Data Processing Addendum

01Roles

The customer company is the controller of the personal data it collects through HaulerBase. HaulerBase is the processor. Where HaulerBase determines its own purposes — account administration, billing and service security — it acts as a controller, and the Privacy Policy applies.

02Scope and instructions

HaulerBase processes personal data only on the documented instructions of the customer company, which include the instructions given by configuring and using the service. HaulerBase notifies the customer if an instruction appears to infringe applicable data protection law.

03Categories of data and data subjects

Processing under this addendum typically covers the following.

• Data subjects — the customer company’s moving customers, and its own staff users.
• Data — contact details, addresses, move dates, household inventory descriptions, photographs and video of a home, signatures and payment references.
• Purpose — collecting inventory, producing quotes, booking moves, taking deposits and supporting the account.

04Sub-processors

HaulerBase engages sub-processors for hosting, storage, email and message delivery, payment processing, error monitoring and analytics. A current list is available on request, and customers are notified before a new sub-processor is engaged so they may object on reasonable data-protection grounds.

05Security

HaulerBase maintains technical and organisational measures appropriate to the risk, including encryption in transit, access control with least privilege, audit logging of privileged actions, tenant isolation between customer companies, and tested backups. Personnel with access are bound by confidentiality.

06International transfers

Where personal data is transferred out of its region of origin, the transfer is made under an approved transfer mechanism, and the relevant safeguards are applied to the sub-processors involved.

07Assistance

HaulerBase assists the customer company with data-subject requests, data protection impact assessments and regulator consultations, taking into account the nature of the processing and the information available to HaulerBase. Personal data breaches are notified to the customer without undue delay.

08Deletion and return

On termination the customer company may export its data for the period stated in the Terms of Service. After that period HaulerBase deletes the personal data, except where retention is required by law, in which case it remains protected by this addendum for as long as it is held.

09Audit

HaulerBase makes available the information necessary to demonstrate compliance with this addendum and permits audits by the customer company or an independent auditor on reasonable notice, subject to confidentiality and to not disrupting the service for other customers.