Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between PrologEU (Carriage LLC, the processor) and the customer (the controller) and meets the requirements of Article 28 of the GDPR.

1. Subject and duration

The processor processes personal data on behalf of the controller to provide the PrologEU service, for as long as the agreement is in force. Nature and purpose: storing, analysing and displaying fleet, tachograph and driver data so that the controller can manage its fleet and its compliance with driving and working time rules.

2. Data and data subjects

Data subjects: the controller's drivers, staff and users. Data: identity and contact data, driver card data, tachograph activity data, position data, vehicle data, documents, loads, inspections, maintenance and fuel records, and account data.

3. Processor obligations

• Process personal data only on the controller's documented instructions, including the use of the Service.
• Inform the controller immediately if, in its opinion, an instruction infringes data protection law.
• Ensure that persons authorised to process the data are bound by confidentiality.
• Implement appropriate technical and organisational measures (Art. 32), including encrypted connections, separation of customer data, role-based access and hosting in the EU.
• Assist the controller with data subject requests, security, breach notification and data protection impact assessments.
• Notify the controller without undue delay after becoming aware of a personal data breach.
• At the end of the agreement, delete or return the personal data at the controller's choice, unless law requires storage.
• Make available the information needed to demonstrate compliance and allow for reasonable audits.

4. Sub-processors

The controller authorises the following sub-processors: Amazon Web Services (hosting in Frankfurt, Germany), HERE Technologies (routing), Google (maps), Namecheap (email used for customer support) and, where the controller connects them, its telematics provider. The processor will inform the controller of intended changes, giving the controller the opportunity to object. The processor imposes the same data protection obligations on each sub-processor by contract and remains responsible to the controller for its sub-processors' performance.

5. International transfers

Personal data is stored in the EU. Where data is accessed from outside the EU/EEA, including by Carriage LLC in the USA, the parties rely on the European Commission's Standard Contractual Clauses.

6. Signed copy

To receive a signed copy of this DPA for your records, email support@prologeu.com.