Data Processing Agreement

This English text is a translation provided for information. In case of any difference, the Hungarian version prevails.

Annex 1 to the General Terms and Conditions (ÁSZF, hereinafter: the “Terms”). Effective from: 12 November 2026.

The parties

Controller: the company or other business (hereinafter: the Controller or the Customer) that ordered the Routehive service by accepting the Terms. Its details are the company details provided at registration and for invoicing. In the case of a signed copy: [ÜGYFÉL NEVE], registered office: [ÜGYFÉL SZÉKHELYE], company registration number: [ÜGYFÉL CÉGJEGYZÉKSZÁMA], tax number: [ÜGYFÉL ADÓSZÁMA], represented by: [ÜGYFÉL KÉPVISELŐJE], data protection contact: [ÜGYFÉL ADATVÉDELMI KAPCSOLATTARTÓJA].

Processor: Tálosné Tomisa Erika e.v. (sole trader), registered office: 8706 Nikla, Berzsenyi Dániel utca 108/A, registration number: 2742748, tax number: 51138938-2-34, represented by: Tálosné Tomisa Erika, data protection contact: info@routehive.eu (hereinafter: the Processor or the Provider).

1. Conclusion of the agreement, relationship to the Terms, definitions

1.1. This agreement is concluded upon acceptance of the Terms, as an annex to them; no separate signature is required. At the Controller's request, the Processor will also provide a signed copy.

1.2. Where this agreement and the Terms differ, this agreement prevails in matters concerning the processing of personal data.

1.3. The expressions used (personal data, processing, controller, processor, data subject, personal data breach, etc.) have the meaning given to them in Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter: GDPR). The expressions Service, Customer Data, User and Recipient have the meaning given to them in the Terms.

2. Subject matter of the agreement

2.1. The Processor processes the personal data contained in the Customer Data on behalf of the Controller and in accordance with its instructions, solely for the purpose of providing the Routehive service (delivery planning software as a service).

2.2. This agreement does not cover data that the Processor processes as a controller in its own right: User accounts (sign-in, security), data relating to the contract and to invoicing, correspondence, and the Processor's own operational logs. These are covered by the Privacy Notice.

3. Duration

This agreement applies for the duration of the legal relationship under the Terms and thereafter remains in force until the deletion or return under clause 16 has been completed.

4. Nature and purpose of the processing

4.1. Nature: collection (via the interface, from imports), recording, storage, organisation, retrieval, display, comparison (route planning), transmission to sub-processors to the extent required for their tasks (e.g. the address to Google for address lookup), export at the Controller's request, erasure.

4.2. Purpose:

• planning deliveries: address lookup, route and stop sequence, dispatching routes to drivers, fixed routes and recurring routes;
• carrying out and proving deliveries: recording delivery or failed delivery, event log, delivery photo and signature;
• recording cash on delivery and returnable packaging (crates);
• displaying the driver's live location to the dispatcher, with the driver's permission;
• reports and exports for the Controller;
• notifying recipients by e-mail or SMS, if the Controller enables this feature (once it has been introduced);
• troubleshooting and support.

4.3. The Processor does not use the Customer Data for its own purposes: it does not sell it, and does not use it for advertising, profiling or serving other customers. It may use aggregated statistics that contain no personal data and cannot be traced back to the Customer (e.g. the number of stops, response times) to develop the Service, in accordance with clause 11.5 of the Terms.

5. Categories of personal data

5.1. The Processor processes the following data, to the extent that the Controller records them in the Service:

5.2. The Service is not designed for processing special categories of personal data (GDPR Article 9) or personal data relating to criminal convictions and offences (Article 10). The Controller shall not record such data, including in comment fields and photos (e.g. health status in a delivery comment).

6. Categories of data subjects

• the Controller's clients and customers, delivery recipients, and their contact persons and persons taking delivery;
• the Controller's drivers (employees, persons engaged under a service contract, or subcontractors) and other Users of the Service (owner, admin, dispatcher);
• other persons who may be visible in a delivery photo.

7. Obligations and instructions of the Controller

7.1. The Controller is responsible for ensuring that the processing is lawful: that it has a legal basis, that the data subjects have been informed (for drivers, the Provider supplies a template), that a balancing test has been carried out where legitimate interest is relied on, and that a data protection impact assessment has been carried out where necessary.

7.2. The following constitute documented instructions: the Terms and this agreement; the configuration and use of the Service by the Controller (entering, modifying, deleting and dispatching data, use of the live location); and any further instructions given by e-mail by the Controller's owner or admin. Carrying out an instruction that goes beyond the normal operation of the Service may be subject to a fee; the Processor will inform the Controller of this in advance.

7.3. Access by Users (invitation, role, removal) is managed by the Controller. When an employment or service relationship ends, the Controller will revoke the access without delay.

8. General obligations of the Processor

8.1. The Processor processes the personal data only on documented instructions from the Controller, including with regard to transfers to a third country, unless required to do so by Union or Member State law; in such a case, the Processor will inform the Controller of this before processing, unless that law prohibits it (GDPR Article 28(3)(a)).

