This Data Processing Addendum ("DPA") forms part of the Master Subscription Agreement (the "Agreement") between Provider and Customer. It applies when Provider processes personal data contained in Customer Data. Capitalized terms not defined here have the meanings in the Agreement.
1.1Customer Data: Provider is Customer's processor. For personal data in Customer Data (for example Authorized Users' details, the Driver roster Customer uploads, and vehicle location and telematics linked to a driver), Customer is the controller (or "business") and Provider is its processor (or "service provider").
1.2Driver Data: Provider is an independent controller. Drivers give Driver Data to Provider directly, under Provider's terms, privacy policy and consents. Provider decides how it is processed, and is a controller of it in its own right. Sections 3 to 9 of this DPA do not apply to Driver Data. Provider shares Driver Data with Customer only as Agreement Section 5.2 allows.
1.3Aggregate Reports. Aggregate Reports that Provider delivers to Customer are de-identified under Section 10. Customer will not attempt to re-identify them.
"Data Protection Law" means all laws that apply to the processing of personal data under the Agreement, including the California Consumer Privacy Act as amended (the "CCPA") and other US state comprehensive privacy laws, the Texas Data Privacy and Security Act, and, for Nigerian customers and Drivers, the Nigeria Data Protection Act 2023 (the "NDPA") and the General Application and Implementation Directive 2025.
3.1Provider will process Customer Data only on Customer's documented instructions. The Agreement, the Order Form and Customer's use of the Services' settings are Customer's complete instructions. Provider will inform Customer if it believes an instruction breaks Data Protection Law.
3.2Service-provider terms. Provider will not: (a) sell or share Customer Data (as "sell" and "share" are defined in the CCPA); (b) retain, use or disclose it for any purpose other than the business purposes in Annex 1, or outside the direct business relationship with Customer; (c) combine it with personal data Provider receives from others, except as the CCPA permits for service providers; or (d) use it for targeted advertising. Provider will comply with the CCPA, provide the same level of privacy protection it requires, and notify Customer if it can no longer meet its obligations. Customer may take reasonable steps to stop and remediate unauthorized processing.
Provider will ensure that anyone it authorizes to process Customer Data is bound by confidentiality and is trained on these obligations.
Provider will implement the measures in Annex 4.
6.1Customer authorizes the subprocessors in Annex 3. Provider will impose data protection terms on each that are at least as protective as this DPA, and remains responsible for their performance.
6.2Provider will give at least 30 days' notice of a new subprocessor by email or in the fleet console. Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, Customer may terminate the affected Service and receive a refund of prepaid fees for the unused period.
7.1Provider will promptly forward to Customer any request it receives from an individual about Customer Data, and will not respond to it except to say it has been forwarded, unless law requires otherwise.
7.2Provider will give Customer reasonable help, taking into account the nature of the processing, with individual rights requests, data protection impact assessments and consultations with regulators.
8.1Provider will notify Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Data. The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of individuals and records concerned, the likely consequences, and the measures taken or proposed.
8.2Provider will cooperate with Customer and take reasonable steps to contain and remedy the breach.
9.1At the end of the Services, Provider will make Customer Data available for export for 30 days and then delete it within a further 30 days, except where law requires Provider to keep it. Backups are overwritten within 35 days.
9.2Provider will make available the information reasonably needed to demonstrate compliance with this DPA. Customer may, no more than once a year and on 30 days' notice, audit Provider's compliance through a questionnaire or, once available, review of Provider's SOC 2 report. On-site audits are allowed only after a breach affecting Customer Data or where a regulator requires one, at Customer's cost and during business hours.
Where Provider de-identifies data, it will: (a) take reasonable measures to ensure the data cannot be associated with an individual; (b) publicly commit to keep it in de-identified form and not to attempt re-identification; and (c) contractually require any recipient to do the same. Aggregate Reports also apply the small-cell suppression rule in Agreement Schedule B (no cell describing fewer than 10 Drivers).
11.1Provider processes and stores data in the United States. Its Nigerian affiliate's data is stored in the United States under Annex 2.
