Data Processing Agreement

1. Scope & Purpose

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Yload Global SA ("Processor", "we") and the Customer ("Controller", "you") and governs the processing of personal data by the Processor on behalf of the Controller in connection with the YLOAD platform and related services.

2. Definitions

"Personal Data", "Processing", "Data Subject", "Controller", "Processor", and "Sub-processor" have the meanings given in the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable data protection legislation.

3. Data Processing Details

• Subject matter: Provision of the YLOAD logistics platform
• Duration: The term of the Service agreement
• Nature & purpose: Storage, retrieval, and processing of logistics and shipment data
• Categories of data: Contact details, shipment records, financial data, usage data
• Data subjects: Customer employees, end customers, carriers, agents

4. Obligations of the Processor

• Process personal data only on documented instructions from the Controller
• Ensure persons authorised to process data are bound by confidentiality
• Implement appropriate technical and organisational security measures
• Assist the Controller in responding to data subject requests
• Delete or return all personal data upon termination of services
• Make available all information necessary to demonstrate compliance

5. Sub-Processors

The Processor engages sub-processors to assist in providing the Service. A current list of sub-processors is available upon request. The Processor will notify the Controller of any intended changes to sub-processors with at least 30 days' notice, allowing the Controller to object.

6. International Transfers

Where personal data is transferred outside the EEA, the Processor ensures appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) as approved by the European Commission, and supplementary measures where required.

7. Security Measures

The Processor implements measures including: AES-256 encryption at rest, TLS 1.3 in transit, role-based access controls per module, and workspace isolation enforced in the database.

8. Data Breach Notification

The Processor will notify the Controller without undue delay (and in any event within 72 hours) upon becoming aware of a personal data breach, providing all information necessary for the Controller to fulfil its notification obligations under GDPR.

9. Audit Rights

The Controller may audit the Processor's compliance with this DPA upon reasonable notice. The Processor will provide access to relevant documentation, facilities, and personnel.

10. Contact

For DPA-related inquiries: