Data processing agreement

Data Processing Agreement pursuant to Art. 28 GDPR

cargo protection gf GmbH · Version: November 2026 · Convenience translation – the German version prevails

Parties

Controller (hereinafter the “Client”): the customer that uses the cargo protection platform on the basis of the General Terms and Conditions, with the details provided upon registration.

Processor (hereinafter “cargo protection”): cargo protection gf GmbH, Mitterstraße 287a, A-8073 Seiersberg-Pirka, Austria, FN 685320 z, Regional Court for Civil Matters Graz.

Preamble

The Client uses the cargo protection platform to verify carriers before awarding an order. In doing so, the Client transmits data on carriers, which may also include personal data. This Agreement governs the data protection obligations of the parties in connection with this processing pursuant to Art. 28 GDPR. It supplements the General Terms and Conditions of cargo protection and takes precedence over them in matters of data protection.

§ 1 Subject Matter and Term

1.1 cargo protection processes personal data on behalf of and on the instructions of the Client in order to check the carrier data entered by the Client for inconsistencies and to provide the Client with an evaluation (CP score, recommendation, individual results).

1.2 This Agreement commences upon acceptance at registration and applies for the term of the user agreement. It ends automatically upon termination of the user agreement; § 8 continues to apply thereafter.

§ 2 Nature and Purpose of Processing, Types of Data, Data Subjects

2.1 The processing comprises the collection, storage, matching, evaluation, provision and deletion of the data transmitted by the Client.

2.2 The data is used exclusively for evaluations on behalf of the respective Client. It is not included in evaluations for other customers, is not made accessible to other customers and is not used for cargo protection’s own purposes, except for retention pursuant to § 8.3. Previous verifications of the same carrier by the same Client may be taken into account in that Client’s further verifications for as long as they are stored pursuant to § 8.3.

2.3 Special categories of personal data (Art. 9 GDPR) and data relating to criminal convictions (Art. 10 GDPR) are not subject to processing. The Client does not upload such data.

§ 3 Instructions

3.1 cargo protection processes the data only on documented instructions from the Client. Use of the platform functions constitutes an instruction; the Client issues further instructions in text form to [email protected].

3.2 If cargo protection considers that an instruction infringes data protection law, it shall inform the Client without delay and may suspend execution until the matter has been clarified.

3.3 Processing without instructions takes place only where cargo protection is required to do so under Union law or Austrian law; in this case, it shall inform the Client in advance unless prohibited by law.

§ 4 Obligations of cargo protection

4.1 Confidentiality: All persons with access to the data are bound to confidentiality or are subject to a statutory obligation of confidentiality.

4.2 Security: cargo protection takes the technical and organisational measures pursuant to Art. 32 GDPR described in Annex 1. It may adapt these to the state of the art, provided that the level of protection is not reduced.

4.3 Data subject rights: cargo protection assists the Client in responding to requests from data subjects (Art. 12 to 22 GDPR). If a data subject contacts cargo protection directly, cargo protection shall forward the request to the Client without delay, provided that the Client can be identified.

4.4 Data breaches: cargo protection informs the Client without undue delay, where possible within 24 hours of becoming aware, of any breach of the security of the Client’s data. The notification contains the information pursuant to Art. 33(3) GDPR, to the extent known; missing information will be provided subsequently.

4.5 Further assistance: cargo protection assists the Client with data protection impact assessments and prior consultations (Art. 35 and 36 GDPR) to the extent that it can contribute information.

4.6 Contact person: Gernot Fischbach, Managing Director, [email protected], +43 316 395334-0. No data protection officer has been appointed, as the requirements of Art. 37 GDPR are currently not met.

§ 5 Sub-processors

5.1 The Client approves the sub-processors listed in Annex 2.

5.2 The Client grants general authorisation for further sub-processors. cargo protection informs the Client by email at least 14 days before engaging or replacing a sub-processor. The Client may object within this period for an important reason relating to data protection. If no agreement is reached, the Client may terminate the user agreement with effect from the date of the change.

5.3 cargo protection contractually binds each sub-processor to a level of protection equivalent to this Agreement and is liable to the Client for the sub-processor’s performance of its obligations.

5.4 Queries of publicly accessible sources and registers in which no personal data is handed over for processing on behalf of the Client do not constitute sub-processing, in particular the verification of a VAT number via the EU VAT Information Exchange System (VIES) and national tax and company registers, queries of licence lists, the assignment of postcodes via OpenStreetMap Nominatim and queries relating to domain names. In each case, only the VAT ID or licence number, postcode or domain is transmitted.

