Transport Manager Data Processing Agreement (DPA)

Brand: UBrise · Service: Transport Manager · Provider (service provider / processor): Reinaldo Victor Artidiello Gonzalez
Customer (business / controller): the company that accepts the Terms of Service
Version: November 7, 2026 · Effective date: 11/03/2026

1. Purpose and order of precedence

This Agreement is part of the Terms of Service (the "Terms") and governs how the Provider processes the personal information contained in Customer Data on the Customer's behalf. Anything not covered here is governed by the Terms; if they conflict on data protection, this Agreement prevails. Capitalized terms have the meaning given in the Terms.

2. Roles of the parties

For Customer Data, the Customer is the business / controller and decides the purposes and means of processing; the Provider is its service provider / processor. The Customer is responsible for the lawfulness of the processing it directs, for giving notices and obtaining consents (including from its drivers) and for the accuracy of the data.

3. Specific purposes of processing

The Provider processes Customer Data only for these business purposes: (a) hosting, storing, displaying, organizing, calculating, exporting and deleting the Customer's information in the Service according to the features of the Plan; (b) receiving and displaying the location, documents and messages of the Customer's drivers, including to the people the Customer sends a load's tracking link to, within the limits described in the Privacy Policy; (c) reading documents, calculating routes and miles and sending notifications when a Customer user asks; (d) providing technical support; (e) securing the Service and preventing fraud; and (f) complying with the law.

4. What the Provider will not do

The Provider will not: (a) sell or "share" (for cross-context behavioral advertising) Customer Data; (b) retain, use or disclose it for purposes other than those in section 3 or outside its direct business relationship with the Customer; (c) combine it with data from other sources, except as the law permits to provide the Service; or (d) use it to train artificial intelligence models.

5. Instructions

The Customer's instructions are these Terms, the Service configuration and what its users do in it. Other instructions must be sent in writing to support@ubrise.com and, if they involve additional work or costs, the Provider may charge for them or decline them. The Provider will notify the Customer if it believes an instruction violates the law, or if it can no longer meet its data protection obligations; in that case the Customer may take reasonable steps to stop and remediate unauthorized use, including termination.

6. Personnel confidentiality

The Provider gives access to Customer Data only to people who need it to provide the Service and who are bound by confidentiality obligations.

7. Security

The Provider maintains the technical and organizational measures in Annex II, appropriate to the risk. It may change them as long as they do not materially reduce protection. The Customer is responsible for the security of its accounts, its users and its drivers' phones.

8. Subprocessors

The Customer gives general authorization for the Provider to use subprocessors in the categories of Annex III. The Provider binds them by contract to substantially equivalent data protection obligations and is responsible for them as set out in the Terms. The Provider will give notice of new subprocessors through support@ubrise.com with thirty (30) days' notice (except in a security or continuity emergency). If the Customer objects on reasonable data protection grounds and no solution is found, its sole remedy is to cancel the Service before the change applies, with a pro-rata refund of the prepaid unused amount.

9. Security incidents

If the Provider determines that an incident caused unauthorized access to or acquisition of the Customer's personal information (or has reason to believe it did), it will notify the Customer without undue delay and no later than ten (10) days, or sooner if applicable law requires, with the information reasonably available, and will help the Customer meet its own notification obligations. Unless the law obliges the Provider, the Customer decides on and makes the notices to affected individuals and authorities. Notice of an incident is not an admission of fault or liability by the Provider.

10. Individuals' requests and assistance to the Customer

If the Provider receives a request from an individual about Customer Data, it will forward it to the Customer and will not answer it itself unless the law requires. Taking into account what the Service does, the Provider will reasonably help the Customer with individuals' requests, risk assessments and inquiries from authorities; help beyond the features of the Service may be charged at reasonable rates.

11. Verification and audits

To demonstrate compliance, the Provider will answer a reasonable security questionnaire once a year and provide the necessary information. If the law requires more, the Customer may carry out an audit with thirty (30) days' notice, during business hours, without affecting the Service or other customers' data, under confidentiality and at its own cost.

12. End of service: return and deletion

After closing, the Customer's Owner may request an export of its data for thirty (30) days. After that, the Provider deletes Customer Data from its active systems. Encrypted backups are deleted on their rotation (up to twelve (12) months) and, while they exist, are used only to recover the system. The Provider may keep what the law requires, protected and only for that purpose.

13. Liability

Each party's liability arising from this Agreement is subject to the exclusions and limits of sections 18 to 21 of the Terms, to the extent permitted by law. The Customer will indemnify the Provider for third-party claims and penalties arising from processing directed by the Customer that is not lawful, or from missing notices or consents that were the Customer's responsibility.

14. Term and governing law

This Agreement lasts as long as the Provider processes Customer Data. It is governed by the same law and dispute resolution mechanism as the Terms. It exists in English and Spanish; if they differ, the English version controls.

Annex I · Details of processing

Annex II · Security measures

• Encrypted connections (HTTPS/TLS) and web security headers.
• A separate database and document folder per company; checks so that a user cannot reach another company's data.
• Passwords stored with salted PBKDF2; session tokens, links and codes stored only as hashes; phone sessions that expire when unused.
• Two-step verification for administrators, with recovery codes; rate limits and temporary lockouts; password recovery by a single-use, expiring link that does not reveal whether an account exists.
• Roles and permissions within each company; activity log of important changes.
• External service keys stored encrypted with a separate master key.
• Automatic backups; encrypted (AES-GCM) off-site backups with rotation.
• System and dependency updates; the service runs as an unprivileged user behind a firewall that only opens the web and administration.

Annex III · Subprocessor categories

The list with each provider's name is available on request at privacy@ubrise.com.