Data Processing Addendum setting out UK GDPR processor obligations for Logivo.ai when processing customer-controlled transport and operational personal dat...
Data Processing Addendum setting out UK GDPR processor obligations for Logivo.ai when processing customer-controlled transport and operational personal data.
Version production-2026-06-03
1. Definitions
In this DPA:
- Customer Personal Data means personal data processed by Logivo.ai on behalf of the Customer in connection with the Services.
- Data Protection Laws means, to the extent applicable, the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003, the EU GDPR, and any replacement or supplemental data protection laws.
- EU GDPR means Regulation (EU) 2016/679.
- UK GDPR has the meaning given in the Data Protection Act 2018.
- Personal Data Breach, controller, processor, personal data, processing, data subject and subprocessor have the meanings given in Data Protection Laws.
Capitalised terms not defined in this DPA have the meanings given in the Agreement.
2. Roles and scope
- The Customer is the controller of Customer Personal Data.
- Logivo.ai is the processor of Customer Personal Data, except where Logivo.ai acts as controller as described in the Privacy Policy or the Agreement.
- Schedule 1 describes the subject matter, duration, nature, purpose, categories of data subjects and categories of personal data.
The Customer is responsible for:
- providing all required privacy notices;
- having a lawful basis for processing;
- ensuring Customer Personal Data is accurate, relevant and lawful;
- ensuring its instructions comply with Data Protection Laws;
- handling data subject requests where it is the controller; and
- configuring the Services lawfully.
Logivo.ai will process Customer Personal Data only on documented instructions from the Customer, including the Agreement, the Order Form, product configuration, Authorised User actions and written instructions, unless required by law. If Logivo.ai is legally required to process Customer Personal Data otherwise than on Customer instructions, Logivo.ai will notify the Customer before doing so unless prohibited by law.
Logivo.ai will promptly notify the Customer if, in Logivo.ai's opinion, an instruction infringes Data Protection Laws.
3. Processor obligations
Logivo.ai will:
- process Customer Personal Data only as necessary to provide, secure, support and improve the Services, comply with the Agreement, and follow Customer instructions;
- ensure persons authorised to process Customer Personal Data are subject to confidentiality obligations;
- implement and maintain appropriate technical and organisational measures as described in Schedule 2;
- assist the Customer, taking into account the nature of processing and information available to Logivo.ai, with data subject requests, security obligations, breach notifications, data protection impact assessments and regulator consultations;
- make available information reasonably necessary to demonstrate compliance with this DPA;
- delete or return Customer Personal Data as described in section 8; and
- comply with obligations that apply directly to processors under Data Protection Laws.
Logivo.ai may charge reasonable fees for assistance that is not required because of Logivo.ai's breach and that requires significant time, bespoke work, exports, audits or technical support outside standard functionality.
4. Subprocessors
- The Customer gives Logivo.ai general written authorisation to engage subprocessors to process Customer Personal Data for the Services.
- Logivo.ai will maintain a current list of subprocessors at https://logivo.ai/sub-processors or another location notified to the Customer. The list should include the subprocessor's name, purpose and country or region of processing.
- Logivo.ai will impose written data protection obligations on subprocessors that provide a level of protection materially equivalent to this DPA.
- Logivo.ai remains responsible to the Customer for subprocessors' performance of data protection obligations to the extent required by Data Protection Laws.
Logivo.ai may add or replace subprocessors. Where required by Data Protection Laws, Logivo.ai will provide reasonable prior notice, such as through the subprocessor page, email or in-product notice. The Customer may object on reasonable data protection grounds within 10 business days. The parties will work in good faith to resolve the objection. If it cannot be resolved, Logivo.ai may terminate the affected Services and provide a pro-rata refund of prepaid unused fees for the affected Services, if any.
5. International transfers
- Logivo.ai will not transfer Customer Personal Data outside the UK, EEA or a country covered by an applicable adequacy decision or adequacy regulation unless appropriate safeguards are in place or a lawful derogation applies.
- Where Customer Personal Data is transferred from the UK to a country without UK adequacy protection, the parties will use the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, as applicable.
- Where Customer Personal Data is transferred from the EEA to a country without EU adequacy protection, the parties will use the EU Standard Contractual Clauses, as applicable.
- The Customer authorises Logivo.ai to enter into onward transfer mechanisms with subprocessors as necessary to provide the Services.
6. Security
- Logivo.ai will implement and maintain appropriate technical and organisational measures designed to protect Customer Personal Data against unauthorised or unlawful processing and accidental loss, destruction, damage, alteration or disclosure.
- Schedule 2 describes the baseline measures. Logivo.ai may update those measures from time to time, provided the overall level of security is not materially reduced.
- The Customer is responsible for securing its own systems, credentials, devices, networks, integrations, permissions, exports and local copies of Customer Personal Data.
7. Personal Data Breach
- Logivo.ai will notify the Customer without undue delay and, where reasonably practicable, within 72 hours after becoming aware of a Personal Data Breach affecting Customer Personal Data.
- The notification will include, to the extent known at the time: the nature of the breach; categories and approximate number of affected data subjects and records; likely consequences; measures taken or proposed to address the breach; and a contact point for follow-up.