§ 6 Transfers to Third Countries

6.1 The data is stored in data centres in the European Union (application: Amsterdam region, Netherlands; database and file storage: EU region).

6.2 A transfer to a country outside the European Economic Area, including by remote access of a sub-processor established in a third country, takes place only if the requirements of Art. 44 et seq. GDPR are met, in particular on the basis of an adequacy decision (such as the EU-US Data Privacy Framework), standard contractual clauses of the European Commission or approved binding corporate rules. The respective basis is set out in Annex 2.

§ 7 Evidence and Audits

7.1 On request, cargo protection provides the Client with the information necessary to demonstrate compliance with this Agreement, in particular a current description of the measures pursuant to Annex 1 and any existing audit reports.

7.2 If this evidence is insufficient, the Client may carry out an audit itself or through an auditing body bound to confidentiality, at most once a year, with at least 30 days’ notice, during business hours and without access to data of other customers or to business and trade secrets of cargo protection, in particular the verification methods. Audits following a data breach or ordered by a supervisory authority remain unaffected.

7.3 cargo protection may charge the costs of an on-site audit at reasonable rates, unless the audit reveals a material breach.

§ 8 Return, Deletion and Retention

8.1 After termination of the user agreement, the Client may export its evaluations via the platform within 30 days.

8.2 Thereafter, cargo protection deletes the Client’s data unless § 8.3 or a statutory retention obligation precludes this. Data in backup copies is overwritten in the regular backup cycle, at the latest after 7 days.

8.3 Verification history and retention for legal certainty: The query data entered, uploaded documents and associated evaluations are retained for three and a half years from the respective query. During the term of the user agreement, they are available to the Client as a verification history so that the Client can demonstrate verifications carried out within the limitation periods relevant to transport contracts (in particular Art. 32 CMR); to this extent, cargo protection processes the data on behalf of the Client. If the Client verifies the same carrier again, its own stored previous verifications of that carrier may be taken into account. Otherwise, each verification is carried out anew and independently; a Client’s data is used neither for verifications by other customers nor for any other evaluations. After termination of the user agreement and expiry of the export period pursuant to § 8.1, cargo protection retains the data in blocked form until the end of the period as an independent controller on the basis of Art. 6(1)(f) GDPR in conjunction with Art. 17(3)(e) GDPR and uses it exclusively for the establishment, exercise or defence of legal claims. After expiry of the period, the data is deleted unless proceedings are pending.

8.4 Query and system logs: Logs of log-ins and queries carried out (in particular time, access account, IP address and verified carrier) are stored for one year and serve the purposes of security, support and error analysis, and the detection and investigation of misuse, such as systematic repeated queries. Longer storage takes place only where this is necessary to pursue a specific suspicion of misuse or where there is a statutory obligation.

§ 9 Liability

9.1 The liability of the parties towards data subjects is governed by Art. 82 GDPR.

9.2 As between the parties, the liability provisions of the General Terms and Conditions of cargo protection apply, unless Art. 82 GDPR mandatorily provides otherwise.

§ 10 Final Provisions

10.1 This Agreement is concluded electronically (Art. 28(9) GDPR) by the Client accepting it upon registration through express confirmation. It is permanently available for download.

10.2 cargo protection shall notify amendments required due to changes in the legal situation or the practice of authorities at least 30 days before they take effect. If the Client does not object within this period, they shall be deemed accepted; the notification shall refer to this consequence.

10.3 In the event of conflicts, this Agreement takes precedence over the General Terms and Conditions in matters of data protection. If any provision is invalid, the remainder of the Agreement remains valid.

10.4 Austrian law applies, excluding its conflict-of-law rules. The place of jurisdiction is the court having subject-matter jurisdiction in Graz.

10.5 This Agreement is made in German. This English version is a convenience translation; in the event of discrepancies, the German version prevails.

Annex 1: Technical and Organisational Measures (Art. 32 GDPR)

Annex 2: Sub-processors

As at the conclusion of the Agreement. Changes pursuant to § 5.2. The current list is available at www.cargo-protection.com/subprocessors.

The payment service provider is not listed: it processes only the Client’s invoicing and payment data under its own responsibility and no query data. Queries of VIES and the national registers (Poland: VAT White List and GITD licence lists; Romania: ANAF; Czech Republic: ARES and VAT register), of OpenStreetMap Nominatim and domain queries (WhoisXML API, WHOIS service of nic.at) likewise do not constitute sub-processing within the meaning of § 5.4.