Data processing agreement

The customer determines the purpose and lawful basis for personal data placed in its workspace and acts as controller. Haulbi acts as processor for that content, on documented customer instructions. Data subjects may include customer personnel and people named in uploaded business records, including counterparties, drivers and consignees. Account, billing and security data handled for Haulbi's own purposes remains outside this processor scope.

A binding DPA should specify processing duration, nature, purposes, data categories and rights of the customer. It should require processing only on documented instructions, confidentiality for authorised personnel, assistance with data-subject requests and security appropriate to the risks.

The public measures page separates implemented product controls from controls that need verification. Final contractual measures should be attached to the signed DPA and kept current.

A signed DPA should provide for notice to the customer without undue delay after Haulbi becomes aware of a personal-data breach affecting customer content, along with available information needed for the customer's assessment. Return and deletion terms should address the 30-day recovery and export window and legally retained records. These are contract terms to finalise, not a claim that a DPA has already been signed.

The customer should receive a current list of authorised subprocessors, change-notice and objection rights, and information sufficient to assess transfers. The signed agreement should define how Haulbi supplies compliance information and accommodates audits in line with GDPR Article 28.