Data Processing Addendum

1. Parties and scope

This Data Processing Addendum ("DPA") is between Timecampus Technologies Private Limited (CIN U72900TN2019PTC131007) ("Timecampus", the processor) and the organisation that uses MoveTheWheels under the Terms of Service or an Order Form (the "Customer", the controller). It applies whenever Timecampus processes personal data on the Customer's behalf to provide MoveTheWheels. On personal-data matters it prevails over the Terms of Service and the Master SaaS Agreement.

• Under the Digital Personal Data Protection Act, 2023 the Customer is the Data Fiduciary and Timecampus is the Data Processor.
• Under the EU and UK GDPR the Customer is the controller and Timecampus is the processor.
• Under the California CPRA the Customer is the business and Timecampus is a service provider.

The Service is delivered by Timecampus using personnel employed by Burdenoff Consultancy Services Private Limited, who act on Timecampus's instructions and are treated as its personnel under this DPA. Timecampus remains fully responsible for them.

2. Processing details

• Purpose: providing MoveTheWheels: order and shipment management, tracking and proof of delivery, fleet and driver management, route planning, warehouse and inventory operations, documents, notifications, AI-assisted suggestions, analytics, support and security.
• Data subjects: the Customer's users; drivers it employs or engages; its customers, consignees and recipients; and the carriers, brokers and 3PLs it works with.
• Personal data: names and contact details, account and role data, driver and licence details, vehicle records, order, shipment and route data, delivery addresses, location data where the Customer enables it, uploaded documents, device and usage data, and billing contacts.
• Special categories: not required and not permitted unless an Order Form expressly allows a specific use with additional controls.
• Duration: the subscription term, plus the export and deletion period in section 3.

3. Our obligations

Timecampus will:

• process personal data only on the Customer’s documented instructions: the Terms or Master SaaS Agreement, this DPA, the Order Form and the Customer’s configuration of the Service, and tell the Customer if it believes an instruction breaks data-protection law;
• make sure everyone who processes the data is bound by confidentiality;
• apply the security measures in section 5, with stricter controls for driver, location and proof-of-delivery data;
• help the Customer answer requests from data subjects, including drivers, customers, consignees and carriers, and pass on any such request it receives directly;
• help the Customer with impact assessments (driver-location tracking usually needs one) and with consultations with regulators such as the Data Protection Board of India;
• notify the Customer of a personal data breach without undue delay and within 72 hours of becoming aware of it, with the information then known, and keep it updated;
• at the end of the subscription let the Customer export its data for 30 days and then delete it, unless the Customer instructs us to keep statutory transport, carriage or tax records or the law requires retention;
• keep records of processing; and
• never use Customer personal data to train, fine-tune or evaluate machine-learning models, or to build profiles of individual drivers or recipients.

4. Customer obligations

• Have a lawful basis, and give the notices and obtain the consents required, for the driver, customer, consignee and location data it puts into the Service.
• Configure access (roles, single sign-on, multi-factor authentication and retention) appropriately, and not add data categories outside section 2 without agreeing it first.
• Not instruct Timecampus to process data unlawfully, including using AI features for decisions that significantly affect an individual without human review.
• Meet any obligations it has as the deployer of AI features, such as notices and impact assessments.

5. Security measures

• Hosting on Amazon Web Services in the Mumbai region (ap-south-1), with Cloudflare in front of all public traffic.
• TLS encryption in transit and encryption at rest for databases, caches and object storage.
• Every organisation’s data kept separate, with access enforced at the API gateway by role-based access control.
• Multi-factor authentication and least-privilege access for our staff; production access is logged.
• Vulnerability and dependency scanning of every build before it is deployed, and secret scanning of source code.
• Audit logs of changes to records, available to the Customer for its plan’s retention period.
• Daily backups kept for no more than 30 days, and documented incident-response procedures.

More detail is on our Security page. We review these measures at least once a year and will not reduce overall protection.

6. Subprocessors

The Customer authorises Timecampus to use the subprocessors listed on our Subprocessors page, which forms Annex 3 of this DPA. Timecampus binds each subprocessor to data-protection terms at least as protective as this DPA and remains liable for them. Map, geocoding, carrier and telematics providers are used only when the Customer turns on the matching integration.

We give at least 30 days' notice before adding or replacing a subprocessor, by updating that page and emailing the Customer's privacy contact where one is on file. The Customer may object on reasonable data-protection grounds within 14 days. If we cannot resolve the objection, the Customer may end the affected service and receive a pro-rata refund of prepaid, unused fees.

7. International transfers

Customer personal data is stored in India. Where personal data is transferred across borders, we use a lawful transfer mechanism: the cross-border rules of the DPDP Act; for data from the EEA, the European Commission's Standard Contractual Clauses (Module 2, controller to processor), which are incorporated into this DPA with the Customer as data exporter and Timecampus as data importer, Clause 9 Option 2 (general authorisation, 30 days' notice) and Clause 17 governed by Irish law unless the Customer names another EU Member State; and for data from the UK and Switzerland, the UK International Data Transfer Addendum and the Swiss-approved form of those clauses. A Customer that needs its data kept in a specific country can agree that in its Order Form.

8. Audits

On request we provide the information reasonably needed to show compliance with this DPA, including a completed standard security questionnaire. MoveTheWheels does not currently hold a third-party certification such as ISO 27001 or SOC 2. If the Customer reasonably needs more, it may, no more than once in any 12 months (or after a personal data breach, or when a regulator requires it), have an independent auditor we both agree on review the relevant controls, at its own cost, with 30 days' notice and under confidentiality.

9. Liability and term

The liability terms of the Terms of Service or the Master SaaS Agreement apply to this DPA, except where data-protection law makes a party directly liable to data subjects. This DPA lasts as long as Timecampus processes Customer personal data. If any part is invalid, the rest stays in force. For EEA and UK transfers, the Standard Contractual Clauses and UK Addendum prevail over this DPA if they conflict.

10. Contact

Questions about this DPA, a countersigned copy, or an objection to a subprocessor: [email protected]. Our Grievance Officer under the DPDP Act is Vignesh T.V., Founder, CEO & CTO.