Data processing agreement

[01]

Roles

For the personal data of the associates your stations schedule, you are the controller and Alakili is your processor. We process it on your documented instructions and for no purpose of our own. For the account data of your own users, we are the controller and our privacy policy governs it.

This agreement forms part of the terms of service. Where your organization requires its own paper, we will sign yours; ask on the call.

[02]

Subject matter and duration

Processing lasts for the term of your subscription plus the wind-down window in our data retention and deletion policy. The subject matter is the provision of logistics operating software for Amazon Delivery Service Partners.

[03]

Categories of data subject

The people your stations schedule and the people you give accounts to:

• Drivers and walkers on your roster, including applicants where you record them.
• Dispatchers, supervisors, owners and anyone else holding a seat.

[04]

Categories of personal data

Identity and contact details, transporter identifiers, employment status and station. Attributes used in assignment. License, right to work and training documents together with the expiry dates derived from them. Scheduling, attendance, messages sent, and shift notes.

No location traces, telematics or behavioral scoring are processed, because the product does not collect them.

[05]

Our obligations

We will process only on your instructions, keep the data confidential, apply the technical and organizational measures described in our security overview and data isolation pages, and bind everyone with access to confidentiality.

[06]

Subprocessors

You give general authorization for us to appoint subprocessors, each under written terms no less protective than these. The current list is available on request. We will tell you before adding or replacing one that handles personal data, and you may object on reasonable data protection grounds.

• Cloud hosting and managed database.
• Transactional email and SMS delivery.
• Error and performance monitoring.
• Payment processing, for account data only.

[07]

International transfers

Where personal data is transferred out of its region, the transfer relies on an adequacy decision where one exists, and otherwise on standard contractual clauses incorporated into this agreement by reference.

[08]

Assisting you

We will help you respond to data subject requests, to data protection impact assessments and to regulators, taking account of what the product can actually do. Self-service export means most access and portability requests need nothing from us at all.

[09]

Personal data breaches

We will notify you without undue delay and in any event within seventy-two hours of becoming aware of a breach affecting your data, with what we know, what we are doing, and what we recommend you do. We will not wait for a complete picture before telling you.

[10]

Audit

We will make available the information needed to demonstrate compliance and will support audits, including by supplying our certifications once awarded. Where a questionnaire or an on-site audit is required, we will agree scope and timing with you rather than refuse.

[11]

Deletion and return

On termination you can export everything during the read-only window. After it, we delete your data under the data retention and deletion policy, except where law requires us to keep something, in which case we keep only that and only for as long as required.