Fleetika Data Processing Agreement (DPA)
Last updated: June 23, 2026 · LLC "CARGOO" (Ukraine, EDRPOU 45054344) — operating as "Fleetika" (DBA)
This Data Processing Agreement ("DPA") is an integral part of the Terms of Service (the "Main Agreement") between LIMITED LIABILITY COMPANY "CARGOO" (Ukraine, EDRPOU: 45054344), operating under the trade name "Fleetika" (DBA) (the "Processor"), and the Customer using the Services (the "Controller").
1. Definitions and Subject Matter
1.1. Terms such as "personal data", "processing", "data subject", "controller" and "processor" have the meanings given to them in the GDPR. This DPA governs the processing of personal data that the Processor carries out on behalf of the Controller in providing the Services.
2. Roles and Instructions
2.1. The Controller determines the purposes and means of processing. The Processor processes personal data only on the documented instructions of the Controller, including as configured through the platform's functionality.
2.2. The Controller warrants that it has a lawful basis and the necessary consents for the data it uploads or connects to the platform (including employee and driver geolocation data).
3. Scope and Nature of Processing
3.1. The Processor processes the categories of data and data subjects described in Annex 1, for the purpose of providing the Services for the duration of the subscription.
4. Obligations of the Processor (Fleetika)
- To process personal data only on the Controller's instructions.
- To ensure the confidentiality of personnel authorized to process the data.
- To apply the technical and organizational measures set out in Annex 2.
- To assist the Controller in responding to data-subject requests and in meeting its security and notification obligations.
5. Sub-processors
5.1. The Controller gives general authorization for the engagement of sub-processors (see Annex 3). The Processor remains liable for the actions of its sub-processors and will inform the Controller of intended changes, giving it the opportunity to object.
6. Integrations and Controller Resources (Google Drive, API)
6.1. Where the Controller connects its own resources (Google Drive, API keys, telematics services), the Processor acts within the granted scopes only. For Google Drive, the Processor uses the minimal drive.file scope and does not read or analyze the Controller's other files.
7. Security Incident Notification
7.1. The Processor will notify the Controller without undue delay, and in any case within 72 hours of confirming a personal-data breach, providing the information needed for the Controller to meet its own notification obligations.
8. International Data Transfers
8.1. Where personal data is transferred outside the EEA, the parties rely on the Standard Contractual Clauses (SCC) and appropriate safeguards.
9. Audit and Data Deletion
9.1. The Processor will make available information necessary to demonstrate compliance and will allow for audits on reasonable notice. On termination, the Processor deletes or returns personal data in accordance with the Privacy Policy and the Main Agreement.
Annex 1: Description of Processing
Categories of data subjects: the Controller's employees, drivers, operators and counterparties. Categories of data: identity and contact data, geolocation/telematics data, messenger metadata and content, media files and documents. Purpose: provision of last-mile logistics Services. Duration: the term of the subscription.
Annex 2: Technical and Organizational Measures (TOMs)
Encryption of data in transit; access control and the principle of least privilege; password storage using modern algorithms (bcrypt/Argon2); access and action logging; firewalls; regular backups; HTTPS/SSL across the platform and website.
Annex 3: List of Sub-processors
The Controller hereby authorizes the engagement of the following sub-processors:
- Linode (Akamai Technologies) — cloud hosting and database infrastructure.
- Google Cloud Platform — Google Maps API, routing services and Google Drive integration.
All sub-processors are engaged under data processing agreements that provide a level of data protection no less stringent than that required under this DPA. An up-to-date list of sub-processors is available to the Controller's Administrator upon request. The Controller will be notified of any intended changes to this list and will have the opportunity to object.
For DPA-related questions, contact [email protected].