Data Processing Addendum

The processor is Digital Nomads Ltd., company ID 208417243, operator of Cargos3D. The customer is the organization or person using Cargos3D under the applicable Terms of Service or another written agreement.

This DPA applies only to the extent customer data contains personal data for which the customer is a controller or processor and Cargos3D processes it on the customer’s behalf. Data Cargos3D processes for its own purposes is covered by the Privacy Policy.

This DPA forms part of the contractual relationship between the parties where the Terms of Service incorporate it by reference or where the parties accept it by another written or electronic means. It becomes effective with the applicable agreement and remains applicable while Cargos3D processes covered personal data on the customer’s behalf.

The subject matter is provision of Cargos3D and the functions the customer chooses to use. Processing continues for the period the service is used and for a limited additional period where needed for deletion, backups, security, legal claims or legal obligations.

The purpose is to enter, import, process, store, visualize and output customer data for cargo planning and to provide related support, security and technical operations.

Depending on how the customer uses the platform, data may include name, business email, phone, organization, customer or recipient, shipment and order identifiers, routing and operational data and other information the customer chooses to include in files or fields.

Categories of individuals may include employees, drivers, representatives, customers, recipients, suppliers and other persons whose data the customer includes. The platform is not intended for special-category personal data and the customer should not enter such data unless expressly agreed and lawfully permitted.

Cargos3D processes personal data only on documented customer instructions, including instructions arising from use of platform features, unless law requires otherwise. If we believe an instruction clearly infringes applicable data protection law, we may inform the customer and pause the relevant processing until clarified.

Persons authorized by us to access customer personal data receive access only as needed for their functions and are bound by appropriate confidentiality obligations. Access to administrative and sensitive operations is limited according to role and need.

We maintain measures appropriate to the risk and nature of the service. They currently include:

• authentication and access controls for accounts and organizations;
• logical data separation between organizations and server-side checks for sensitive operations;
• HTTPS/TLS for communications with the service and secure channels provided by core vendors;
• logging and mechanisms to detect and investigate suspicious activity and technical issues;
• restriction of access to secrets and sensitive keys to server-side environments and authorized persons where applicable.

Measures may evolve with the platform provided the overall level of protection is not materially reduced.

The customer grants general written authorization for Cargos3D to use subprocessors where necessary to provide the service. Core subprocessors and technical providers are published on a separate page. Cargos3D requires appropriate contractual data protection obligations from subprocessors according to their role.

Where applicable law requires notice of a material addition or replacement of a subprocessor, Cargos3D will use a reasonable channel to notify affected customers and provide a reasonable opportunity to raise a substantiated data protection objection.

Where processing involves a transfer of personal data outside the EEA and applicable law requires a transfer mechanism, Cargos3D and the relevant provider rely on a valid mechanism, including an adequacy decision, the EU-US Data Privacy Framework for certified organizations or applicable Standard Contractual Clauses.

Taking into account the nature of processing and information available, Cargos3D will provide reasonable assistance to the customer with applicable data subject request obligations. If we receive a request clearly concerning customer data for which the customer is controller, we may direct the individual to the customer and notify the customer where appropriate.

If we become aware of a personal data breach affecting customer personal data processed by us as processor, we will notify the customer without undue delay where such notification is required and provide reasonably available information needed to assess and meet applicable obligations.

After the service ends and upon customer request, Cargos3D will delete or, where technically and reasonably feasible, assist with return of customer personal data, except where applicable law requires or permits longer retention. Residual copies may temporarily remain in standard backup systems until overwritten in their normal cycle, while remaining protected and not used for other purposes.

Upon reasonable request, we will provide information available to us that is necessary for the customer to demonstrate compliance with applicable processor obligations. Requests must take into account confidentiality, other customers’ security, trade secrets and reasonable operational limitations.

Taking into account the nature of processing and the information available to us, we will provide reasonable assistance with applicable security obligations, data protection impact assessments and supervisory authority consultations where that assistance is relevant to processing through Cargos3D.

Where applicable law requires an audit or inspection, we may first provide available documentation and a reasonable remote review. If this is insufficient and further inspection is legally required, the parties will coordinate scope and timing so that confidentiality, security and other customers’ data are protected.

For DPA questions, security questionnaires or requests for additional information, contact sales@cargos3d.com.