Data Processing Agreement

This Data Processing Agreement ("DPA") is between the customer identified on the account (the "Controller") and Fuel Relay (the "Processor", "we").

It is incorporated into the Terms of Service and is accepted by click-through when the admin account is created. Enterprise customers can request a countersigned copy at privacy@fuelrelay.net. This DPA applies to the extent we process personal data on the Controller's behalf and data protection law, including the GDPR and UK GDPR, applies to that processing.

The subject matter is the processing of personal data needed to provide the Fuel Relay service: the mobile app, the admin dashboard, and the APIs behind them.

The duration is the life of the Controller's account plus the retention window described in the Privacy Policy: 90 days of export availability after a subscription is cancelled, then scheduled deletion, or 30 days after the Controller requests account deletion. Any admin of the company can cancel the deletion from the dashboard before that date; signing in alone does not cancel it. We never delete an account because it is unused or has no subscription; it is kept until the Controller deletes it.

We collect, store, sync, and display data submitted through the service; generate reports and exports the Controller runs; send service email; and maintain security records such as the audit log. The sole purpose is providing the service. We do not process Controller personal data for advertising, profiling, or model training.

Categories of personal data:

• Admins: email address, hashed password, company name.
• Prices and invoices, only if the Controller turns them on: the Controller’s address and invoice note; each contractor’s bill-to address (which may name a contact person) and tax status; issued and voided invoices (contractor, dates, and each line’s day, location, fuel type, AFE if shown, gallons, price and amount, with which admin issued or voided it, when, and the reason for a void); and a history of changes to prices, contractors and invoice settings (what changed, by which admin, when). Kept until the account is deleted.
• Fuelers: the access code the Controller issued; operator name and truck number; profile settings (default fuel type and shift, and the fuel load on the truck if entered); a device identifier; the app version and update on the phone and when it last checked in; the fuel logs they create and submit (date, shift, truck number, fuel type, operator name, when the log was created and submitted, and each entry's unit or equipment number, location, description, contractor and gallons, plus any AFE the Controller attaches); and the date of an in-app deletion request. Voice entry is recognised on the phone when it can be, otherwise by the phone's speech recognizer's online service (on most Android phones, Google's; on an iPhone, Apple's); we receive only confirmed text, never audio. From the app's first store release, words a fueler says from the lock screen are held only on the phone, sealed so they can be read only once it is unlocked, until the fueler opens the app (words older than 7 days are then deleted); none of it reaches us unless the fueler saves it as an entry.
• Device data attached to app crash reports: app version, OS version, device model, locale, screen size, free memory, battery level, and a random installation identifier; and in website error reports, the page address without its query string and the browser and operating system.
• The app's update check, sent to Expo each time the app starts: the platform, runtime version and release channel, the current, original and recently failed update IDs, a random installation identifier, any error from the previous start of the update system, and the phone's IP address.
• Genuine-app checks: on Android, from the app's Play Store release, a Google Play Integrity verdict for each request (Google receives the app's name, version and signing certificate, a one-way code of the request, its own device and app integrity signals, and the phone's IP address); on an iPhone, Apple's App Attest, for which Apple receives the app's identifier, a new key's public half and a one-way code of a challenge once per install, and we keep the key's public half, Apple's receipt and when it was last used.
• Security records: the IP address and user agent of each audited action, kept in the audit log for 90 days and not shown to the Controller's admins; our authentication provider's log of dashboard sign-ins (email and IP address), kept 90 days.

Categories of data subjects: the Controller's admins, employees, and contractors who use the service, and any contact person named in a contractor’s bill-to address. No special categories of data are processed, and the service is not intended for data about children.

We will:

