Draft. Draft prepared from legal research, not yet reviewed by a licensed US attorney. Items in ⟦ ⟧ must be completed. Before this becomes final: confirm governing law and venue, complete the entity, address and contacts, and set up how a former customer asks for deletion (the Terms, DPA and Privacy Notice promise deletion within 30 days of such a request).

Version 2026-09-19-draft · effective September 19, 2026 SHA-256 e5e4e0a3d43518926e5ac97b1bd335042853bd3cd62a29200d12c7f5f6a8014b

Haularo Data Processing Addendum

This Data Processing Addendum (“DPA”) is part of the Haularo Terms of Service between Haularo and Customer. It governs Haularo’s processing of personal information contained in Customer Data. Where it conflicts with the Terms, this DPA controls.

1. Roles

Customer is the business (controller) for Customer Data and Haularo is its service provider and processor. Customer is responsible for the lawfulness of the Customer Data it provides, including every notice to and consent from its drivers, employees and partners.

2. Processing

2.1 Purposes. Haularo processes Customer Data only to provide the Service to Customer: managing loads, dispatch and planning; driver records, qualification files and compliance reminders; location that Customer’s drivers or devices report, and proof of delivery; drug and alcohol testing and medical dates the Customer records; accident and incident records; invoicing and accounts receivable; fuel tax worksheets; vehicle inspections and maintenance; EDI, API and webhook exchanges Customer configures; the partner portal; support; and securing the Service. Details are in Annex 1.

2.2 Restrictions. Haularo will not: sell or share Customer Data; retain, use or disclose it for any purpose other than the purposes in 2.1, including any commercial purpose; retain, use or disclose it outside the direct business relationship with Customer; or combine it with personal information it receives from anyone else, except as the law permits for service providers.

2.3 Compliance. Haularo will comply with applicable US privacy laws, including the California Consumer Privacy Act, and give Customer Data the same level of protection they require. Haularo will tell Customer if it can no longer meet its obligations under this DPA, and Customer may then take reasonable and appropriate steps to stop and remediate unauthorized use.

2.4 Instructions. The Terms, this DPA and Customer’s use of the Service’s features are Customer’s instructions. Haularo will tell Customer if it believes an instruction violates the law.

3. Personnel

People who process Customer Data for Haularo are bound by confidentiality obligations and have access only as far as they need it.

4. Subprocessors

Customer authorizes the subprocessors listed at /legal/subprocessors. Haularo binds each by written contract to data-protection obligations at least as protective as this DPA and remains responsible for them. Haularo will give at least 30 days’ notice of a new subprocessor. Customer may object on reasonable data-protection grounds within that period; if the parties cannot resolve the objection, Customer may terminate the affected Service and receive a refund of prepaid fees for the remaining term.

5. Security

Haularo maintains the technical and organizational measures in Annex 2 and will not materially reduce them during the term.

6. Security incidents

Haularo will notify Customer without undue delay, and in any case within 72 hours, after confirming a breach of security leading to unauthorized access to or disclosure of Customer Data. The notice will describe what happened, the data affected as far as known, the measures taken and a contact point, and Haularo will update it as it learns more. Customer, as owner of the data, is responsible for notices to individuals and regulators; Haularo will provide the information Customer reasonably needs for them.

7. Assistance

Haularo will pass on to Customer any request it receives from an individual about Customer Data and will not answer it directly unless Customer asks. Haularo will provide reasonable help with individual requests, risk assessments and regulator enquiries, taking into account the nature of the processing.

8. Demonstrating compliance

Haularo will make available the information reasonably needed to demonstrate compliance with this DPA — its security documentation, and independent reports when it has them — and will answer a reasonable security questionnaire once a year. If that does not reasonably satisfy Customer, Customer may conduct a remote assessment once a year, at its cost, on 30 days’ notice, subject to confidentiality.

9. Return and deletion

Customer can export Customer Data at any time. After the subscription ends, Haularo keeps Customer Data, subject to this DPA, until Customer directs it to delete or return it. Haularo will delete Customer Data within 30 days of Customer’s direction, unless the law requires it to keep it, and will confirm deletion on request. Copies in backups expire on their normal cycle and stay protected until they do. Customer may ask Haularo to suspend deletion for a legal hold. Customer is solely responsible for determining and meeting its record-retention obligations under 49 CFR Parts 382, 390, 391, 395 and 396, the IFTA Articles of Agreement, the IRP and tax law; Haularo does not guarantee that the Service satisfies any recordkeeping regulation.

Annex 1 — Description of processing

Individuals: Customer’s drivers, employees and contractors; contacts at its customers, brokers, shippers and vendors; users of its partner portal.
Data: identity and contact details; license numbers and expiry; medical-certificate, drug and alcohol testing and qualification dates; motor vehicle records uploaded by Customer; accident records; location reported through the driver app or Customer’s connected devices when Customer uses location features; proof-of-delivery photos and signatures; load, invoice, fuel, inspection and maintenance records; documents Customer uploads.
Duration: the subscription term, and afterwards until Customer directs deletion or return under Section 9.

Annex 2 — Security measures

Encryption in transit (TLS) and HTTP Strict Transport Security.
Passwords stored as salted hashes; two-factor authentication enforced for staff where enabled by policy; sessions that can be revoked immediately.
Role-based access control; per-company data separation enforced in the data layer and tested automatically.
API keys stored only as hashes and limited to the permissions of the person who created them; webhook payloads signed with HMAC-SHA256.
Content Security Policy, anti-forgery protection, rate limiting and audit logging of changes.
Backups and restore procedures.

All legal documents