Data Processing Agreement

1. Parties and Roles

This DPA is between the customer that accepted the CloudTMS terms (“Carrier”) and CloudTMS LLC, a Wisconsin limited liability company (“CloudTMS”).

• Controller. The Carrier decides why and how personal data in its CloudTMS account is used.
• Processor. CloudTMS processes that data only to provide the Service. Under the CCPA and similar state laws, CloudTMS acts as the Carrier's “service provider” or “processor”.

This DPA does not cover data CloudTMS controls for itself, such as website leads, prospects and billing contacts. The Privacy Policy covers that data.

2. What We Process

Annex 1 lists the data, the people it is about, and the purposes.

3. Our Duties as Processor

CloudTMS will:

1. Follow instructions. Process Carrier personal data only on the Carrier's documented instructions. The terms, this DPA and the Carrier's use of the Service settings are those instructions. If we think an instruction breaks the law, we tell the Carrier.
2. Not sell or share. Not sell the data. Not share it for cross-context behavioral advertising. Not use it for any purpose outside the Service. Not combine it with data from other customers or other sources, except as needed to run the Service, such as public FMCSA data used to fill in a carrier profile.
3. Not train models. Not use Carrier data to train any model.
4. Keep MCs and companies separate. Keep each Carrier's data separate from every other customer's data. Inside the Carrier's account, keep each MC's data separate as the Service is designed.
5. Confidentiality. Make sure everyone who can access the data is bound to keep it confidential.
6. Security. Keep the measures in Annex 2 in place, and never reduce their overall protection.
7. Help with requests. Help the Carrier answer requests from drivers and staff, such as access and deletion, as far as is reasonable. If a person sends a request to us directly, we pass it to the Carrier and do not answer it ourselves, unless the Carrier tells us to.
8. Respect legal retention. Not delete records inside a legal retention minimum, even on request, unless the Carrier confirms in writing that it keeps a complete copy elsewhere and CloudTMS agrees. See the retention table in the Privacy Policy.
9. Certify. On request, once a year, confirm in writing that we comply with this DPA.
10. Tell the Carrier if we can no longer meet our duties under this DPA or state privacy law.

4. Drug and Alcohol Test Records

Drug and alcohol test records are confidential under 49 CFR Part 40.

• In the Service, test results are shown only to Carrier users with the company admin, safety or executive role. Other Carrier users see only whether a result stops a driver from being dispatched.
• In a support session, our team sees these records as restricted, without results.
• CloudTMS will not release individual results to any third party, except as Part 40 allows.

5. Sub-Processors

• The Carrier gives general permission for CloudTMS to use the sub-processors listed on our Sub-Processors page.
• CloudTMS signs a written contract with each sub-processor. That contract protects the data at least as well as this DPA does.
• New sub-processors. We email account admins at least 30 days before a new sub-processor starts receiving Carrier data. The list page is updated at the same time.
• Objections. The Carrier may object in writing within those 30 days. If we cannot address the objection, the Carrier may cancel the affected part of the Service, and we refund any fees prepaid for time after cancellation.
• CloudTMS remains responsible for its sub-processors.
• The change that connects a new vendor is reviewed against our sub-processor list before release.

6. Where Data Is Processed

Our database and file storage are in the United States (AWS us-east-1). /subprocessors lists each provider's location where known. Access to production systems is limited to authorized members of our admin team, which can include people and AI tools working on our behalf, each with only the access their work needs.

7. Security Incidents

Definition. A “security incident” means a confirmed breach of security. It covers unauthorized access to, or loss, change or disclosure of, Carrier personal data. It includes data from one company or MC being shown to another.

Notice. CloudTMS will tell the Carrier without undue delay, and no later than 72 hours after confirming an incident. Notice goes by email to account admins.

What the notice says, as far as we know it at the time:

• what happened and when;
• what data and which people are involved;
• what we have done and will do;
• a contact person.

We send updates as we learn more.

Help. CloudTMS will help the Carrier meet its own breach-notice duties under state law. Unless the law requires otherwise, the Carrier decides whether to notify drivers or regulators. CloudTMS will not notify the Carrier's drivers or staff without the Carrier's OK.

Records. CloudTMS keeps a record of each incident and the steps taken.

Notice is not an admission of fault.

8. Audits

CloudTMS will answer reasonable written security questionnaires once a year. CloudTMS has no SOC 2 report today. If the Carrier needs more, the parties agree the scope, timing and cost in writing first. On-site audits need 30 days' notice and a confidentiality agreement, and are limited to one a year.

9. Return and Deletion at the End

When the account closes:

1. Return. For 90 days the Carrier can ask for a full export of its data.
2. Default keep. Unless the Carrier instructs otherwise, CloudTMS keeps the data in storage for up to 7 years after closing, only so the Carrier can get records back for audits. This is a Carrier instruction, and the Carrier may change it at any time.
3. Earlier deletion. On written instruction, CloudTMS deletes, within 30 days, all Carrier data that no legal minimum covers. Records inside a legal minimum are kept until it ends, unless section 3(8) applies.
4. Final purge removes the data from the live database and from file storage, including stored file versions. Automatic database backups roll off within 7 days. Snapshots taken before maintenance are deleted within 30 days. The final purge is run by hand and logged.
5. On request, CloudTMS confirms the deletion in writing.

10. Liability

The terms' limit of liability applies to this DPA.

11. Order of Priority

If this DPA conflicts with the terms on personal data, this DPA wins.

Annex 1: Details of Processing

Annex 2: Security Measures

Known limits. CloudTMS has no SOC 2 report, ISO 27001 certification or penetration test yet. The database runs in a single availability zone.