Data Processing Agreement

This Data Processing Agreement (“DPA”) is between the customer – the organization that uses CueLoad (the controller) – and MB AE Motors, company code 307601914, VAT code LT100020138218, registered address Svirbygalos g. 13A-9, LT-46280 Kaunas, Lithuania (the processor, “we”).

It is part of the Terms of Service. The owner accepts it for the organization when creating the organization in CueLoad or when the app asks to accept a new version. No separate signature is needed. If this DPA and the Terms disagree on personal data, this DPA applies.

• Subject: personal data in the data the customer and its team members put into CueLoad (“Customer Data”).
• Duration: as long as the customer uses CueLoad, and afterwards until the data is returned or deleted (section 11).
• Nature: storing, organizing, showing, updating in real time, sending notifications, making PDF documents, backing up and deleting Customer Data.
• Purpose: providing the Service – equipment and warehouse, project equipment lists and availability, loading and returns, quotes, team roles, crew pay and expenses, notifications and calendar links.

Data subjects: the customer's team members and invited people; the customer's clients and their contact people; contact people of equipment suppliers; any other people whose data the customer puts in, for example in notes, photos or documents.

Categories of data:

• names, email addresses, phone numbers and roles;
• work data: assignments to projects, positions, schedules, who loaded, returned or changed what and when;
• crew pay: hours, rates, amounts, payouts, expenses, vehicles and photos or PDFs of receipts;
• client and supplier names and contact details, venue names and addresses, notes;
• photos, logos, letterheads and documents;
• devices for push notifications (push address, keys, browser type) and personal settings.

CueLoad is not built for special categories of data (such as health data). The customer should not put them into CueLoad.

We process Customer Data only on the customer's documented instructions. The instructions are the Terms, this DPA and how the customer and its team members use the Service. We do not use Customer Data for our own purposes, do not sell it and do not use it for advertising. If the law requires us to process it otherwise, we tell the customer first, unless the law forbids that. If we think an instruction breaks data protection law, we tell the customer.

• have a legal basis for the personal data it puts into CueLoad and inform the people concerned, for example its crew about crew pay records;
• decide who gets access and with which role, and remove access that is no longer needed;
• answer requests from data subjects about Customer Data (we help – section 9).

Only people who run CueLoad for us have access to Customer Data, only when needed for the Service, and they are bound to keep it confidential.

We keep these technical and organizational measures (GDPR Art. 32):

• Separation of organizations: row level security in the database – every table with organization data carries the organization, and a person can read and change only the data of organizations they belong to, as their role allows. These rules are enforced by the database, not only by the app, and are covered by automated tests.
• Equipment photos are the exception: they are stored at long random addresses that open without signing in, so lists and PDFs load fast on the phone. Anyone who has a photo's address can open it. Do not upload photos of people or private information as equipment photos.
• Access by role: owner, admin, planner, warehouse and crew have different rights; crew sees only what crew needs.
• Encryption in transit: all connections use HTTPS.
• Encryption at rest: stored data and files are encrypted by our hosting providers.
• Secrets: keys for the database and payments are kept only on the server, never in the app in your browser.
• Tokens: invitation and calendar links are stored only as hashes; push notification content is encrypted end to end.
• History that cannot be rewritten: equipment movements and crew pay changes are append-only.
• Backups: a full backup of the database and stored files before every change to the database structure.
• Testing apart from real data: development and tests run on a separate database with made-up data.
• Limited production access: only the people who run CueLoad can change the production database.

We may improve these measures over time, but not lower their overall level.

The customer gives general authorization for the subprocessors listed on the Subprocessors page.

• We tell owners by email and update that page at least 30 days before we add or replace a subprocessor.
• The customer can object on reasonable data protection grounds within that time by writing to info@cueload.com. If we cannot find a solution together, the customer may end the agreement before the change, without penalty.
• Each subprocessor is bound by a written contract with data protection obligations at least as strict as in this DPA. We remain responsible to the customer for their work.
• Personal data is transferred outside the European Economic Area only with safeguards required by the GDPR – an adequacy decision (such as the EU-U.S. Data Privacy Framework) or the EU Standard Contractual Clauses.

If a person contacts us about Customer Data, we pass the request to the customer and do not answer it ourselves unless the customer asks us to. We help the customer, as far as we reasonably can, to answer requests, to keep data secure, to handle breaches, and with data protection impact assessments and prior consultations with the supervisory authority (GDPR Art. 32–36).

If we become aware of a personal data breach affecting Customer Data, we notify the owner by email without undue delay. We describe what happened, which data and people are likely affected, the likely consequences, and what we have done and recommend. We give more information as it becomes available and help the customer meet its own reporting duties.

When the customer stops using CueLoad, the owner can ask at info@cueload.com for a copy of the organization's data in a common machine-readable format and for its deletion. We delete or irreversibly anonymize Customer Data within 30 days of the request, except what the law requires us to keep. Data can remain in backup copies until those copies are deleted.

On request we give the customer the information needed to show that we meet this DPA. If that is not enough, the customer or an auditor it chooses, bound by confidentiality, may audit us after at least 30 days' notice, at most once a year (more often after a breach or when a supervisory authority asks), at the customer's cost. Audits of our subprocessors are done through their own reports and certifications.

Liability under this DPA follows the Terms of Service, as far as the GDPR allows. This DPA is governed by the law of the Republic of Lithuania.