Data processing agreement

Instructions and roles

The customer identified in the quotation or order confirmation is the controller of its business records; Drivaro is the processor. If the customer itself processes data for a carrier, its mandate must permit Drivaro’s appointment as a further processor. Each party retains its own legal responsibilities.

The processing covers receiving, organising, storing, displaying, changing, transmitting, returning and deleting data for the agreed Drivaxo features. It lasts throughout the service and the agreed wind-down, until the relevant data has been deleted or returned.

Which data and people?

• People: users, managers, drivers, customer and carrier contacts, parcel recipients and people named in a necessary case record.
• Data: names, contact details, roles, employment and reminder dates, leave and absence, carrier-issued codes, vehicle details and assignments, mileage, parcel and stop counts, fuel entries, complaints, delivery addresses, correspondence, necessary operational attachments and action history.
• The instructions exclude identity-document or driving-licence copies or numbers, national-register numbers, and employment-contract copies or contents; reminder dates remain within the scope above. They also exclude biometric identification, medical records, criminal-offence data and continuous GPS monitoring. A necessary extension requires a prior separate assessment and written agreement.

Only for your instructions

We process only on documented instructions: the contract, permitted settings and written requests from authorised contacts. If we consider an instruction contrary to the GDPR or other data protection rules, we notify the customer immediately and do not carry out the disputed part until it is resolved.

Where law requires processing, we inform the customer beforehand unless the law prohibits this for important reasons. We do not use the records for our own advertising, the sale of personal data or another independent purpose.

Confidentiality and security

Only authorised people bound by confidentiality receive the access they need. We implement risk-based technical and organisational measures and do not reduce the agreed protection through a change.

Measures include separate company permissions, server and database checks, encrypted connections, hashed passwords, protected sessions, restricted administration, records of important actions, backups and security tests. The security page explains their scope; this is not a certification or a guarantee that incidents are impossible.

Subprocessors and international transfers

On acceptance, the customer authorises the necessary processors on the provider list supplied at that time for the described services. That list and its version are kept with the agreement. We give prior written notice of additions or replacements and sufficient opportunity to object on data protection grounds before the new party processes the data.

We impose equivalent data protection obligations and remain responsible for the performance of their processor obligations. A justified objection must be addressed before the affected processing continues.

Processing outside the EEA requires documented instructions and a valid basis under GDPR Chapter V. Depending on the recipient, this may be an applicable adequacy decision or another valid safeguard, such as standard contractual clauses with the necessary assessment and supplementary measures. Hosting in Belgium does not rule out overseas support or transfers through other services.

Requests, incidents and checks

We assist with access, correction, deletion, restriction and portability, taking account of the processing. A request received directly is promptly forwarded to the responsible customer. We do not answer on its behalf without authority unless law requires otherwise.

We notify the customer of a personal data breach without undue delay after becoming aware of it. We provide available information about its nature, affected people and data, consequences, contact point and measures, and supplement it as details emerge. The controller’s statutory reporting deadline is not a waiting period for us.

We assist with security, notifications, data protection impact assessments and prior consultation with the authority. We provide the information necessary to demonstrate compliance and allow appropriate audits and inspections, including by an authorised auditor. Security and confidentiality arrangements must not undermine these rights.

Return and deletion

At the end of the service, the customer chooses return or deletion. We delete existing copies unless EU or Belgian law requires retention. A legal exception is limited to the relevant data and required purpose.

Backups are not for everyday use. Local database backups are cleaned up after roughly two weeks. Google Cloud applies a 90-day deletion rule, followed by seven days during which deleted objects remain recoverable. Where immediate selective erasure is not possible, deletion from backup copies follows that cycle. After a restore, previous deletions must be reapplied. Portability rights and agreed retrieval periods remain applicable.