Data Processing Addendum
Effective: September 9, 2026. Incorporated into the Terms of Service; it applies wherever Service Provider processes Customer Personal Data.
This Data Processing Addendum ("DPA") forms part of the agreement between "IRSA" MCHJ, a limited liability company organised under the laws of the Republic of Uzbekistan, TIN 313132120 ("Service Provider"), and the customer identified in the applicable order, checkout record or agreement ("Customer") for use of Carrier Safety Check (the "Service").
If this DPA conflicts with the Terms of Service on processing of Customer Personal Data, this DPA controls to the extent of the conflict.
1. Definitions
Applicable Data Protection Law means privacy, data-protection and security law applicable to the processing covered by this DPA.
Customer Personal Data means personal information/personal data submitted by or for Customer to the Service, or otherwise processed by Service Provider on Customer's behalf, excluding information for which Service Provider acts independently as a controller/business for its own account administration, billing, security, legal compliance or similar purposes.
Process, controller, processor, business, service provider, consumer, data subject, sell and share have the meanings given by Applicable Data Protection Law where those terms apply.
2. Roles and instructions
For Customer Personal Data contained in carrier-verification requests and uploaded carrier documents, the parties intend that:
- Customer determines the commercial purpose and means of the verification and
acts as controller/business or equivalent; and
- Service Provider processes Customer Personal Data on Customer's documented
instructions as processor/service provider or equivalent.
Customer instructs Service Provider to process Customer Personal Data only as necessary to provide, secure, support and improve the contracted Service in a manner consistent with the agreement, this DPA and Customer's lawful use of the Service.
Service Provider may process separate account, billing, fraud-prevention, security and legal-compliance data for its own legitimate business purposes as an independent controller/business where permitted by law.
3. Customer obligations
Customer represents that it:
- has a lawful basis, authority or other right required to provide Customer
Personal Data to Service Provider and instruct the processing;
- will provide notices and obtain authorisations required from individuals;
- will not instruct Service Provider to process data in violation of law; and
- will not use the Service for consumer credit, personal insurance, housing,
driver employment screening or another prohibited purpose described in the Terms.
Customer should submit only personal information reasonably necessary for the carrier-verification purpose.
4. Processing restrictions
Service Provider will not, except as permitted by Applicable Data Protection Law or necessary to provide the Service:
- sell Customer Personal Data;
- share Customer Personal Data for cross-context behavioural advertising;
- retain, use or disclose Customer Personal Data outside the contracted business
purpose and Customer's lawful instructions;
- combine Customer Personal Data received from Customer with personal
information received from another unrelated customer or collected from an individual's unrelated interaction, where Applicable Data Protection Law prohibits that combination; or
- use uploaded carrier documents to train Service Provider's own general-purpose
machine-learning models.
If Service Provider believes an instruction violates Applicable Data Protection Law, it may suspend the affected processing and inform Customer where legally permitted.
5. Confidentiality and access
Service Provider will limit access to Customer Personal Data to personnel and contractors who need access for the Service and who are subject to appropriate confidentiality obligations.
6. Security
Service Provider will maintain reasonable administrative, technical and organisational safeguards appropriate to the nature of Customer Personal Data and the risks of the processing. The current baseline is summarised in Annex B.
Customer is responsible for securing its own accounts, credentials, endpoints and authorised users.
7. Subprocessors
Customer authorises Service Provider to use subprocessors to provide the Service. The current list is in Annex C and may also be maintained on a Subprocessors page made available through the Service or its public website.
Service Provider will impose data-protection obligations on subprocessors appropriate to the processing they perform.
Production safeguard: personal source documents must not be sent to an unpaid Gemini API project. Gemini document processing must use an approved paid Cloud Project/contractual configuration as described in the Privacy Policy.
Service Provider will provide at least 15 days' advance notice before a new subprocessor begins processing Customer Personal Data where reasonably practicable. Advance notice is not required for an emergency replacement needed to address a security, availability or legal issue, but Service Provider will provide notice without undue delay afterward.
Customer may object during the notice period on reasonable, documented data- protection grounds. The parties will work in good faith to resolve the objection. If they cannot resolve it, Service Provider may offer a commercially reasonable way to avoid the affected processing; if none is available, Customer may terminate the affected Service or subscription before the new subprocessor begins processing Customer Personal Data, and Service Provider will refund any prepaid fees covering the terminated period.
8. Individual/privacy requests
Taking into account the nature of the processing, Service Provider will provide reasonable assistance to Customer with requests from individuals to access, correct, delete or otherwise exercise rights concerning Customer Personal Data, to the extent Customer cannot reasonably fulfil the request through the Service.
If Service Provider receives a request concerning Customer Personal Data, it may refer the requester to Customer and/or notify Customer, unless Applicable Data Protection Law requires Service Provider to respond directly.
Service Provider may verify the requester before disclosing or changing personal information.
9. Accuracy, correction and historical reports
Where the Service preserves an immutable historical verification report, correcting later information may create an amendment or superseding report rather than alter the historical snapshot. This is intended to preserve what was shown at the original time while clearly recording the correction.
