UK and US customer data terms
Data Processing Addendum
Effective: 22 August 2026 · Version 2026-08-22
1. Parties and application
This Data Processing Addendum (“DPA”) forms part of the agreement between the Customer and the UK or US Trukfox contracting entity identified in the applicable order form (“Agreement”). It applies where Trukfox processes Customer Personal Data on the Customer’s behalf.
For UK Data Protection Law, the Customer is controller and Trukfox is processor, except where either party independently determines purposes and means. For applicable US State Privacy Laws, the Customer is the business/controller and Trukfox is the service provider/contractor/processor.
2. Definitions
“Customer Personal Data” means personal data, personal information, or equivalent regulated information contained in Customer Data. “Data Protection Law” means the UK GDPR, Data Protection Act 2018, Privacy and Electronic Communications Regulations where applicable, and applicable US federal and state privacy laws. Other capitalised terms have the meanings in the Agreement.
3. Processing details and instructions
Trukfox will process Customer Personal Data only on documented Customer instructions, including instructions expressed through authorised use and configuration of the Service, to provide, host, secure, support, maintain, and improve reliability of the Service, and to comply with law. If Trukfox believes an instruction breaches Data Protection Law, it will inform the Customer unless prohibited by law.
The processing description in Schedule 1 forms part of this DPA. The Agreement, this DPA, authorised product settings, support requests, and lawful written instructions constitute the Customer’s documented instructions.
4. Confidentiality
Trukfox will ensure people authorised to process Customer Personal Data are subject to appropriate confidentiality obligations and receive access only where needed for their role.
5. Security
Taking account of available technology, implementation cost, processing scope and risk, Trukfox will maintain appropriate technical and organisational measures. Current core measures are described in Schedule 2. Trukfox may update measures provided that overall protection is not materially reduced.
6. Subprocessors
The Customer gives general written authorisation for Trukfox to use subprocessors needed to provide the Service, including hosting, storage, communications, security, monitoring, support, and payment providers. Trukfox will impose data-protection obligations appropriate to the processing and remains responsible for subprocessor performance to the extent required by law.
Trukfox will provide a current subprocessor list on request or through a published service page. For a new subprocessor that materially processes Customer Personal Data, Trukfox will give reasonable advance notice where required. The Customer may object on reasonable data-protection grounds. The parties will work in good faith; if no reasonable solution is available, either party may terminate the affected Service according to the Agreement.
7. International transfers
Trukfox will not transfer Customer Personal Data from the United Kingdom to a country without a lawful transfer mechanism where one is required. Depending on the transfer, this may include UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to approved EU Standard Contractual Clauses. The Customer authorises transfers inherent in the documented subprocessor arrangement subject to those safeguards.
8. Individual rights
Taking account of the processing, Trukfox will provide reasonable assistance for Customer responses to lawful requests to access, correct, delete, restrict, object to, or port Customer Personal Data. If Trukfox directly receives a request relating to Customer Personal Data, it may direct the person to the Customer and will not independently respond except as instructed or required by law.
9. Regulatory assistance
Taking account of the processing and information available, Trukfox will reasonably assist the Customer with security obligations, breach notifications, data protection impact assessments, regulator consultations, and similar obligations under applicable Data Protection Law. Material assistance outside normal Service functionality may be charged at agreed rates where permitted.
10. Personal data incidents
Trukfox will notify the Customer without undue delay after becoming aware of a confirmed personal data breach affecting Customer Personal Data. The notice will include information reasonably available about the nature, likely consequences, affected information, mitigation, and contact point. Notification is not an admission of fault. The Customer remains responsible for regulatory and individual notifications unless law assigns that duty to Trukfox.
11. Return and deletion
During the subscription, the Customer may access and export information through available Service functionality. After termination, Trukfox will delete or return Customer Personal Data according to the Agreement and Customer instructions, unless law requires retention. Data may remain temporarily in protected backups until overwritten under normal cycles and will remain subject to this DPA.
12. Information and audits
Trukfox will make information reasonably necessary to demonstrate compliance available to the Customer. No more than once annually, unless required by a regulator or following a material incident, the Customer may request a reasonable remote audit. On-site audits require reasonable advance notice, confidentiality, normal business hours, non-disruption, and reimbursement of reasonable costs. Audits must not expose other customers’ information, Trukfox security secrets, or unrelated confidential data.
13. US service-provider and contractor terms
Where US State Privacy Laws apply, Trukfox certifies that it understands and will comply with these restrictions. Trukfox will not sell or share Customer Personal Data; retain, use, or disclose it outside the direct business relationship and permitted business purposes; combine it with personal information from another source except where law permits; or use it for targeted advertising or to infer characteristics about individuals.
The Customer may take reasonable and appropriate steps to help ensure Trukfox uses Customer Personal Data consistently with the Customer’s obligations and may require remediation of unauthorised use. Trukfox will notify the Customer if it determines it can no longer meet applicable service-provider, contractor, or processor obligations.
14. Conflict, liability, and duration
If this DPA conflicts with the Agreement on processing Customer Personal Data, this DPA controls. Liability under this DPA is subject to the Agreement’s exclusions and limits to the fullest extent permitted by law. This DPA remains effective while Trukfox processes Customer Personal Data.
Schedule 1 — Processing description
| Subject and purpose | Providing a multi-company trucking operations platform, account administration, security, support, document storage, reporting, and optional email-document ingestion. |
|---|---|
| Duration | The subscription term plus limited exit, backup, legal-retention, and deletion periods. |
| Operations | Collection, receipt, hosting, organisation, retrieval, display, matching, transmission, support access, security analysis, export, deletion, and backup. |
| Individuals | Customer staff, administrators, drivers, dispatchers, managers, customers, customer contacts, suppliers, senders, recipients, and other people identified in operational records or documents. |
| Data | Names, business emails, phones, roles, login and audit information, customer contacts, routes, locations, order and vehicle details, instructions, timestamps, fees, notes, documents, signatures or images in uploaded paperwork, mailbox identifiers, senders, subjects, and attachments. |
| Sensitive data | Not intentionally required. The Customer must not submit special-category, criminal-offence, medical, biometric, Social Security, financial-account, or similarly sensitive data unless expressly agreed and lawfully protected. |
Schedule 2 — Core security measures
- Unique user identities, hashed passwords, role-based access, account deactivation, and token-version session revocation.
- Company-scoped database queries and protected document endpoints designed to maintain tenant separation.
- AES-256-GCM encryption of saved mailbox app passwords with a separately managed service secret.
- Input validation, file-type and size controls, authentication checks, audit records, and bounded email-processing records.
- HTTPS in production through the hosting edge, controlled deployment secrets, and persistent data storage.
- Operational logging, mailbox health monitoring, backups and recovery controls appropriate to the selected hosting plan.
- Access limited to authorised personnel and providers with a business need and confidentiality duties.
- Incident investigation, credential reset, account suspension, and Customer notification procedures.
Contact
DPA and privacy questions may be sent to privacy@trukfox.com. Security incidents should be sent to security@trukfox.com.