Data Processing Addendum (Template)

1. Template Status

This DPA is intended to supplement the Terms of Service between Highway TMS (the “Service Provider”) and a customer that creates a HighwayTMS company workspace (the “Customer”). Where this DPA conflicts with the Terms on the processing of personal data, this DPA is intended to control — subject to legal review of the executed version.

2. Parties & Roles

The Customer determines what personal data it submits to the Service — typically information about its drivers, employees, contractors, and business contacts — and the purposes for which it is used. For that data, the Customer acts as the party that determines purposes and means (the “controller” or “business,” as applicable law defines it), and the Service Provider processes that personal data on the Customer’s behalf to provide the Service (the “processor” or “service provider,” as applicable law defines it).

[REQUIRES LEGAL REVIEW: the precise role labels depend on the jurisdictions and privacy laws that apply to each Customer. This template does not assert GDPR applicability.]

3. Scope & Instructions

The Service Provider will process personal data submitted through the Service only to: provide and operate the Service; maintain its security; prevent and address fraud or abuse; provide customer support; and comply with applicable law. Processing under this DPA covers the categories of data described in the Privacy Policy (account, company, driver/contractor, document, fleet/operations, and financial data) for the duration of the Customer’s use of the Service.

The Service Provider will not sell personal data, use it for advertising, or use it for its own unrelated purposes.

4. Confidentiality

The Service Provider will ensure that persons authorized to process personal data are bound by confidentiality obligations, whether contractual or statutory.

5. Security Measures

The Service Provider implements the technical and organizational measures described on the Security & Data Protection page, including authenticated sessions, private document storage, PostgreSQL Row Level Security, tenant-scoped authorization, role-based access controls, HTTPS in production, and server-side handling of privileged credentials. These measures may be updated over time so long as the overall level of protection is not materially reduced.

6. Subprocessors

The Customer authorizes the Service Provider to engage the subprocessors listed below (the same list published in the Privacy Policy) to process personal data as needed to operate the Service. Optional providers participate only when the related feature is enabled or a user chooses it. The Service Provider remains responsible for its subprocessors’ performance of their data-protection obligations.

[REQUIRES LEGAL REVIEW AND BUSINESS CONFIRMATION: the mechanism for advance notice of new subprocessors and Customer objection (for example, [NUMBER] days’ notice by email), and the open items flagged in the Privacy Policy list.]

7. Assistance with Privacy Requests

Taking into account the nature of the processing, the Service Provider will provide reasonable assistance — where the Customer cannot do so through the Service itself — with requests from individuals to exercise privacy rights in the Customer’s data (for example, access, correction, or deletion), to the extent required by applicable law. [REQUIRES LEGAL REVIEW: any cost allocation for assistance beyond routine requests.]

8. Incident Notification

[REQUIRES LEGAL REVIEW — the following is placeholder language, not an executed commitment.] If the Service Provider becomes aware of a confirmed security incident resulting in unauthorized access to or acquisition of the Customer’s personal data in the Service, it will notify the affected Customer without undue delay, share information reasonably available about the nature and scope of the incident, and take reasonable steps to mitigate it. [SPECIFIC NOTIFICATION WINDOWS AND CONTACT MECHANICS TO BE AGREED IN THE EXECUTED VERSION.] As a proposed default for counsel to confirm, notice would be given within [NUMBER] hours of confirming the incident, sent to the Customer’s Admin contact on file.

9. Audit Rights

[REQUIRES LEGAL REVIEW.] On reasonable written request, and not more than once per year unless required by a regulator or after a confirmed incident, the Service Provider will make available information reasonably necessary to demonstrate compliance with this DPA, such as the Security & Data Protection page and written answers to a security questionnaire. On-site audits, if any, are subject to advance notice, confidentiality, and the Customer bearing the costs. The Service Provider does not currently hold third-party security certifications.

10. California Service-Provider Terms

To the extent the California Consumer Privacy Act (as amended) applies, the Customer is the “business” and the Service Provider is a “service provider.” The Service Provider will: (a) not sell or share personal information; (b) retain, use, or disclose it only for the business purposes in this DPA and not outside the direct business relationship; (c) not combine it with personal information from other sources except as the law permits; (d) provide the level of privacy protection the law requires and tell the Customer if it can no longer do so; and (e) allow the Customer to take reasonable steps to confirm compliance and to stop and remediate unauthorized use. [REQUIRES LEGAL REVIEW.]

11. Deletion & Return

On termination of the Customer’s account, the Service Provider will, at the Customer’s request, delete or return personal data processed under this DPA, subject to retention required by law, legal holds, dispute resolution, or legitimate business records, and subject to backup-cycle delays described in the Privacy Policy. Customers can also export operational records from the Service before closure.

12. International Transfers

[PLACEHOLDER — REQUIRES LEGAL REVIEW AND BUSINESS CONFIRMATION. The Service is operated from the United States; the production hosting/database regions and any cross-border processing must be confirmed from the deployed configuration before this section is completed. This template does not include Standard Contractual Clauses, EU or UK representatives, or a Data Protection Officer designation — none have been established. If a Customer’s data is subject to EEA, UK, or Swiss transfer rules, the parties would incorporate the EU Standard Contractual Clauses (Module Two, controller to processor) and the UK International Data Transfer Addendum by reference in the executed version. Add transfer mechanisms only if and when they genuinely apply.]

13. How to Execute This DPA

[REQUIRES LEGAL REVIEW.] Once counsel has approved this template, it can be put in place in either of two ways: (1) online acceptance, where the DPA is incorporated into the Terms of Service that the Customer’s Admin accepts at account setup; or (2) a signed copy on request, by writing to support@highwaytms.com with the Customer’s legal name and signatory. Until counsel approves it, this page is a template only.

14. General

[REQUIRES LEGAL REVIEW: governing law for this DPA (expected to follow the Terms — currently State of Michigan), order of precedence, liability interaction with the Terms, and signature blocks for Highway TMS and the Customer.]

Contact for DPA requests and notices: support@highwaytms.com.