8.2. If, in the Processor's opinion, an instruction infringes the GDPR or other data protection legislation, the Processor will inform the Controller without delay and may suspend its execution until the matter has been clarified.

8.3. The Processor maintains a record of the processing activities carried out on behalf of the Controller (GDPR Article 30(2)) and cooperates with the supervisory authority.

8.4. The Processor is not required to appoint a data protection officer (its core activity does not consist of regular and systematic monitoring of data subjects on a large scale), so none has been appointed; this is reviewed as the customer base grows.

9. Confidentiality and access

9.1. The Processor grants access to the personal data only to those of its staff and other persons engaged by it who need such access to operate the Service or to provide support, and who are bound by confidentiality (GDPR Article 28(3)(b)).

9.2. The Processor's staff view the Customer Data only at the Controller's request, for troubleshooting, for handling a personal data breach or for complying with a legal obligation, and only to the extent necessary. The Processor logs such access.

10. Security measures (GDPR Article 32)

10.1. The Processor applies the following technical and organisational measures:

Encrypted connection

• The Service is available only over HTTPS; unencrypted requests are redirected, and browsers are instructed to use HTTPS strictly (HSTS).

Separation by company

• Every database row containing company data carries the company's identifier, and every query is restricted to the active company of the signed-in User. The system always takes the company identifier from the session, never from data received from the browser.
• A request for another company's identifier receives the response “not found”, so not even its existence is revealed.
• An automated check runs before every change to the software: a script checks the company filter in every database operation, and a cross-company test suite verifies that one company can neither read nor modify another company's data. The effectiveness of the test suite has been verified with deliberately broken filters.
• In the file storage (photos, signatures), every file is held under the company's prefix; a file can be opened only via a signed link that is valid for a short time (1-2 hours), and only those who can see the stop receive such a link. On upload, the system checks the file type from its content (images only); the maximum size is 4 MB.

Access management

• Roles within the company: owner, admin, dispatcher, driver. A driver sees only the routes assigned to them.
• Two-step sign-in (authenticator app and 10 single-use backup codes) is available to every User as an option. The two-step secret and the backup codes are stored encrypted.
• Passwords are stored only in salted, one-way hashed form (scrypt); the minimum length is 7 characters.
• Users can sign out of their other devices on their own profile; after a password change, the sessions on the other devices are terminated. A session is valid for 30 days.

Attempt limits

• Sign-in: 5 failed attempts per e-mail address within 15 minutes, 20 attempts per IP address within 15 minutes (for IPv6, counted per /64 range).
• Two-step code: 5 incorrect codes per account within 15 minutes, 20 attempts per IP address; in addition, after 10 consecutive incorrect codes the account is locked for 15 minutes.
• Registration: 5 per IP address per hour; password change: 5 incorrect passwords per account within 15 minutes.

Data storage location

• The database (Cloudflare D1), the file storage (Cloudflare R2) and the key-value store for short-lived data (Workers KV: the driver's live location for 10 minutes, attempt counters for 15-60 minutes, the address lookup cache for 30 days) were created with EU jurisdiction, and the data are stored in the EU. Requests are processed on Cloudflare's global network (details: list of sub-processors).

Logging and data integrity

• Delivery event log (who recorded what, and when); a delivered stop and its proof cannot be deleted from the interface, only the route can be archived, so the proof of delivery cannot be lost.
• Deletion log of the deletion of stops and routes.
• Application log of errors and security events (e.g. enabling and disabling two-step sign-in), kept for 7 days; a company's log can be cleared only by the owner and the admin.

Operations and development

• Secret keys are held in Cloudflare's secrets manager, not in the source code.
• The source code is held in a private repository; type checking, unit tests and the cross-company test suite are run before each release to production.
• Security headers (e.g. content type protection); the internal interface is excluded from search engines.
• Backup: the built-in point-in-time recovery of Cloudflare D1 (30 days), and a separate backup before major changes; the restore has been tested.

10.2. The Processor reviews the measures regularly, adapting them to the state of the art. It may not reduce the level of protection.

10.3. The Controller is responsible for security on its own side: for its Users' passwords and devices, for revoking access in good time and for protecting downloaded exports.

11. Sub-processors (subcontractors)

11.1. The Controller gives general written authorisation to engage the sub-processors listed in Annex 2 to the Terms (list of sub-processors) (GDPR Article 28(2)).

11.2. The Processor will notify the Controller's owners by e-mail at least 30 days in advance of the engagement of a new sub-processor or of a planned replacement, and will update the list.

11.3. The Controller may object, stating its reasons, within 14 days of the notification. The parties will consult each other; if no solution is found, the Controller may terminate with immediate effect before the change takes effect, and the proportionate part of any fees paid in advance will be refunded.

11.4. If a sub-processor has to be replaced urgently (e.g. it ceases to operate, or for security reasons), the Processor will notify the Controller without delay after the replacement; the Controller has the right to object in this case as well.

