Data Processing (DPA)

1. Subject matter

We process personal data only on documented instructions from you to provide the Service: drivers, contacts, positions, and related operational records.

1a. Aggregate statistics about places and processes

Your instructions include producing aggregate statistics about places and processes — how long an operation takes at a site, how accurate our estimates are, how well address lookup performs — computed from your own data and used to improve the Service we provide to you.

These statistics carry no personal data: no driver, no vehicle assignment, no name, no identifier, and no data from which a person could be singled out. Producing a statistic about a person is outside these instructions, and we do not do it. If a figure cannot be produced without a person becoming identifiable, it is not produced.

Sharing any such figure outside your account would require your separate, written and revocable consent; without it, nothing of yours is pooled with other companies.

2. Duration & nature

Processing lasts for the term of the Service. Nature/purpose: transport management, tracking, and compliance automation. Data subjects: your drivers, staff and business contacts.

3. Obligations

We ensure confidentiality of personnel, implement appropriate technical and organisational measures, assist you with data-subject requests and security incidents, and delete or return data at the end of the engagement.

3a. Personal data breaches

If we become aware of a personal data breach affecting your data, we notify you without undue delay and in any case within 48 hours, as required of a processor by Art. 33(2) GDPR. The notice describes, as far as known at that moment, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed; we complete it as the investigation progresses.

The 48 hours leave you, as controller, room to meet your own deadline of 72 hours towards the supervisory authority (Art. 33(1) GDPR) and, where required, to inform the people concerned (Art. 34).

4. Sub-processors

You authorise the sub-processors listed in the Privacy Policy. We remain responsible for their compliance and will inform you of intended changes, allowing objection.

5. Security measures

Row-level tenant isolation, encryption in transit and of secrets/PII at rest, hash-chained audit logs, access controls, encrypted daily database backups that cannot be deleted for 31 days, and least-privilege operations.

6. International transfers

Hosting in the EU; any transfer outside the EEA relies on Standard Contractual Clauses or an adequacy decision.

7. Audit

You may audit compliance with reasonable notice, subject to confidentiality, or rely on our written documentation. Contact office@digiohs.com.

8. Security contact

Security incidents, suspected breaches and vulnerability reports: office@vectares.com.