Legal
Data Processing Addendum
How Clovrr processes the load and billing data its customers submit.
Effective October 1, 2026
1. Roles and scope
This Data Processing Addendum ("DPA") forms part of the Terms between Aryan Padarthi d/b/a Clovrr Solutions ("Processor") and the Customer ("Controller"). It applies to personal information contained in Customer Data that we process on the Customer's behalf, including data treated as personal information under the GDPR, UK GDPR, the California Consumer Privacy Act (as a "service provider") and similar laws.
2. Instructions
We process Customer Data only on the Customer's documented instructions, which are the Terms, this DPA and the Customer's use of the Service's features, unless law requires otherwise (in which case we will tell the Customer first where permitted). We will not sell Customer Data, retain, use or disclose it outside the direct business relationship, or combine it with other data except as allowed by law and the Terms.
3. Details of processing
Subject matter and purpose: auditing historical loads, and preparing, sending and following up on accessorial and invoice claims with brokers and shippers on the Customer's instructions. Categories of data: rate confirmations, bills of lading, receipts, invoices and remittances, ELD stop and location records, driver names, and names and contact details of broker and shipper staff. Data subjects: the Customer's personnel and drivers, and staff of its brokers, shippers and factoring companies. Duration: the term of the Terms plus the deletion period below.
4. Confidentiality and security
Personnel with access to Customer Data are bound by confidentiality. We maintain technical and organizational measures appropriate to the risk, including encryption in transit and at rest through our hosting providers, role-based access control, logical separation of each customer's data at the database level, and provider-managed backups.
5. Subprocessors
The Customer authorizes the subprocessors listed on our subprocessor page. We will give at least 30 days' notice of a new subprocessor by updating that page and notifying account owners by email; the Customer may object on reasonable data-protection grounds, and if we cannot address the objection the Customer may terminate the affected service. We impose data-protection terms on each subprocessor that are no less protective than this DPA and remain responsible for their performance.
6. Assistance and data subject requests
Taking into account the nature of processing, we will help the Customer respond to data subject requests, carry out data protection impact assessments, and meet its security and breach-notification obligations. If we receive a request directly from a data subject about Customer Data, we will refer it to the Customer.
7. Personal data breaches
We will notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Data, with the information reasonably available to help the Customer meet its obligations.
8. Deletion and return
During the term, the Customer may export or delete Customer Data through the Service or on request. Within 30 days after the Terms end, we will delete Customer Data, except copies we must keep by law or that exist in routine backups, which remain protected until overwritten.
9. Audits
On reasonable written request, no more than once a year, we will provide information needed to demonstrate compliance with this DPA, such as security documentation and our providers' third-party audit reports.
10. International transfers
Where Customer Data is transferred from the EEA, UK or Switzerland to a country without an adequacy decision, the applicable standard contractual clauses are incorporated by reference, with the Customer as exporter and us as importer.
This draft is not legal advice and has not yet been reviewed by counsel.