Data Processing Agreement

1. Purpose & Scope

This Data Processing Agreement ("DPA") describes how RelayRigs ("Processor") handles personal data on behalf of business customers, carriers, and partners ("Controller") who use the Platform to post assignments, manage drivers, or otherwise submit personal data of third parties.

2. Roles & Responsibilities

• Controller determines the purposes and means of processing personal data it submits to the Platform, and is responsible for having a lawful basis to share that data with RelayRigs.
• Processor (RelayRigs) processes that data only on Controller's documented instructions and as needed to provide the Platform, and does not sell or use it for unrelated purposes.

3. Categories of Data Processed

• Identity and contact information of drivers, owner operators, or carrier personnel (name, email, phone, company, USDOT number).
• Assignment, location, and vehicle/RV data associated with a posted job.
• Payment and subscription status (no full card numbers are stored by RelayRigs; payment processing is handled by a licensed third-party processor).

4. Sub-processors

RelayRigs may engage third-party sub-processors (for example, cloud hosting and payment processing providers) to support the Platform, and remains responsible for ensuring those sub-processors provide an equivalent level of data protection.

5. Security Measures

• Encryption of data in transit (HTTPS/TLS).
• Access controls limiting who can view administrative data, gated behind authenticated sessions.
• Rate limiting and abuse monitoring on data-submission endpoints.

6. Data Breach Notification

In the event of a confirmed personal data breach affecting Controller's data, RelayRigs will notify the affected Controller without undue delay, and in any case no later than 72 hours after becoming aware of the breach.

7. International Transfers

Where personal data is transferred outside the United States, RelayRigs uses safeguards recognized under applicable data protection law for that transfer.

8. Term & Termination

This DPA remains in effect for as long as RelayRigs processes personal data on Controller's behalf under the underlying Terms of Service or Master Service Agreement. Upon termination, RelayRigs will delete or return Controller's personal data, except where retention is required by law.

9. Liability

Each party's liability under this DPA is subject to the limitation of liability set out in RelayRigs' Terms of Service.

10. Governing Law

This DPA is governed by the laws of the State of Florida, without regard to conflict-of-laws principles.