Data Processing Agreement (DPA)

Effective Date: 28-08-2025

This Data Processing Agreement (“DPA”) is entered into between:

• Client (the “Controller”), and

• Bioseq Ltd, Carrick Rd, Drumshanbo, Co. Leitrim, Ireland (the “Processor”),

together the “Parties”.

This DPA forms part of the Terms of Service / Service Agreement between the Parties.

1. Subject Matter

The Processor will process personal data on behalf of the Controller in connection with the Controller’s use of Bioseq Transport, a logistics management platform.

2. Roles & Responsibilities

• Controller determines the purposes and means of processing personal data.

• Processor processes personal data only on documented instructions from the Controller.

• Sub-processors may be engaged by the Processor in accordance with Section 7.

3. Categories of Data Processed

The Processor may process the following types of personal data on behalf of the Controller:

• Driver identity (name, contact details, licence number).

• Driver credentials (CPC, ADR, certifications, expiry dates).

• Location and GPS data during journeys.

• Working hours, logs, breaks, and compliance records.

• Photos, signatures, POD scans.

• Messaging between drivers and dispatchers.

Special categories of data are not intentionally processed, but incidental processing (e.g., medical notes in driver compliance) may occur.

4. Data Subjects

• Drivers employed or contracted by the Controller.

• Controller’s employees or agents (dispatchers, administrators).

• Consignees/consignors associated with deliveries.

5. Duration

Processing shall continue for as long as the Controller maintains an active subscription to the Platform, and until all personal data has been deleted or returned in accordance with Section 10.

6. Processor Obligations

The Processor shall:

• Process personal data only on documented instructions.

• Ensure staff authorised to process personal data are bound by confidentiality.

• Implement appropriate technical and organisational security measures.

• Assist the Controller in responding to data subject requests (DSARs).

• Notify the Controller without undue delay of personal data breaches.

• Assist with data protection impact assessments (DPIAs) where required.

7. Sub-Processing

• The Controller authorises the Processor to engage sub-processors (e.g., cloud hosting, mapping, analytics, payment providers).

• A current list of sub-processors is maintained at [URL to Bioseq sub-processor list].

• The Processor shall impose equivalent data protection obligations on sub-processors.

• The Processor remains fully liable for the actions of sub-processors.

8. International Data Transfers

• Data may be transferred outside the EEA/UK if adequate safeguards are in place (e.g., EU Standard Contractual Clauses, UK IDTA).

• The Controller consents to such transfers subject to these safeguards.

9. Security Measures

The Processor shall maintain security appropriate to the risk, including:

• Encryption of data at rest and in transit.

• Access controls and authentication.

• Logging and monitoring of access to systems.

• Regular security testing and vulnerability assessments.

• Data minimisation and retention controls.

10. Data Retention & Deletion

• Upon termination of services, the Processor will, at the Controller’s option, delete or return all personal data.

• Backups will be securely deleted within [90] days unless retention is required by law.

11. Audit Rights

• The Controller may audit the Processor’s compliance once per year, with reasonable notice, at the Controller’s cost.

• Alternatively, the Processor may provide independent third-party audit reports (e.g., ISO 27001, SOC 2).

12. Liability

Each Party’s liability under this DPA shall be subject to the limitations of liability agreed in the Terms of Service, except where prohibited by law.

13. Governing Law

This DPA shall be governed by the laws of Ireland, with exclusive jurisdiction of the Irish courts.

14. Contact

For data protection matters, please contact:
Bioseq Ltd – Data Protection Officer
Carrick Rd, Drumshanbo, Co. Leitrim, Ireland
Email: [info@bioseq.io]