11.5. The Processor imposes on its sub-processors by contract at least the data protection obligations set out in this agreement (GDPR Article 28(4)), and is liable to the Controller for the performance of the sub-processors' obligations.

12. Transfers to third countries

12.1. Personal data may be transferred outside the EEA only in accordance with Chapter V of the GDPR. At present, for the US sub-processors (Cloudflare, Inc., Google), the safeguards are the EU-U.S. Data Privacy Framework and the standard contractual clauses (list of sub-processors).

12.2. If the Framework ceases to be valid, or the certification of a sub-processor lapses, the Processor will switch to the standard contractual clauses and, where necessary, supplementary measures, and will inform the Controller accordingly.

13. Assistance with data subject requests

13.1. The Controller can itself view, correct, export (Excel) and delete most data on the interface of the Service.

13.2. Where the interface deliberately does not allow this (a delivered stop and its event log, proof of delivery, a partner with recorded crate movements, the deletion log), or where a full export is needed, the Processor will, at the Controller's written request, carry out the erasure or rectification, or provide the data in a machine-readable format, within 10 working days.

13.3. If a data subject request is received directly by the Processor, the Processor will not respond to it on the merits, but will forward it to the Controller within 5 working days and inform the data subject accordingly.

14. Personal data breach

14.1. The Processor will notify the Controller of any personal data breach affecting the Customer Data without undue delay, and no later than 48 hours after becoming aware of it, by e-mail to the Controller's owners and to the contact person designated by the Controller.

14.2. The notification will include (GDPR Article 33(3)): the nature of the breach, the categories and approximate number of the data subjects and of the data concerned, the likely consequences, the measures taken and planned, and the name of the contact person. Any information not known at the time of the notification will be provided by the Processor later, without delay.

14.3. The Processor takes the measures necessary to mitigate the damage, and investigates and documents the breach. It notifies the supervisory authority and the data subjects on behalf of the Controller only at the Controller's request or where required by law.

14.4. If a breach affects several customers, the Processor will notify each of them separately and will not disclose any customer's data to another customer.

15. Assistance with impact assessments and prior consultation

The Processor assists the Controller, with the information available to it, in complying with its obligations relating to data security (GDPR Article 32), breach handling (Articles 33-34), impact assessment (Article 35) and prior consultation (Article 36), in particular in connection with the use of the drivers' live location. Work beyond the usual provision of information may be subject to a fee; the Processor will give advance notice of this.

16. Termination of the agreement: deletion or return

16.1. When the legal relationship ends, the Processor will, at the Controller's choice, return (export) and/or delete the personal data (GDPR Article 28(3)(g)).

16.2. Return: during the 30 days following termination, the Controller's owner or admin may export data on the interface, or may request a full export (CSV and JSON, with the photos and signatures as files).

16.3. Deletion: thereafter, the Processor will permanently delete all Customer Data from the database and the file storage. Short-lived data cease to exist when they expire (live location 10 minutes, the address lookup cache, which does not refer to the company, 30 days), and the application log within 7 days. The data disappear from backups within the D1 point-in-time recovery period, within 30 days at most; the backup taken before deletion is kept for at most 30 days and then deleted.

16.4. Deletion does not apply to data that Union or Member State law requires to be retained.

16.5. On request, the Processor will confirm the deletion in writing.

16.6. User accounts fall within the Processor's own processing as a controller (Privacy Notice). Accounts that are members only of this Controller are deleted together with the company data; accounts that are also members of another company are retained.

17. Audits

17.1. The Processor makes available to the Controller all information necessary to demonstrate compliance with this agreement: this document, the description of the security measures, the list of sub-processors and the independent certifications of the sub-processors (e.g. ISO/IEC 27001, SOC 2).

17.2. The Controller, or an auditor appointed by it who is bound by confidentiality and is not a competitor, may audit the Processor at most once a year (and additionally after a personal data breach), with at least 30 days' prior notice, during working hours, while protecting the data of other customers and the security of the system. The costs of the audit are borne by the Controller.

17.3. On-site audits are not possible at the data centres of the sub-processors (Cloudflare, Google); there, the certifications referred to in clause 17.1 apply.

18. Liability

18.1. Towards data subjects, the parties are liable in accordance with Article 82 of the GDPR.

18.2. As between the parties, the liability provisions of the Terms apply; liability for breach of data protection obligations is also subject to the general cap in the Terms.

19. Final provisions

19.1. The Processor may amend this agreement in accordance with the rules on amending the Terms; it may not reduce the level of data protection to the detriment of the Controller.

19.2. If this agreement has to be amended because of a change in legislation or a decision of an authority, the parties will do so in good faith.

19.3. This agreement is governed by Hungarian law; in matters not regulated herein, the GDPR, Act CXII of 2011 on Informational Self-Determination and Freedom of Information (Infotv.) and Act V of 2013 on the Civil Code (Ptk.) apply.

In the case of a signed copy: