Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between NS Technology, Inc. ("Processor", "we"), which operates NS Logistics TMS, and the Customer named on the Order Form ("Customer"). It applies to personal information the Customer puts into NSLogi.

1. Roles and scope

The Customer decides why and how personal information in NSLogi is used and is the "business" or "controller". We process it only on the Customer's behalf as its "service provider" or "processor". The personal information covered includes the Customer's staff, drivers, owner-operators and partner contacts: names, contact details, licence and medical-card dates, pay and settlement records, tax identifiers the Customer enters, documents, and truck or phone locations.

2. Instructions

We process personal information only to provide, secure and support NSLogi for the Customer, as described in the Terms of Service and this DPA, and on the Customer's further documented instructions given through the product or in writing. We tell the Customer if we believe an instruction breaks the law.

3. What we will not do

We will not sell or share the Customer's personal information, use it for any purpose other than providing the service, combine it with data from other Customers or sources except as the service requires, or retain it longer than this DPA allows.

4. Confidentiality of personnel

Only staff who need access to provide or support the service can reach Customer personal information. They are bound by confidentiality, and their access to a Customer's data is logged.

5. Security measures

We maintain safeguards appropriate to the risk, including:

• encryption in transit (TLS) and at rest;
• a tenant key on every record, enforced by the database layer, so one Customer can never read another's data, and a second per-user filter that limits drivers and owner-operators to their own records;
• role-based permissions set by the Customer's administrator;
• passkey and two-factor sign-in, account lockout, and audit and access logs;
• secrets held in a key vault, not in code;
• daily backups and point-in-time restore;
• automated tests of tenant and driver isolation on every release.

6. Sub-processors

The Customer authorises these sub-processors: Microsoft Azure (hosting, database, storage, United States) and Twilio SendGrid (e-mail delivery), plus a payment processor if card payment is used. Integrations the Customer connects with its own accounts (load boards, telematics, fuel cards, factoring, accounting) act for the Customer, not as our sub-processors. We give at least 30 days' notice of a new sub-processor; the Customer may object on reasonable grounds, and if we cannot resolve the objection the Customer may end the affected service with a pro-rata refund.

7. Assistance

We help the Customer answer requests from individuals to access, correct, delete or copy their information, mainly through the product's own tools, and forward any request we receive directly. We give reasonable help with the Customer's security reviews and legally required assessments.

8. Security incidents

We notify the Customer without undue delay, and within 72 hours of confirming a security incident affecting its personal information, with what we know, what we are doing, and a contact. We keep the Customer updated and help it meet its own notification duties.

9. Return and deletion

When the agreement ends, the Customer can export its data for 90 days. We then delete it, except where the law requires us to keep it, and backups expire within 35 days.

10. Audits

On reasonable written request, no more than once a year, we answer the Customer's security questionnaire and provide a summary of our controls. Further audits are by agreement on scope, timing and cost.

11. Location

Customer data is stored and processed in the United States.

12. Order of precedence

For personal information, this DPA controls over the Terms of Service if they conflict. Liability under this DPA is subject to the limits in the Terms of Service.

Signatures

See also: Terms of ServicePrivacy PolicySMS Terms & ConditionsAcceptable Use PolicyService Level & Support Policy