Data Processing Agreement

1. Roles

The Customer decides what personal data about its staff, drivers and delivery recipients goes into the Service and why; it is the controller of that data. Themion processes it only on the Customer's behalf, as its processor.

2. Our instructions

We process the personal data only on the Customer's documented instructions, which are: to provide, secure and support the Service as described in the Customer Agreement and as configured by the Customer in the Service. If we believe an instruction breaks data protection law, we will tell the Customer.

We may also process personal data where the law requires it; in that case we will tell the Customer first unless the law forbids it.

3. Confidentiality

Everyone at Themion who can access the personal data is bound by a duty of confidentiality and accesses it only when needed for the Service.

4. Security

We take appropriate technical and organisational measures to protect the personal data, including those listed in Annex 2, and review them regularly.

5. Sub-processors

The Customer gives a general authorisation for us to use the sub-processors listed in Annex 3. We have written contracts with them that protect personal data to the same standard as this DPA, and we remain responsible for their work.

We will tell the Customer at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds; if we cannot resolve the objection, the Customer may cancel the affected part of the Service without penalty.

6. Helping the Customer

Taking into account the nature of the processing, we help the Customer to answer requests from people exercising their data protection rights, and to carry out data protection impact assessments and consultations with the ICO where needed. Most requests can be handled by the Customer directly in the Service.

If we receive a request directly from a person whose data belongs to the Customer, we will pass it to the Customer and will not answer it ourselves unless instructed.

7. Personal data breaches

We will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the Customer's data. We will give the information the Customer reasonably needs to meet its own duties, and take reasonable steps to contain the breach.

8. International transfers

Some sub-processors are based in, or may access data from, countries outside the UK, such as the United States. We only allow this where the transfer is covered by UK adequacy regulations or by appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

9. End of the service

When the Customer Agreement ends, the Customer can export its data for 30 days. After that we delete the personal data from the live system, and backup copies are deleted within a further 90 days, unless the law requires us to keep them.

10. Audits and information

We will make available the information reasonably needed to show that we meet this DPA, and allow for and contribute to audits by the Customer or an auditor it appoints. Audits need reasonable notice (at least 30 days unless there has been a breach), may happen no more than once a year, are at the Customer's cost and must respect our confidentiality and security.

11. Liability and order of documents

The limits of liability in the Customer Agreement apply to this DPA, except where the law does not allow it. If this DPA conflicts with the Customer Agreement about personal data, this DPA applies.

Annex 1 — Details of the processing

• Subject matter and duration: providing the Service, for as long as the Customer Agreement lasts plus the 30-day export period and backup deletion described above.
• Nature and purpose: hosting, storing, organising, displaying and analysing data so the Customer can manage staff, drivers, rota, vehicles, payments and deliveries; navigation and route planning; live tracking during routes; reading parcel labels; proof of delivery; notifications and support.
• People concerned: the Customer's staff and managers; drivers and other contractors; delivery recipients and senders; other people whose details the Customer enters.
• Types of personal data: names and contact details; role, depot and account records; identity, right-to-work and driving documents; vehicle and fleet records; rota and performance data; pay, fee and bank details; GPS location while a route is running; delivery addresses, label photos, proof-of-delivery photos and notes; device and security logs.
• Special category data: not required by the Service. The Customer should only upload it where it has a lawful basis and a condition under the law.

Annex 2 — Security measures

• Encryption of data in transit (HTTPS/TLS).
• Data stored with established cloud providers that encrypt data at rest.
• Access to the Service controlled by user roles and depot scope, so each person sees only what their role allows.
• Limits on login attempts, expiring reset and invitation links, and sessions that are signed out when a password changes.
• Access to production systems limited to the people who need it.
• Driver location collected only while a route is running.
• Automatic backups, and regular review of our security measures.

Annex 3 — Sub-processors

• Vercel Inc. — hosting of the website and apps.
• Neon Inc. — database.
• Cloudflare, Inc. — domain, network protection and storage of photos and files.
• Resend (Plus Five Five, Inc.) — sending service emails.
• Anthropic PBC — reading the text on parcel labels.
• Mapbox, Inc. — maps and address search.
• Hetzner Online GmbH — our routing server (route calculation).
• postcodes.io and OpenStreetMap-based services — postcode and address lookup.
• Apple Inc. and Google LLC — push notifications to phones.