Data Processing Addendum (DPA)

This DPA forms part of the Rigmatix Subscription Agreement between KeeWee Brands LLC (“Rigmatix”, processor) and the Customer (controller).

1. Scope

Applies whenever Rigmatix processes personal data on behalf of the Customer in the course of providing the Rigmatix service.

2. Subject matter and duration

Subject matter: provision of trucking management software. Duration: term of the Subscription Agreement.

3. Nature and purpose of processing

Hosting, storage, transmission, and display of operational trucking data (loads, drivers, vehicles, documents, GPS, fuel, settlements, invoices) so the Customer can run their business.

4. Categories of data subjects

• Customer's employees and contractors (drivers, dispatchers, owners)
• Customer's customers and brokers

5. Types of personal data

• Identifiers: name, email, phone, CDL/licence number
• Vehicle and location data (GPS)
• Operational documents (BOL, POD, rate confirmations)
• Payment and billing metadata

6. Sub-processors

Current list: Lovable Cloud (hosting/database), payment processing providers, Lovable (frontend hosting, US), Twilio/SendGrid (transactional email, US), Google Cloud (maps, US). Customer will be notified 30 days before any material change.

7. International transfers

Where data is transferred outside the EEA/UK/Canada, Rigmatix relies on the EU Standard Contractual Clauses (2021/914), the UK IDTA, and PIPEDA equivalency safeguards.

8. Security measures

Encryption in transit (TLS 1.2+) and at rest where supported by our infrastructure, role-based access, row-level data isolation, audit logging, backups, and restricted administrative access.

9. Data subject rights

Rigmatix assists the Customer in fulfilling data subject access, rectification, erasure, restriction, and portability requests within statutory timeframes.

10. Breach notification

Rigmatix will notify the Customer without undue delay and in any case within 72 hours of becoming aware of a personal data breach.

11. Audit

Once per year, Customer may request a written information security questionnaire and most recent third-party audit summary.

12. Return or deletion

On termination, Customer may export all data via the in-app export tools. Rigmatix deletes Customer data within 30 days of termination unless legally required to retain.

Need a counter-signed copy on letterhead? Email legal@gorigmatix.com.