Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service (the “Agreement”) between Loadful, Inc. (“Loadful”) and the business that has agreed to them (the “Customer”). It applies whenever Loadful processes Customer Personal Data in providing the Service.

1. Definitions

Capitalised terms not defined here have the meaning given in the Agreement. In this DPA:

• Data Protection Laws means all laws applicable to the processing of Customer Personal Data under the Agreement, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”), other U.S. state privacy laws, and, where they apply, the EU General Data Protection Regulation and the UK GDPR.
• Customer Personal Data means personal data that Loadful processes on the Customer’s behalf in providing the Service.
• Service means the Loadful.ai web application, API, and mobile apps.
• Subprocessor means a third party Loadful engages to process Customer Personal Data.
• Security Incident means a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of, or access to, Customer Personal Data.
• Controller, processor, data subject, personal data, processing, business, service provider, sell and share have the meanings given in the applicable Data Protection Laws.

2. Scope and roles

The Customer is the controller (or “business”) of Customer Personal Data, and Loadful is its processor (or “service provider”). The subject matter, nature, purpose and duration of the processing, and the categories of data and data subjects, are described in Annex 1.

Loadful acts as an independent controller only for the limited data it needs to run its own business — account administration, billing, security monitoring, and communications with the Customer’s personnel about the Service — as described in the Privacy Policy.

The Customer is responsible for having a lawful basis for the processing it instructs, including giving any notices and obtaining any consents its own personnel, drivers, shippers and other data subjects are owed. In particular, before enabling the driver app’s location features, the Customer is responsible for giving its drivers written notice of what is tracked and when, and for obtaining any consent required by the laws of the states in which they work.

3. Processing instructions

Loadful will process Customer Personal Data only on the Customer’s documented instructions. The Agreement, this DPA, and the Customer’s configuration and use of the Service (including the integrations it chooses to connect) are the Customer’s complete instructions. Loadful will tell the Customer if, in its opinion, an instruction infringes Data Protection Laws, and may decline to follow it. If the law requires Loadful to process Customer Personal Data other than on instructions, Loadful will tell the Customer first unless the law prohibits it.

Loadful does not use Customer Personal Data to train machine-learning models, to build advertising profiles, or for any purpose other than providing, securing and supporting the Service.

4. Confidentiality of personnel

Loadful will ensure that everyone it authorises to process Customer Personal Data is bound by an appropriate obligation of confidentiality, and that access is limited to personnel who need it to provide, secure or support the Service.

5. Security measures

Loadful will implement and maintain the technical and organisational measures described in Annex 2, which are designed to protect Customer Personal Data against Security Incidents. Loadful may update those measures, provided the update does not materially reduce the overall level of protection.

6. Subprocessors

The Customer authorises Loadful to engage the Subprocessors listed in Annex 3. Loadful will impose data protection obligations on each Subprocessor that are no less protective than this DPA, to the extent applicable to the service it provides, and remains responsible for each Subprocessor’s performance of those obligations.

Services the Customer chooses to connect and that it contracts with directly — such as Super Dispatch, the Customer’s bank, or the Customer’s own Stripe account — are the Customer’s own providers, not Loadful’s Subprocessors.

7. Subprocessor changes

Loadful will give the Customer at least 30 days’ notice before a new Subprocessor begins processing Customer Personal Data, by updating Annex 3 and emailing the account’s contact address. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection in good faith, the Customer may terminate the affected part of the Service and receive a refund of any prepaid fees for the period after termination.

8. Data subject requests

Taking into account the nature of the processing, Loadful will assist the Customer, by appropriate technical and organisational measures, in responding to requests from data subjects to exercise their rights. Most Customer Personal Data can be viewed, corrected or removed by the Customer directly in the Service. If Loadful receives a request directly, it will refer the data subject to the Customer unless the law requires otherwise. Loadful will act on the Customer’s requests for export or deletion within 30 days.

