Data Processing Agreement

1. Scope and roles

The Customer is the controller of the personal information it and its users put into the Services (“Customer Personal Data”). Shree Krupa Enterprise Inc. processes it only to provide the Services. Annex 1 describes the data and the people concerned.

2. Instructions

We process Customer Personal Data only on the Customer’s documented instructions. Those instructions are these Terms, this DPA, and the Customer’s use and configuration of the Services, for example connecting a travel agency, social network or carrier, booking a shipment, or approving a pay run. We will tell the Customer if we believe an instruction breaks the law, unless the law forbids us to.

3. Confidentiality

Everyone at Shree Krupa Enterprise Inc. who can access Customer Personal Data is bound by confidentiality obligations, and has access only as far as their role needs.

4. Security

We maintain the measures in Annex 2 and may improve them, without reducing the overall level of protection.

5. Subprocessors

The Customer authorizes the subprocessors listed in Annex 3. We bind each one to data protection terms at least as protective as this DPA, and we remain responsible for them. We will announce new subprocessors on this page and notify account administrators at least 30 days before they start. The Customer may object on reasonable data protection grounds; if we cannot address the objection, the Customer may end the affected Service.

Services the Customer chooses to connect are not our subprocessors. Their own terms govern what they do with the data the Customer sends them. Examples are online travel agencies in Booking, social networks in Meridian Media Hub, the carriers and payment gateway the Customer connects in dispatch, the address lookup and route planning services it sets up, and the Customer’s bank.

6. Helping the Customer

Taking into account what the Services do, we help the Customer answer requests from individuals to access, correct, delete or port their information. We also help with privacy impact assessments, and with consultations with regulators. If an individual contacts us directly about Customer Personal Data, we refer them to the Customer.

7. Security incidents

If we become aware of unauthorized access to, or loss or disclosure of, Customer Personal Data, we will notify the Customer without undue delay, and within 72 hours where possible. We will describe what happened, the data and people affected, and what we are doing about it, and keep the Customer updated. The Customer decides whether to notify regulators and individuals, and we will help it to.

8. Return and deletion

The Customer can export its data while its account is active, and for 30 days after it ends. We then delete Customer Personal Data within 90 days, including from backups as they rotate, unless the law requires us to keep it. Payroll and bookkeeping records are subject to tax record-keeping periods: the Customer should export them before closing its account, or ask us to keep them for the required period.

9. Audits

On reasonable request, no more than once a year, we will provide information that shows our compliance with this DPA, such as security documentation and answers to a security questionnaire. If that is not enough, or a regulator requires it, the Customer may audit us. The audit happens on 30 days’ notice, during business hours and under confidentiality, at the Customer’s cost.

10. Where data is processed

Customer Personal Data is stored on servers in Canada. Some subprocessors (Annex 3) may process it in other countries. Where the law requires it, for example for data subject to the GDPR, we use appropriate safeguards such as the EU Standard Contractual Clauses. For Québec residents, we carry out the assessment Law 25 requires before information is communicated outside Québec.

11. Liability and precedence

The liability limits in the Terms apply to this DPA. If this DPA conflicts with the Terms about personal information, this DPA governs.

Annex 1: Processing details

Purpose: providing, securing and supporting the Services. Duration: the subscription term, plus the deletion period in section 8.

Annex 2: Security measures

• Encryption: TLS for all traffic to the Services, and encrypted connections between our servers. Stored files use server-side encryption. Social Insurance Numbers, banking details, sessions and connected-account tokens are additionally encrypted with AES-256-GCM in the application.
• Access control: role-based permissions in every product, separate administrator roles, and approval steps for sensitive actions such as payroll approval and payment batches.
• Isolation: each organization’s data is separated by tenant, and every request is checked against the organization the user signed in to.
• Network: databases and storage are not exposed to the internet, and are reached only through restricted, encrypted tunnels.
• Accountability: audit logs of significant actions and sign-ins, and change history for key records.
• Resilience: regular backups of databases and stored files.
• People: confidentiality obligations, and access limited to what each role needs.

Annex 3: Subprocessors

Sign-in with Google, Microsoft or Facebook happens only when a user chooses it, and is governed by that provider’s terms.

Maps in dispatch load map images straight from the OpenStreetMap Foundation (United Kingdom) and CARTO (Spain and United States), which receive the viewer’s IP address and the area shown. Couriers’ positions and stops are not sent to them.

Time stamps on sealed form records come from FreeTSA (Germany) and the OpenTimestamps calendars, which record them in the public Bitcoin blockchain. They receive only a record’s SHA-256 fingerprint, which contains no personal information, so they are not subprocessors; we list them so the Customer knows where the fingerprints go.