The parties will cooperate on legally required correction or dispute procedures.
10. Security incidents
Service Provider will notify Customer without undue delay after becoming aware that a Security Incident affecting Customer Personal Data has occurred, where notice is required by Applicable Data Protection Law or the parties' agreement. Service Provider does not make a fixed-hour incident-notification SLA in this standard DPA; any stricter deadline must be stated in a signed order form or enterprise security addendum.
The notice will provide information reasonably available to Service Provider, which may include the nature of the incident, affected data/customers, containment or remediation steps and a contact for follow-up. Information may be provided in phases as the investigation develops.
"Security Incident" does not include unsuccessful attempts that do not result in unauthorised access to Customer Personal Data, such as blocked scans or failed login attempts.
11. Deletion and return
During the agreement, Customer may delete requests/source documents using available Service controls.
On termination or Customer request, Service Provider will delete or return Customer Personal Data as required by the agreement and Applicable Data Protection Law, except for data that Service Provider is permitted or required to retain for legal, security, billing, dispute or minimized historical audit purposes.
The intended production retention schedule is described in the Privacy Policy. Raw source documents are retained for no more than 90 days by default, unless deleted earlier or a different period is lawfully agreed in writing.
12. Audits and information
Service Provider will make information reasonably necessary to demonstrate compliance with this DPA available to Customer, subject to confidentiality, security and reasonable scope/frequency limits.
Service Provider may satisfy reasonable audit requests first through available security documentation, questionnaires, certifications or independent reports. If Applicable Data Protection Law requires additional audit access and those materials are not sufficient, Customer may conduct one audit in any 12-month period on at least 30 days' written notice, during normal business hours, at Customer's expense and subject to reasonable confidentiality, security and non-disruption requirements. More frequent audits are permitted where required by law or following a confirmed material Security Incident affecting Customer Personal Data. An audit may not provide access to another customer's data or to information that would materially compromise Service Provider's security.
13. International processing
Customer acknowledges that Service Provider's subprocessors may process data in countries other than the United States as disclosed in the Privacy Policy and subprocessor information.
If Applicable Data Protection Law requires a specific transfer mechanism, the parties will execute or incorporate the legally required mechanism before the relevant transfer.
14. Term
This DPA remains in effect for as long as Service Provider processes Customer Personal Data on Customer's behalf, including any permitted post-termination retention period.
Annex A — Processing details
| Item | Description |
|---|---|
| Subject matter | B2B US motor-carrier verification, document comparison, monitoring and audit history |
| Duration | For the term of the Service plus the applicable retention/deletion period |
| Nature of processing | receive, store, extract, compare, query, score, classify, display, monitor, transmit to approved subprocessors, secure, delete and preserve minimized audit evidence |
| Purpose | provide Customer-requested commercial carrier verification and related Service functions |
| Individuals | drivers, carrier owners/representatives, dispatchers and other individuals appearing in carrier documents; Customer users |
| Data categories | names, work/contact details, CDL number/state/expiry/endorsements, addresses, phone numbers, VIN/plate, document contents, carrier/insurance information, request/report metadata |
| Intentionally excluded structured fields | date of birth, photograph, signature, physical characteristics and biometric identifiers are not intended to be extracted into structured risk-analysis fields, although source documents may contain them until deletion |
Annex B — Baseline security measures
- encryption in transit;
- encryption/storage protections provided by contracted infrastructure vendors;
- tenant/account authorization controls designed to prevent cross-customer access;
- least-privilege production access;
- authentication/session controls;
- API tokens stored only as non-reversible hashes;
- logging and monitoring of security-relevant events;
- secret-management practices;
- documented incident-response process;
- retention/deletion automation for raw source documents;
- backups and recovery controls appropriate to the Service;
- subprocessor/vendor review appropriate to the data they receive.
These measures are a baseline commitment. Specific implementation details may change as the Service evolves, provided the overall level of protection is not materially reduced.
Annex C — Current/approved subprocessors
| Subprocessor | Function | Data involved |
|---|---|---|
| Supabase | database/authentication | account, request, report/audit data |
| Cloudflare | application hosting, delivery, R2 object storage, cache | traffic metadata, uploaded source documents, configured cache data |
| Google Gemini API — Paid Services configuration only | document extraction/classification | uploaded source document and extraction prompt/context |
| AbstractAPI | phone enrichment | submitted phone number |
| Lemon Squeezy | merchant of record/payment administration | customer/billing data required for payment |
| Geoapify | address geocoding | carrier business address submitted for the lookup |
Geoapify is the approved geocoding provider. Production geocoding remains disabled until this addendum is executed; while it is disabled, no carrier address is transmitted to any geocoding provider.
Government/public data sources queried for carrier information (such as FMCSA, NHTSA and trade.gov) are data sources used to perform customer-requested checks; they are not treated as subprocessors merely because the Service submits a carrier identifier or other lookup value to their public/government interfaces.