Data Processing Agreement

This is a translation. In case of any discrepancy, the Czech version prevails.

This agreement governs the processing of personal data carried out by Palletoo on behalf of the customer under Article 28 GDPR. It is an annex to and an integral part of the Palletoo Terms and Conditions (T&C) and is concluded together with them.

1. Parties, subject matter and term

1.1 Controller: the customer who has concluded a contract with Palletoo under the T&C (the "Controller").

1.2 Processor: Hifour s.r.o., Company ID 47537841, registered office at Dobrovského 1076/36, 170 00 Prague 7, Czech Republic, operator of the Palletoo application (the "Processor").

1.3 Terms have the meaning given in Regulation (EU) 2016/679 (GDPR). "Service" means the Palletoo service under the T&C.

1.4 The Processor processes personal data on behalf of the Controller solely to provide the Service. The subject matter, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex 1.

1.5 This agreement is concluded for the term of the contract under the T&C. Obligations which by their nature are to survive (confidentiality, deletion, assistance) continue after it ends.

1.6 This agreement does not apply to personal data that the Processor processes as a controller for its own purposes, in particular:

• data on shipments the Controller orders from the Processor and which the Processor arranges in its own name through partner carriers,
• data on the account, invoicing, Service security and marketing communications.

Such data is governed by the T&C and the Palletoo Privacy Policy.

2. Processor's obligations

2.1 Instructions. The Processor processes personal data only on documented instructions from the Controller, including with regard to transfers to third countries. Documented instructions are this agreement, the T&C and the actions the Controller or its users take in the Service (e.g. entering a shipment, confirming a request, sending a message to a carrier). Further instructions may be given in writing; where they go beyond the Service, the Processor may make them subject to payment of its costs.

2.2 Where EU or Member State law requires the Processor to process data, it will inform the Controller in advance unless that law prohibits it.

2.3 If the Processor considers that an instruction infringes the GDPR or other data protection law, it will inform the Controller without delay and need not carry out the instruction until the Controller responds.

2.4 Purpose limitation. The Processor does not use the Controller's personal data for its own purposes, does not sell it and does not use it to train or improve artificial intelligence models. Anonymised and aggregated operational statistics that do not identify the Controller or any data subject are not the Controller's personal data.

2.5 Confidentiality. The Processor ensures that persons authorised to process personal data are bound by confidentiality by contract or by law and have access only to the extent necessary for their task.

2.6 Controller's responsibility. The Controller is responsible for having a valid legal basis for the processing, for properly informing data subjects (in particular contact persons, recipients and carriers) under Articles 13 and 14 GDPR, and for not entering special categories of personal data (Article 9 GDPR) or data relating to criminal convictions into the Service.

3. Sub-processors and transfers outside the EU

3.1 The Controller grants the Processor general authorisation to engage sub-processors. The list of current sub-processors is in Annex 3 and on the Sub-processors page.

3.2 The Processor will inform the Controller by email or in the application of any intended addition or replacement of a sub-processor at least 30 days in advance. Within that period the Controller may raise a reasoned objection on data protection grounds. If the parties do not agree on a solution, the Controller may terminate the contract under the T&C without penalty, effective on the date the new sub-processor is engaged.

3.3 The Processor will impose on each sub-processor by contract the same data protection obligations as set out in this agreement. The Processor remains liable to the Controller for the performance of a sub-processor's obligations as if they were its own.

3.4 Personal data may be transferred to a third country outside the EEA only if protection under Chapter V GDPR is ensured, in particular by an adequacy decision of the Commission (including the EU–US Data Privacy Framework) or Standard Contractual Clauses. Specific safeguards are listed in Annex 3.

3.5 The provider of an email mailbox that the Controller connects to the Service (Google, Microsoft) is not a sub-processor of the Processor. The Controller has its own relationship with that provider.

4. Security and personal data breaches

4.1 The Processor implements the technical and organisational measures under Article 32 GDPR set out in Annex 2. It may change them provided the level of protection is not reduced.

4.2 The Processor will notify the Controller of a breach affecting the Controller's personal data without undue delay and no later than 48 hours after becoming aware of it. The notification will be sent to the contact email of the Controller's account.

4.3 The notification contains, insofar as available at the time: a description of the breach, the categories and approximate number of data subjects and records concerned, likely consequences, measures taken or proposed, and a contact point for further information. Missing information will be provided in phases.

4.4 A notification under this article is not an acknowledgement of liability. Notification to the supervisory authority and to data subjects is made by the Controller; the Processor will assist.

5. Assistance, audit, termination and liability

5.1 Data subject rights. The Processor assists the Controller by appropriate measures in responding to data subject requests. The Controller can handle most requests (access, rectification, erasure, export) itself in the Service. Where a data subject sends a request directly to the Processor, the Processor will forward it to the Controller without undue delay and will not respond to it on the merits.

5.2 Further assistance. Taking into account the nature of the processing, the Processor assists the Controller in complying with Articles 32 to 36 GDPR (security, breach notification, impact assessment, prior consultation).

5.3 Audit. The Processor provides the Controller with the information necessary to demonstrate compliance with Article 28 GDPR, in particular this agreement, a description of the measures and any certifications of sub-processors. The Controller, or an auditor appointed by it and bound by confidentiality, may carry out an audit no more than once every 12 months, with at least 30 days' notice, during business hours and without disrupting the Service. More frequent audits are possible following a personal data breach or on instruction from a supervisory authority. The Controller bears the costs of the audit.

5.4 Deletion and return. After the contract ends, the Controller may export its data from the Service for 30 days. The Processor will then delete the Controller's personal data unless EU or Member State law requires its storage. Data in backups is deleted in the normal backup rotation cycle, within 30 days at the latest.

5.5 Liability. The parties' liability for damage is governed by Article 82 GDPR and the limitations of liability in the T&C. The limitation does not apply to damage caused intentionally or by gross negligence.

5.6 Precedence. In the event of conflict between this agreement and the T&C, this agreement prevails in matters of personal data protection. This agreement is governed by the laws of the Czech Republic.

Annex 1 – Description of processing

Annex 2 – Technical and organisational measures

• encryption in transit (TLS) and encryption of mailbox tokens and carrier credentials (AES-256-GCM),
• hosting in EU data centres (Hetzner, Germany),
• logical separation of each customer's data,
• role-based access control, access to production data only for authorised persons, two-factor authentication for administrator accounts,
• regular backups with a 30-day overwrite cycle,
• access and security event logs kept for max. 12 months,
• regular updates of systems and dependencies,
• incident response procedure (Art. 4).

The Processor reviews these measures regularly.

Annex 3 – Sub-processors

See the Sub-processors page, which forms part of this annex.

Partner carriers through which the Processor arranges, in its own name, shipments ordered by the Controller are not sub-processors under this agreement; such shipments are governed by the T&C.