11.2Provider will not transfer Customer Data to another country, other than to subprocessors listed in Annex 3, without Customer's consent.
| Item | ROADTRUTH | ROADWORTHY |
|---|---|---|
| Business purposes | Computing vehicle scores, predictions and alerts; reporting; support; security | Inviting Drivers; Aggregate Reports; delivering broadcasts; receiving injury reports; billing counts |
| Individuals | Authorized Users; drivers linked to vehicles in Connected Accounts; shop staff named in service records | Authorized Users; Drivers on the roster |
| Personal data | Names and contact details of Authorized Users; driver IDs and names from Connected Accounts; vehicle location and timestamps | Names, work email or phone, office and depot; enrolment status |
| Sensitive data | None intended | None in Customer Data (health data is Driver Data, Section 1.2) |
| Duration | Subscription Term plus Section 9.1 | Subscription Term plus Section 9.1 |
A2.1Parties. Where the customer is Nigerian, Provider is Josmol Human Capital Resources Ltd, which engages Josmol Group Inc. as its processor for hosting, operations and support.
A2.2Lawful basis. Customer relies on its contract of employment or engagement with Drivers, or its legitimate interests, for the roster it shares. Provider relies on each Driver's explicit consent for Driver Data, including health data, and for its transfer to the United States.
A2.3Transfer safeguards. Data transferred to the United States is protected by: (a) an intra-group data transfer agreement between Josmol Human Capital Resources Ltd and Josmol Group Inc. containing the protections in this DPA; (b) encryption in transit and at rest; (c) access limited to named personnel on a need-to-know basis; (d) Drivers' explicit, informed consent, given after being told the data is stored in the United States and what that means; and (e) the commitment in Order Form Part B to move the data on notice.
A2.4Compliance steps. Provider will maintain a record of processing, appoint a data protection officer, conduct a data protection impact assessment for ROADWORTHY's health processing, and file compliance audit returns and registrations with the Nigeria Data Protection Commission as the NDPA and the GAID require.
A2.5Breach notice. Provider will notify the Commission within 72 hours of becoming aware of a breach of Driver Data likely to result in a risk to Drivers' rights, and will inform affected Drivers where the risk is high.
| Subprocessor | Purpose | Data | Location | App |
|---|---|---|---|---|
| Google LLC (Firebase: Authentication, Firestore, Cloud Messaging, Storage) | Accounts, database, notifications, file storage | Account, Driver Data, roster | United States | ROADWORTHY |
| Supabase, Inc. | Database | Vehicle, telemetry and fleet data | United States | ROADTRUTH |
| Netlify, Inc. | Website hosting and server functions | Data in transit through functions | United States | Both |
| Anthropic, PBC | AI generation (Co-Driver, pathways, journal reflections, vehicle rounds) | Text of the request, which may include health context and the Driver's first name; not used to train models under Anthropic's commercial terms | United States | Both |
| Daily, Inc. | Video visits | Live audio and video (not recorded) | United States | ROADWORTHY |
| Twilio Inc. | SMS outside Nigeria | Phone numbers, message text | United States | ROADWORTHY |
| Africa's Talking Ltd | SMS to Nigerian numbers | Phone numbers, message text | Kenya and Nigeria | ROADWORTHY |
| Meta Platforms, Inc. (WhatsApp Business Platform) | Service-record intake and alerts | Phone numbers, messages, photos of service records | United States and global | ROADTRUTH |
| Stripe, Inc. | Card and ACH payments (US) | Billing contact, payment details | United States | Both |
| Paystack Payments Limited | Payments (Nigeria) | Billing contact, payment details | Nigeria | Both |
| Omega Wellness Center Inc. (affiliate) | The Ready Mindset assessment | Assessment answers, internal Driver ID | United States | ROADWORTHY |
Not subprocessors: Connected Account providers (Motive, Samsara, Wialon, Traccar, MiX), which are Customer's own vendors; CareClix and DoktorConnect's doctors, which are independent clinical providers to the Driver; Fit Step Pro, which fulfils insole orders a Driver places; and map services (OpenStreetMap, Esri), which receive approximate map coordinates only, with no identifiers.