Data Processing Agreement

Version: 2026-10-22

This Data Processing Agreement ("DPA") forms part of the RouteIQ Terms & Conditions between CodeRed Technologies, Inc. ("CodeRed", "we", "us") and the business accepting those Terms ("Customer", "you"). It governs personal data we process on your behalf through RouteIQ ("Customer Personal Data"). For a new self-service account, it takes effect when your organization is created after you accept it during signup.

References to the EU GDPR, the UK GDPR and other data protection laws apply only to processing within their scope.

1. Roles and instructions

You determine the purposes of processing and act as controller, or as a processor authorized by your controller to engage us. CodeRed acts as your processor or subprocessor. Your use and configuration of RouteIQ, this DPA, and written instructions you send us constitute your documented instructions. You are responsible for lawful instructions, the applicable legal basis, and the notices and permissions required for your operations, including driver tracking.

We will process Customer Personal Data only on those instructions to provide the agreed Service, including when transferring data, unless applicable law requires otherwise. In that case we will inform you of the legal requirement before processing, unless the law prohibits doing so. We will inform you immediately if we consider an instruction to infringe applicable data protection law and may suspend the affected processing while we resolve the issue with you.

We act as your service provider under the CCPA. We will not sell or share Customer Personal Data; retain, use or disclose it outside our direct business relationship with you or for any purpose other than providing the Service; or combine it with other personal data except as the CCPA permits. We will comply with the CCPA, provide the level of protection it requires, notify you if we can no longer meet these obligations, and allow you to take reasonable steps to stop and remediate unauthorized use. Our own processing as a controller is described in our Privacy Policy.

2. Processing covered

• Subject matter and purpose: operating the dispatch, routing, tracking, communication and related business workflows you configure in RouteIQ.
• Duration: the customer relationship and the limited return, deletion or legally required retention period described in section 8.
• Activities: collecting, receiving, storing, organizing, retrieving, displaying, transmitting, updating, exporting and deleting data, and computing routes and arrival estimates.
• People: your account users, employees, drivers, contractors, customers, passengers, recipients and other people whose information you lawfully enter.
• Data: identifiers and contact details; pickup and delivery addresses; job and route records; service requirements and scheduling details; driver and vehicle location and timestamps; communications; proof-of-service photos, signatures and attachments; and custom fields you configure.

The data categories depend on the operational workflows and fields you configure. Submit only information necessary for those workflows and ensure you have the legal basis and permissions required for it. The measures in Annex A apply to all Customer Personal Data.

3. Confidentiality and security

We will ensure that people authorized to process Customer Personal Data are bound by confidentiality duties and receive access only as necessary for their work. We will maintain technical and organizational measures appropriate to the risks, taking account of the nature, scope, context and purposes of processing, the state of the art and implementation costs.

Annex A describes these measures. We may update them if overall protection is not materially reduced.

4. Subprocessors and customer integrations

You give general written authorization for us to use the providers on our Subprocessors page. We will notify the account administrator 30 days before adding or replacing a subprocessor. You may object on reasonable data protection grounds; if we cannot resolve the objection, you may end the affected service before the change.

We will impose data protection obligations on our subprocessors that provide the protection required by this DPA, including sufficient security guarantees. We remain fully liable to you for their performance of those obligations.

Providers you connect with your own account process data under your agreement with them and are not our subprocessors.

5. Assistance

Taking into account the nature of processing and the information available to us, we will assist you, insofar as possible, with requests from individuals and with your obligations under GDPR Articles 32 to 36. Contact hello@routeiq.app for assistance.

6. Personal data breaches

We will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data and provide the information reasonably available to us. A notification is not an admission of liability.

7. International transfers

RouteIQ is operated from the United States. Your use of the Service instructs us to transfer Customer Personal Data to the United States and to our subprocessors' locations as needed to provide it.

EU/EEA. Where a transfer needs safeguards under the EU GDPR, the Standard Contractual Clauses in the Annex to Commission Implementing Decision (EU) 2021/914 (the "SCCs") are incorporated into this DPA: Module Two where you are a controller and Module Three where you are a processor, completed by Annex B. You are the data exporter and CodeRed is the data importer.

Switzerland. For transfers from Switzerland, the SCCs apply with references to the GDPR read as the Swiss Federal Act on Data Protection and the Federal Data Protection and Information Commissioner as the competent supervisory authority. "Member State" in Clause 18(c) does not prevent data subjects in Switzerland from suing where they habitually reside.

United Kingdom. For transfers from the UK, the International Data Transfer Addendum to the SCCs issued by the Information Commissioner (version B1.0) is incorporated, completed by Annex B.

Accepting this DPA is each party's signature of these clauses. They prevail over any conflicting term of this DPA or the Terms.

8. Return and deletion

On termination we will, at your choice, return or delete Customer Personal Data unless law requires retention. Backups are deleted on their normal expiry and stay protected until then.

9. Demonstrating compliance and audits

We will make available the information necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, by you or an auditor you appoint, at your cost, on reasonable notice, and subject to confidentiality and protection of other customers' data.

10. Relationship to the Terms

This DPA prevails over inconsistent Terms concerning Customer Personal Data. Nothing in the Terms or this DPA limits rights of individuals or obligations and liabilities that cannot lawfully be limited. This version remains available at /legal/2026-10-22/dpa.

Annex A. Security measures

• Access and separation: authenticated access, role-based permissions and tenant-scoped data access; authorized personnel access limited to operational need and removed when no longer needed.
• Data protection: HTTPS for public web and API connections, encryption at rest for production database and file storage, protected authentication secrets and field-level encryption of stored integration credentials; controls over access to storage and backups.
• Accountability: relevant activity and change logs, monitoring and procedures for investigating security events, with access to logs restricted to authorized personnel.
• Availability: backup, restoration and incident recovery arrangements appropriate to the Service; checks of recovery procedures and safeguard effectiveness.
• Maintenance: review of software changes, security updates and vulnerability handling; assessment of providers used to process Customer Personal Data.
• Privacy requests: procedures to identify affected records and assist with correction, export, restriction and deletion, including appropriate verification of the requesting party.

These are contractual commitments, not a claim of ISO certification, SOC attestation or a guarantee that every incident can be prevented.

Annex B. Transfer details

These details complete the SCCs and the UK Addendum under section 7.

• Clause selections: Clause 7 does not apply. Clause 9(a) Option 2, with the 30-day notice in section 4. The optional language in Clause 11(a) does not apply. Clauses 17 and 18: the law and courts of Ireland.
• Data exporter: the Customer identified in its RouteIQ account, as controller or processor. Contact: its account administrator.
• Data importer: CodeRed Technologies, Inc., New York, United States (full address on request), as processor or subprocessor. Contact: privacy contact, hello@routeiq.app.
• People, data and purpose: as in section 2.
• Sensitive data: depending on your configured workflows, operational records may contain health information relating to service requirements or scheduling. The measures in Annex A apply. Other special-category or criminal-offence data require a separate written agreement.
• Frequency and nature: continuous while you use the Service, for the activities in section 2.
• Retention: as in section 8.
• Supervisory authority: the authority competent for you under Clause 13.
• Security measures (Annex II): Annex A.
• Subprocessors (Annex III): our Subprocessors page, under section 4.
• UK Addendum: Tables 1 and 3 are completed by the details above; Table 2 is the SCCs as completed here; under Table 4, neither party may end the Addendum under its Section 19.