Skip to content
Start free
Legal

Data processing addendum

For business customers: how Upways processes the personal data in your company's account on your behalf. It forms part of the Terms of service.

Last updated October 8, 2026 · Version 2026-10-085 minute readralpasovsi@gmail.com
On this page 12 sections

Who is who.

This addendum is between the customer that holds an Upways company account ("Customer") and DRS Express LLC d/b/a Upways ("Upways", "we", "us"). For personal data in the Customer's account (about its drivers, staff, applicants, customers, brokers and others), the Customer is the controller (or business) and Upways is its processor (or service provider). It applies for as long as Upways processes that data, and wins over the Terms of service where they differ.

What we process.

The details of the processing (Annex 1).

  • Subject matter and duration: providing Upways under the Terms, for as long as the Customer's account exists and then until the data is deleted.
  • Nature and purpose: hosting, storing, displaying, sending and analysing data to run rescues, dispatch, loads, records, messages, billing, support and security.
  • People concerned: the Customer's owners, dispatchers, drivers, contractors and applicants, and the Customer's customers', brokers' and providers' contacts.
  • Kinds of data: contact and account details, roles, phone position while the app is open, documents and photos (such as CDL, medical card, receipts, rate confirmations, bills of lading), messages and emails, call records, load and pay records, tax identifiers needed for tax forms, device tokens and security logs.
  • Sensitive data: the Customer decides whether to upload any (for example drug test results through hiring). Upways treats it with the same protections and does not use it for anything else.

Our promises as processor.

Upways will:

  • Process the data only on the Customer's documented instructions (the Terms, this addendum and the Customer's use of the product), and tell the Customer if an instruction seems unlawful.
  • Not sell or share the data, not use it for its own purposes or for advertising, not combine it with other data except as the service needs, and not use it to train AI models without the Customer's opt in consent.
  • Make sure everyone who can access it is bound to keep it confidential.
  • Keep the security measures in Annex 2 in place.
  • Help the Customer answer people exercising their rights (access, export, correction, deletion), through the product's own tools and by email.
  • Help the Customer with security, breach notices, and data protection impact assessments, as far as Upways reasonably can.

Sub-processors.

The Customer authorises the sub-processors on the Sub-processors page (/info/subprocessors). Upways binds each one to data protection terms at least as protective as these, and stays responsible for them. Upways will tell Customers who ask to be notified at least 30 days before adding or replacing one; the Customer may object on reasonable data protection grounds, and if we cannot resolve it, end the affected service and get a refund of fees prepaid for the remaining period.

Security measures (Annex 2).

What Upways does today to protect the data. Upways does not hold a SOC 2 report or ISO 27001 certification at this time.

  • Encryption: all traffic over TLS; data encrypted at rest by our database and storage provider; email connection tokens and contractor tax IDs sealed with an additional key.
  • Separation: each company's data is kept apart by database row level security, enforced on the server, and tested.
  • Access: role based access inside each company; optional two step sign in that an owner can require for the office; a password check before deleting an account or exporting data; sign out everywhere.
  • Private files: documents and load papers in private storage, opened only through short lived signed links.
  • Secrets: service keys only on the server, never in the apps; paid features have usage caps and kill switches.
  • Logging: a security log of sensitive changes for the company owner; server events logged with a request id and no personal data; crash reports scrubbed of personal data.
  • Resilience: daily database backups that roll off within 30 days, and a written restore procedure.
  • People and process: least privilege for staff, written change management and secure development policies, and a written incident response plan.

Personal data breaches.

If Upways becomes aware of a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to the Customer's personal data, it will tell the Customer without undue delay and in any case within 72 hours, with what it knows (what happened, the data and people likely affected, the likely consequences, and the steps taken), and keep the Customer updated. Telling the Customer is not an admission of fault.

Deletion and return.

During the account, the Customer can export its data at any time (Settings, Security, Export company data) and delete records and people. When the account ends, the Customer has 30 days to export; Upways then deletes the Customer's personal data, with backup copies rolling off within a further 30 days, unless the law requires it to keep something, which stays protected by this addendum.

Audits.

On written request, no more than once a year (or after a breach, or when a regulator asks), Upways will answer a reasonable security questionnaire and provide its security documentation and policies. If that is not enough to show compliance, the parties will agree a reasonable, confidential audit at the Customer's cost, with notice and during business hours, that does not expose other customers' data.

International transfers.

Upways and its sub-processors process data in the United States. Where the Customer's data includes personal data of people in the European Economic Area, the United Kingdom or Switzerland, the parties agree that the EU Standard Contractual Clauses (Module 2, controller to processor, and Module 3 where the Customer is itself a processor) and the UK International Data Transfer Addendum apply and are incorporated by reference, with the details in Annex 1 and Annex 2. The completed clauses, governing law and supervisory authority are set out in the signed version of this addendum.

US state privacy laws.

For the California Consumer Privacy Act and similar state laws, Upways is the Customer's service provider or processor. It will not sell or share the personal data, retain, use or disclose it outside the direct business relationship or for any purpose other than providing the service, or combine it with data from other sources except as those laws allow. It will comply with those laws and tell the Customer if it can no longer meet them.

Liability and order of precedence.

Each side's liability under this addendum is subject to the limits in the Terms of service, as far as the law allows. If this addendum and the Terms differ on data protection, this addendum wins; the Standard Contractual Clauses win over both where they apply.

Getting a signed copy.

This addendum applies to every business customer without a signature. If you need a countersigned copy, use Request a signed DPA below or write to ralpasovsi@gmail.com with your company's legal name, address and the signer's name and title; we return a signed copy with the clause details filled in.