you") and the Transynq entity named in the same order form ("Transynq", "we"). It forms part of the agreement under which you subscribe to the Transynq service (the "Agreement").

If this DPA and the Agreement conflict on the processing of personal data, this DPA prevails. Anything this DPA does not change stays as the Agreement sets it out, including limits of liability.

2. Definitions

Terms such as controller, processor, personal data, processing and data subject have the meaning given in the data protection laws that apply to the processing. In this DPA:

• Customer personal data: personal data that you, your users, your customers or your drivers enter into or generate in the Transynq service.
• Data protection laws: the laws that apply to the processing of customer personal data, which may include the Australian Privacy Act 1988, Singapore's Personal Data Protection Act 2012, the EU GDPR and the UK GDPR.
• Sub-processor: a third party Transynq engages to process customer personal data.
• Security incident: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, customer personal data.

3. Roles and instructions

You are the controller (or a processor acting for your own controller) of customer personal data, and Transynq is your processor. You are responsible for having a lawful basis for the processing and for the instructions you give.

Transynq processes customer personal data only on your documented instructions. The Agreement, this DPA and the settings you choose in the service are your instructions. If we believe an instruction breaks data protection law, we will tell you.

4. Details of the processing

The processing is described as follows:

• Subject matter and purpose: providing, supporting and securing the Transynq transport management service.
• Duration: the term of the Agreement, plus the export and deletion period in section 10.
• Nature: collection, storage, organisation, retrieval, use, transmission and deletion through the service.
• Data subjects: your users, your customers and their receivers, drivers, subcontractors and their staff.
• Categories of data: names, phone numbers and email addresses; sign-in and security records (IP address and user agent); proof of delivery (signatures, photos, times and notes); and vehicle position and time when tracking is turned on.
• Special categories: none are required by the service. Do not enter them unless the law allows it and you have agreed it with us.

5. Confidentiality and personnel

Transynq makes sure that everyone authorised to process customer personal data is bound by confidentiality. Staff access customer personal data only when it is needed to run, support or secure the service.

6. Security measures

Transynq maintains appropriate technical and organisational measures to protect customer personal data, including the measures described on the Transynq security and trust page: hosting in the Microsoft Azure region you choose, encryption in transit (TLS 1.2 or better) and at rest (AES-256), separation of each company's data in code with automated tests, role-based access control, and audit records of sign-ins and changes.

We may update these measures as the service develops, provided the overall level of protection does not decrease.

7. Sub-processors

You give Transynq general authorisation to engage sub-processors. The current list is in the Transynq customer data protection policy; Microsoft Azure hosts every deployment, and the other sub-processors receive customer personal data only when you enable the feature that uses them.

We will update the list before a new sub-processor receives customer personal data. If you object on reasonable data protection grounds within 30 days, we will discuss it with you in good faith; if we cannot resolve it, you may end the affected part of the service.

We bind each sub-processor to data protection obligations no less protective than this DPA and remain responsible to you for its performance.

8. International transfers

Customer personal data is stored in the Azure region you choose. Where an enabled sub-processor or support activity involves a transfer that data protection law restricts, the transfer is made under an appropriate safeguard, such as the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum.

9. Security incidents

Transynq will notify you of a security incident affecting customer personal data without undue delay and in any case within 72 hours of becoming aware of it.

The notice will describe the nature of the incident, the categories and approximate number of data subjects and records concerned where known, the likely consequences, and the measures taken or proposed. We will update you as more becomes known and give you reasonable help with any notification you must make.

10. Return and deletion

When the Agreement ends, customer personal data stays available for you to export for 30 days. After that, Transynq deletes it from the live service, and backups that still contain it are deleted as they expire, within a further 35 days, unless the law requires us to keep it.

11. Assistance

Taking into account the nature of the processing, Transynq will give you reasonable help to respond to requests from data subjects, and to carry out data protection impact assessments and consultations with regulators where the law requires them.

If we receive a request directly from one of your data subjects, we will pass it to you and not answer it ourselves unless you ask us to.

12. Information and audits

Transynq will make available the information reasonably needed to show compliance with this DPA, including written answers to your security questionnaire, the security and trust page, and third-party reports once they exist.

If that information is not enough, you may audit our compliance once a year on 30 days' written notice, at your cost, during business hours and under confidentiality, in a way that does not compromise other customers' data or the security of the service.

13. Requests from authorities

Transynq discloses customer personal data to a government or law enforcement body only where the law requires it, and will tell you first unless the law forbids it.

14. Term and signing

This DPA lasts for as long as Transynq processes customer personal data for you. To sign it, email us with your company's legal name and the name of the person signing; we will return a copy countersigned and dated, together with your order form.

Send DPA requests to contact@transynq.io.