Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms and Conditions between Handova LLC ("Processor", "Handova") and the business customer ("Customer"). It applies when Handova processes personal data on the Customer's behalf, and is designed to meet Article 28 of the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended (CCPA) and other U.S. state privacy laws, and the data protection laws of other countries where the Customer uses Handova (together, "Data Protection Laws"). The Customer accepts this DPA by accepting the Terms; a countersigned copy is available from privacy@myhandova.com.

1. Roles and scope

• The Customer is the controller (or "business") of Customer Personal Data, and Handova is its processor (or "service provider"). Where the Customer is itself a processor for another controller, Handova is its sub-processor.
• "Customer Personal Data" means personal data in Customer Data processed by Handova to provide the Service. The details are in Annex 1.
• The Customer is responsible for having a lawful basis, giving notices and obtaining any consents for the processing, including for location tracking (see the GPS Tracking and Driver Consent Policy).

2. Handova's obligations

1. Instructions. Handova processes Customer Personal Data only on the Customer's documented instructions, which are the Agreement and the Customer's use and settings of the Service, unless the law requires otherwise (in which case Handova will tell the Customer first, unless the law forbids it). Handova will tell the Customer if it believes an instruction breaks Data Protection Laws.
2. Confidentiality. Everyone authorised to process Customer Personal Data is bound by confidentiality and receives access only as needed.
3. Security. Handova implements the technical and organisational measures in Annex 2, appropriate to the risk, and may update them provided the overall level of protection is not reduced.
4. Sub-processors. The Customer gives general authorisation for Handova to use the sub-processors listed in Annex 3. Handova will give at least 30 days' notice (by email or in the Legal centre) before adding or replacing a sub-processor. The Customer may object on reasonable data-protection grounds within that time; if the parties cannot resolve the objection, the Customer may terminate the affected service and receive a refund of prepaid fees for the unused period. Handova imposes data-protection obligations on each sub-processor no less protective than this DPA and remains responsible for them.
5. Data subject requests. Handova will promptly pass on any request it receives from an individual about Customer Personal Data, will not answer it except to redirect the individual, and will help the Customer respond using the Service's features or other reasonable assistance.
6. Assistance. Handova will provide reasonable help with the Customer's security obligations, data protection impact assessments and prior consultations with authorities, taking into account the nature of the processing and the information available to Handova.
7. Personal data breaches. Handova will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data, with the information the Customer reasonably needs to meet its obligations (to the extent known, updated as more is learned), and will take reasonable steps to contain and remedy it. Notifying is not an admission of fault.
8. Deletion and return. When the Agreement ends, the Customer may export its data for 30 days. Handova then deletes Customer Personal Data, including copies, within a further 30 days (and from backups within 90 days), unless the law requires storage, in which case Handova keeps it protected and uses it only for that purpose.
9. Audits. Handova will make available the information reasonably needed to show compliance with this DPA, including answers to security questionnaires and any independent audit reports it has. Where this is not enough, or a regulator requires it, the Customer may carry out an audit (by itself or an independent auditor bound by confidentiality) once a year with at least 30 days' notice, during business hours, at its own cost, without access to other customers' data.
10. Records. Handova keeps records of processing as Data Protection Laws require.

3. International transfers

• Handova LLC is in the United States and may process Customer Personal Data in the United States and in the locations of its sub-processors.
• EEA: for transfers of personal data from the European Economic Area to a country without an adequacy decision, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 ("SCCs") are incorporated by reference: Module 2 (controller to processor) where the Customer is a controller, and Module 3 (processor to processor) where it is a processor. Clause 7 (docking) applies; under Clause 9 option 2 (general authorisation) applies with the notice period in section 2.4; the optional wording in Clause 11 does not apply; Clauses 17 and 18 select the law and courts of Ireland; Annexes I to III are completed by Annexes 1 to 3 of this DPA; the competent supervisory authority is that of the Customer's EU establishment or EU representative.
• UK: the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner applies, with the tables completed using this DPA and either party able to end it as allowed by its Section 19.
• Switzerland: the SCCs apply with the references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner as a competent authority.
• Other countries (for example South Africa, Nigeria, Kenya, Brazil, India and others): the parties agree that this DPA, including the SCC protections applied to all Customer Personal Data, is the contract or binding agreement those laws require for transfers, and will sign any additional standard clauses the law of the Customer's country requires on request.
• If a transfer mechanism is invalidated, the parties will cooperate to put another valid mechanism in place promptly.
• If a public authority requests Customer Personal Data, Handova will review the legality of the request, challenge it where there are reasonable grounds, disclose only the minimum required, and notify the Customer unless the law forbids it.

4. U.S. state privacy laws (CCPA and others)

Handova acts as a "service provider" or "processor" and will: process Customer Personal Data only for the business purposes in Annex 1 and the Agreement; not sell or share it (including for cross-context behavioural advertising); not retain, use or disclose it outside the direct business relationship or for any other commercial purpose; not combine it with personal data from other sources except as the law permits; comply with applicable obligations and provide the same level of privacy protection the law requires; notify the Customer if it can no longer meet these obligations; and allow the Customer to take reasonable steps to stop and remedy unauthorised use. Handova certifies that it understands and will comply with these restrictions.

5. General

This DPA lasts as long as Handova processes Customer Personal Data. The limitations of liability in the Terms apply to this DPA, except where Data Protection Laws or the SCCs do not allow it. If this DPA conflicts with the Terms, this DPA prevails for personal data; if it conflicts with the SCCs, the SCCs prevail.

Annex 1 – Details of processing

Annex 2 – Technical and organisational security measures

• Encryption: HTTPS/TLS for all data in transit; encryption at rest provided by the hosting provider where available; passwords stored only as salted, slow one-way hashes (scrypt or PBKDF2).
• Access control: role-based access (driver, company, Handova staff); each company sees only its own data; Handova staff can see a company's private details only after asking for time-limited access, and every such access is logged; least privilege for administrators.
• Authentication: login rate limits and temporary lock-outs; secure, HTTP-only, same-site session cookies; automatic sign-out after inactivity (unless the user chose "Remember me"); single-use, time-limited password-reset links; optional sign-in with Google.
• Application security: protection against forged requests (CSRF tokens), parameterised database queries, security headers, validation of all input.
• Availability and resilience: regular backups, ability to restore, monitoring, and timely security updates of software and dependencies.
• Data minimisation and retention: phone location collected only during shifts; automatic deletion of old location data; no advertising trackers.
• People: confidentiality obligations and security training for staff with access; access removed when no longer needed.
• Incident response: a documented process to detect, contain, investigate and notify personal data breaches.
• Sub-processor management: due diligence and written data protection terms for each sub-processor.

Annex 3 – Approved sub-processors