Data Processing Agreement (DPA)

Between:

HaulCheck trading as HaulCheck, of "Hillcrest", 25 High Street, Monaghan, Ireland, H18KD29 ("Processor", "HaulCheck")

And:

The customer identified in the HaulCheck account/order ("Controller", "you")

This DPA forms part of, and is incorporated into, the HaulCheck Terms of Service / subscription agreement between the parties ("Agreement"). It applies whenever HaulCheck processes personal data on your behalf in connection with the HaulCheck platform and driver app.

---

1. Definitions

Terms such as "personal data", "processing", "controller", "processor", "data subject", "personal data breach", and "supervisory authority" have the meanings given in the UK GDPR and, where applicable, the EU GDPR ("Data Protection Laws").

2. Roles of the parties

2.1 For the driver, vehicle, and fleet compliance data you input into or generate through HaulCheck (e.g. driver licence details, tachograph data, Driver CPC status, defect reports), you are the Controller and HaulCheck is the Processor.

2.2 For account, billing, and platform usage data, HaulCheck acts as an independent Controller as described in our Privacy Policy.

3. Subject matter and details of processing

4. HaulCheck's obligations

HaulCheck shall:

4.1 Process personal data only on your documented instructions (including as set out in the Agreement and this DPA), unless required to do otherwise by law, in which case HaulCheck will inform you before processing, unless legally prohibited from doing so.

4.2 Ensure that personnel authorised to process personal data are subject to confidentiality obligations.

4.3 Implement appropriate technical and organisational security measures, including encryption of data in transit and at rest, role-based access controls, and regular security review, as described in Clause 7.

4.4 Not engage a sub-processor without providing you general notice of the appointment (see Clause 6), and impose data protection obligations on any sub-processor equivalent to those in this DPA.

4.5 Assist you, insofar as reasonably possible, in responding to requests from data subjects exercising their rights under Data Protection Laws.

4.6 Assist you in ensuring compliance with obligations relating to the security of processing, breach notification, and data protection impact assessments, taking into account the nature of processing and information available to HaulCheck.

4.7 At your choice, delete or return all personal data on termination of the Agreement, except to the extent HaulCheck is required by law or statutory retention obligation (e.g. tachograph record-keeping rules) to retain it — see Clause 8.

4.8 Make available to you information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate, subject to reasonable notice and confidentiality.

5. Your obligations

You warrant that:

5.1 You have a lawful basis for the personal data you provide to or process through HaulCheck, and have given any required notices to, and where necessary obtained consent from, your drivers and other data subjects.

5.2 Your instructions to HaulCheck for the processing of personal data comply with Data Protection Laws.

6. Sub-processors

6.1 You provide general authorisation for HaulCheck to engage sub-processors to support delivery of the service, currently including hosting/infrastructure providers such as Emergent (emergent.sh). A current list of sub-processors is available on request.

6.2 HaulCheck will notify you of any intended changes to sub-processors, giving you the opportunity to object on reasonable data-protection grounds.

7. Security measures

HaulCheck maintains technical and organisational measures appropriate to the risk, including:

• Encryption of personal data in transit (TLS) and at rest
• Role-based access controls restricting access to driver-level data
• Cloud infrastructure provided by Emergent (Google Cloud)
• Regular review of security practices
• Incident response procedures for personal data breaches

8. Data retention and deletion

8.1 HaulCheck retains personal data for the duration of your active subscription, and thereafter only as required by statutory retention obligations (e.g. tachograph and driver compliance record-keeping rules) or as otherwise agreed.

8.2 On termination of the Agreement, HaulCheck will, at your request, delete or return personal data within 30 days, save for data HaulCheck is required to retain by law.

9. Personal data breaches

HaulCheck will notify you without undue delay after becoming aware of a personal data breach affecting your data, and will provide information reasonably necessary for you to meet any of your own notification obligations under Data Protection Laws.

10. International transfers

Personal data is hosted in the UK. Any transfer of personal data outside the UK or EEA will only take place where an adequate level of protection is ensured, including via Standard Contractual Clauses or another lawful transfer mechanism.

11. Liability

Each party's liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability set out in the Agreement.

12. Term and termination

This DPA remains in effect for as long as HaulCheck processes personal data on your behalf under the Agreement, and terminates automatically on termination or expiry of the Agreement, subject to Clause 8.

13. Governing law

This DPA is governed by the laws of the Republic of Ireland, unless otherwise stated in the Agreement.

---

Signed for and on behalf of HaulCheck:

Name: _______________________

Title: _______________________

Date: _______________________

Signed for and on behalf of the Controller:

Name: _______________________

Title: _______________________

Date: _______________________