• Process personal data only on the Controller's documented instructions, which are: these terms, the DPA, and the Controller's use of the service's features. We will inform the Controller if we believe an instruction violates data protection law.
• Ensure everyone we authorize to process the data is bound by confidentiality.
• Apply appropriate technical and organizational measures, including encryption in transit and at rest, per-tenant row-level security, least-privilege access, re-authentication for sensitive admin actions, and an audit log that no one at the Controller can edit and whose entries are never deleted (IP addresses and user agents are removed from it after 90 days). Our published summary is at fuelrelay.net/security.
• Assist the Controller with data subject requests and with security obligations, including a dashboard tool that erases one fueler's personal data: their access code, the name, truck and fuel load on their profile, their device identifier and app details, the logs they started but never submitted, our technical records about their phone, and the IP addresses and user agents of their audited actions. Every log they submitted, including any sent back for correction, keeps the operator name and truck number it was submitted with, as the Controller's business record.
• Delete or return all personal data at the end of the service term, on the schedule in the Privacy Policy (90 days after cancellation, 30 days after a deletion request), unless law requires longer storage. Audit log entries are anonymized (actor, IP address, and user agent cleared) and retained as security evidence. Encrypted nightly backups are kept for 30 days, so deleted data leaves them within 30 days, and a restore first repeats the account deletions and fueler erasures made after the backup. Stripe's customer record and invoices for the Controller's subscription are kept as our accounting and tax records.

The Controller will:

• Have a lawful basis for the personal data it submits, and inform its fuelers and staff about the processing.
• Keep the data it enters accurate. In the dashboard the Controller can correct a fueler's name and truck number, the AFE codes on entries not yet invoiced, and a log it has sent back to the fueler for correction (or let the fueler correct it); it can erase a fueler's personal data, including to answer a fueler's deletion request (section 5), and delete the whole account. It can't delete a single submitted log, or change a log's entries (other than their AFE codes) unless the log has been sent back; for that, or any other correction or deletion, it can ask us (section 8).
• Issue and revoke fueler access codes responsibly.
• Give only instructions that comply with data protection law.

The Controller gives general authorization for the sub-processors listed at fuelrelay.net/sub-processors. We impose data protection obligations on each sub-processor equivalent to this DPA and remain responsible for their performance.

We will notify admins by email before adding or replacing a sub-processor. The Controller may object on reasonable data protection grounds within 30 days; if we cannot resolve the objection, the Controller may cancel the affected service.

Taking into account the nature of the processing, we assist the Controller in fulfilling requests to access, export, correct, delete, or restrict processing of personal data. The dashboard's export, account deletion and fueler erasure tools cover most requests directly. If a data subject contacts us directly, we forward the request to the Controller without undue delay.

We notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data. The notice describes the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed. We document breaches and our response to them.

On request, we make available the information reasonably necessary to demonstrate compliance with this DPA, including summaries of our security measures and third-party assessments when available. The Controller may audit no more than once per year, on at least 30 days' written notice, during business hours, under confidentiality, at its own cost, and without access to other customers' data.

Personal data is hosted in the United States (AWS us-west-1, Northern California). Where the Controller's personal data originates in the EEA, the UK, or Switzerland, the transfer is governed by the Standard Contractual Clauses (Module Two, controller to processor), which are incorporated into this DPA by reference and completed as set out in section 13, or by another lawful transfer mechanism.

Each party's liability under this DPA is subject to the limitations of liability in the Terms of Service, except where data protection law does not permit such limits. Questions about this DPA: privacy@fuelrelay.net or our data protection officer at dpo@fuelrelay.net.

The Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module Two) are completed by reference to this DPA rather than by separate annexes:

• Annex I.A (parties) and Annex I.B (description of the transfer): the parties in section 1; the data subjects, categories of personal data, purpose, nature, and duration in sections 2 to 4. No sensitive data is transferred. Data is transferred continuously for the duration in section 2.
• Annex I.C (competent supervisory authority): the authority of the EU member state in which the Controller is established.
• Annex II (technical and organizational measures): section 5 and the published summary at fuelrelay.net/security.
• Annex III (sub-processors): the list at fuelrelay.net/sub-processors, authorized under section 7.

Clause selections. Clause 7 (docking clause) applies. Clause 9, Option 2 (general written authorization) applies, with the notice period in section 7. The optional language in Clause 11 (independent dispute resolution body) is not included. Clause 13: the supervisory authority is the one identified in Annex I.C above. Clause 17, Option 1: the Clauses are governed by the law of Ireland. Clause 18: disputes are resolved by the courts of Ireland.

United Kingdom. For transfers subject to the UK GDPR, the Clauses apply as amended by the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the Information Commissioner (version B1.0, in force 21 March 2022). Its tables are completed with the information above; for Table 4, neither party may end the Addendum under its section 19.

Switzerland. For transfers subject to the Swiss Federal Act on Data Protection, references in the Clauses to the GDPR and to a member state are read as references to that Act and to Switzerland, and the Federal Data Protection and Information Commissioner is the competent authority.