9. Security Incident notification

Loadful will notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident affecting Customer Personal Data. The notice will describe, to the extent known, the nature of the incident, the categories and approximate volume of data affected, the likely consequences, and the measures taken or proposed, and Loadful will update it as more becomes known. Loadful will take reasonable steps to contain and remediate the incident and will cooperate with the Customer’s own notification obligations. Notice of an incident is not an admission of fault.

10. Deletion and return

During the term, the Customer may export its data on request. When the Agreement ends or the Customer closes its account, Loadful will delete or anonymise Customer Personal Data within 90 days, and will return a copy in a machine-readable format first if the Customer asks for one within that period. Loadful may keep data the law requires it to retain, and copies in backups until they expire in the ordinary course; both remain subject to this DPA while held.

11. Audits

On written request no more than once a year (or after a Security Incident), Loadful will make available the information reasonably necessary to demonstrate its compliance with this DPA — such as answers to a reasonable security questionnaire, descriptions of its controls, and its Subprocessors’ available security reports or certifications. If that information does not reasonably satisfy an obligation the Customer owes a regulator, the parties will agree in good faith on the scope, timing and cost of any further review, which must be conducted under confidentiality and without access to other customers’ data.

12. International transfers

Loadful and its Subprocessors process Customer Personal Data in the United States, except where Annex 3 says otherwise. Where Data Protection Laws require a transfer mechanism for data leaving the European Economic Area, the United Kingdom or Switzerland, the parties will rely on the applicable Standard Contractual Clauses, which Loadful will provide on request and which are incorporated by reference when they apply.

13. CCPA service provider terms

To the extent the CCPA applies, Loadful will not:

• sell or share Customer Personal Data;
• retain, use or disclose it for any purpose other than the business purposes specified in the Agreement, including for any commercial purpose other than providing the Service;
• retain, use or disclose it outside the direct business relationship between Loadful and the Customer; or
• combine it with personal data Loadful receives from or on behalf of others, except as the CCPA permits a service provider to.

Loadful will comply with the CCPA’s obligations applicable to service providers, provide the same level of privacy protection the CCPA requires of businesses, and notify the Customer if it can no longer meet them. The Customer may take reasonable and appropriate steps to stop and remediate unauthorised use. Loadful certifies that it understands and will comply with these restrictions.

14. Liability

Each party’s liability arising out of or relating to this DPA is subject to the exclusions and limitations of liability in the Agreement (Terms of Service §12), which apply in aggregate across the Agreement and this DPA.

15. General

If this DPA conflicts with the Agreement on the processing of Customer Personal Data, this DPA prevails. This DPA lasts as long as Loadful processes Customer Personal Data. It is governed by the laws of the State of Indiana, USA, and disputes are subject to the exclusive jurisdiction of the state and federal courts located in Marion County, Indiana, as set out in Terms §15 — except where the Standard Contractual Clauses or Data Protection Laws require otherwise. Loadful may update this DPA to reflect changes in law or in the Service, with notice as the Agreement provides; an update will not materially reduce the protection it gives Customer Personal Data.

Annex 1 — Details of processing

Subject matter, nature and purpose

Hosting, storing, analysing and displaying the Customer’s operational data to provide the Service: syncing the Customer’s loads and trips from Super Dispatch, planning and pricing trips, costing trips against the Customer’s fleet and driver pay, matching bank deposits to loads, recording driver duty, inspections and collections, and — on the broker side — receiving shipper quote requests, sending quotes, and taking bookings.

Duration

For the term of the Agreement, plus the deletion period in §10.

Categories of data subjects

• The Customer’s team members who use the dashboard (owners, dispatchers).
• The Customer’s drivers.
• Contacts at brokers, shippers and customers that appear in the Customer’s loads and trips.
• Shippers who request quotes or book through the Customer’s broker-side forms.
• Contacts at carriers in the Customer’s broker-side carrier list.