- Logivo.ai will take reasonable steps to contain, investigate and remediate the breach and will provide reasonable assistance to the Customer for any required notifications.
- Logivo.ai's notification of a breach is not an admission of fault or liability.
8. Return and deletion
- During the term, the Customer may export Customer Personal Data using available export functionality or by requesting reasonable assistance.
- On termination or expiry of the Services, Logivo.ai will, at the Customer's choice and subject to payment of undisputed fees, delete or return Customer Personal Data within a reasonable period, unless retention is required by law or needed to establish, exercise or defend legal claims.
- Backup copies may remain in secure backups until overwritten or deleted through normal backup cycles, provided they are protected and not used for active processing except restoration, security, compliance or legal purposes.
9. Data subject requests
- If Logivo.ai receives a request from a data subject relating to Customer Personal Data, Logivo.ai will, where legally permitted, notify the Customer or direct the data subject to contact the Customer.
- Logivo.ai will not respond substantively to such requests except on Customer instructions, as required by law, or to confirm that the request relates to a Customer-controlled account.
10. Audits and compliance information
- Logivo.ai will make available information reasonably necessary to demonstrate compliance with this DPA. This may include security summaries, questionnaires, policies, certifications, audit reports or other documentation where available.
- If the information provided is insufficient to demonstrate compliance, the Customer may request an audit no more than once in any 12-month period, unless required by a regulator or following a confirmed Personal Data Breach affecting Customer Personal Data.
- Audits must be conducted during normal UK business hours, on reasonable prior written notice, by qualified personnel, in a way that does not disrupt Logivo.ai's business or compromise other customers' data, security, confidentiality or systems.
- The Customer must ensure auditors are bound by confidentiality obligations. Logivo.ai may charge reasonable fees for audits requiring significant time or resources, except where the audit is required because of Logivo.ai's material breach of this DPA.
11. Customer instructions and restricted data
- The Customer must not upload or submit special category data, criminal offence data, children's data, national identifiers, financial account data, payment card data, health data, biometric data or other high-risk data unless expressly permitted in the Order Form and supported by appropriate safeguards.
- The Customer must not use the Services to make solely automated decisions about individuals that produce legal or similarly significant effects unless expressly agreed in writing and supported by appropriate safeguards.
12. Liability and conflict
- Liability arising under this DPA is subject to the limitations and exclusions in the Agreement unless Data Protection Laws require otherwise.
- If this DPA conflicts with the Terms, this DPA prevails for the processing of Customer Personal Data.
Schedule 1: Details of processing
- Subject matter: provision of Logivo.ai transport, fleet, logistics, AI, automation, web, mobile, integration, support, analytics and related services to the Customer.
- Duration: the term of the Agreement plus any export, deletion, backup, legal retention or wind-down period.
- Nature of processing: hosting, storage, transmission, retrieval, access, organisation, structuring, recording, alteration, consultation, analysis, extraction, enrichment, disclosure by transmission, deletion, support, security monitoring, backup and restoration.
- Purpose: to provide, secure, support, maintain, troubleshoot, improve and operate the Services in accordance with the Agreement and Customer instructions.
- Frequency: continuous or intermittent depending on Customer use of the Services.
- Data subjects: Customer employees, drivers, contractors, subcontractors, administrators, customers, suppliers, consignees, shippers, carriers, third-party contacts, support contacts and other individuals whose data is submitted to the Services by or for the Customer.
- Categories of personal data: names, work contact details, role, user credentials, permissions, job and route details, vehicle and trailer identifiers, driver assignments, collection and delivery details, timestamps, signatures, photos, proof-of-delivery documents, notes, communications, location data, telematics data, device data, audit logs, support data and integration data.
- Sensitive data: not intended. Customers must not submit special category data or criminal offence data unless expressly agreed in the Order Form.
- Processing locations: United Kingdom, EEA and other locations used by authorised subprocessors subject to section 5.
Schedule 2: Technical and organisational measures
Logivo.ai will maintain measures appropriate to the risk, nature and scope of the Services, which may include:
- Access control: role-based access, least-privilege permissions, access reviews, authentication controls and revocation processes.
- Encryption: encryption in transit using TLS or equivalent; encryption at rest where supported by the relevant storage or infrastructure service.
- Availability and resilience: backups, monitoring, incident response, disaster recovery planning and operational continuity procedures proportionate to the Services.
- Logging and monitoring: system, access, security and audit logging designed to detect suspicious activity and support investigations.
- Network and application security: firewalls or equivalent controls, secure configuration, vulnerability management, patching processes and malware protection where appropriate.
- Secure development: code review, change control, environment separation, release management and testing practices proportionate to risk.
- Personnel security: confidentiality obligations, access limitation, onboarding and offboarding controls, and security awareness appropriate to roles.
- Subprocessor management: vendor due diligence, written contracts, access limitation and review of relevant security commitments.
- Data segregation: logical separation of customer environments or records where appropriate to the architecture.
- Data minimisation: configuration and retention controls designed to limit processing to what is necessary for the Services.
- Incident management: documented process for identifying, escalating, investigating and remediating security incidents and Personal Data Breaches.
- Physical security: reliance on secure data-centre and office controls provided by reputable infrastructure and workplace providers.