Categories of personal data

• Company and team data: names, email addresses, phone numbers, business addresses, USDOT and MC numbers, sign-in and two-factor records.
• Driver data: name, phone, email, CDL number, state and class, years of experience, pay rates and pay history; and, from the driver app, location while the driver is on duty (and at no other time), on-duty periods, signed pre-trip inspections, recorded cash and check collections with photos, fuel receipts with photos, and device identifiers.
• Load and trip data: pickup and delivery addresses, dates, pay, vehicle details including VINs, broker and customer names and contact details, driver names, and payment status, as synced from Super Dispatch at the Customer’s direction or entered by the Customer.
• Shipper and lead data (broker side): names, email addresses, phone numbers, pickup and delivery locations, vehicle details, quote and email correspondence, signed agreements including the signer’s IP address and browser, and payment status. Card and bank payment details are collected by Stripe and are not stored by Loadful.
• Bank data (only if the Customer connects a bank through Plaid): institution, account name, last four digits and type of each shared account, and transaction records — dates, amounts, counterparty and merchant names, and the bank’s memo text. Never banking credentials or full account or routing numbers.
• Accounting data: none at present. The QuickBooks Online integration is not available; if it is enabled, it will read invoices, payments and customer names, read-only, and Loadful will update this Annex and give notice first.
• Super Dispatch session data: the Super Dispatch email address and, for the server-side sync, an encrypted Super Dispatch session. The Customer’s Super Dispatch password is used once to sign in and is never stored.

Special categories

The Service is not designed to process special categories of personal data, and the Customer should not submit them. Precise location of drivers while on duty is processed as described above; some laws treat precise geolocation as sensitive personal information, and the Customer is responsible for the notices and consents described in §2.

AI processing

Some features send operational context to Anthropic (Annex 3) for processing by its Claude models. No credential is ever sent. For expense categorisation, only the bank’s descriptor text for a vendor is sent — never the amount, the date, the account, or the connection token. Matching payments to loads is performed by deterministic code, not by a model.

Annex 2 — Technical and organisational measures

• Encryption in transit. TLS on all connections between browsers, the Service, its database, and Subprocessors.
• Encryption at rest. The managed database is encrypted at rest by the database provider.
• Credential sealing. Third-party credentials Loadful must hold — the Plaid access token and the Super Dispatch session — are additionally encrypted with AES-256-GCM (authenticated encryption) before storage, under a key held in the API’s environment and never in the database, so a copy of the database alone cannot decrypt them. If that key is missing, the Service refuses to store them at all rather than store them unencrypted.
• Credentials never held. Dashboard passwords are held by the authentication provider, not Loadful. Bank credentials go to Plaid and the bank, never to Loadful. The Super Dispatch password is used once to sign in and never written to storage, logs or error reports.
• Tenant isolation. Every query that reads or writes customer data is scoped to the Customer’s organisation in application code. Row-level security is enabled with a default-deny posture on every database table, closing the database provider’s automatic public API.
• Access control. Dashboard sign-in through the authentication provider, with optional organisation-wide two-factor authentication. Short-lived signed tokens between the web application and the API. Driver devices use a separate identity with a different signing secret, audience and issuer, device-bound refresh credentials that rotate on every use, and per-device revocation. Administrative credentials are scoped to the minimum required permissions.
• Secrets management. Keys and secrets are held in the hosting providers’ secret stores, never in source code.
• Verified integrations. Inbound webhooks from payment, banking and email providers are authenticated by signature before they are acted on.
• Error-report scrubbing. Error and performance reports are scrubbed before leaving Loadful’s systems: credential headers and cookies are dropped, and names, contact details, addresses, VINs, account numbers and tokens are redacted.
• Minimisation. Bank access is read-only, limited to transactions, and stores only the last four digits of an account number. Driver location is recorded only during on-duty periods, enforced by the server as well as the app.
• Backups and resilience. Automated database backups are provided by the database provider. The public status page is hosted separately from the API.
• Personnel. Access to production systems is limited to personnel who need it and who are bound by confidentiality obligations.

Annex 3 — Subprocessors

Intuit Inc. (QuickBooks Online) will be added only if that integration is enabled, with the notice described in §7.

Questions about this Addendum, or a request for a countersigned copy: hello@loadful.ai. See also our Privacy Policy and Terms of Service.