Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between Freyt ("Processor", "we") and the customer using the Service ("Controller", "you"), and governs Freyt's processing of personal data on your behalf in connection with the Service. It supplements our Terms of Service and Privacy Policy. Where this DPA conflicts with the Terms of Service on data-processing matters, this DPA controls. By using the Service to submit documents containing personal data, you agree to this DPA; where you require a countersigned copy for your own vendor-review process, see Section 13.

1. Scope and roles

For personal data contained in documents you upload or forward to the Service (for example, names, contact details, and other information appearing on rate confirmations or bills of lading), you act as the data controller and Freyt acts as your data processor, processing that data solely to provide the Service — extracting the fields you request and returning them to you or a destination you configure. Freyt does not determine the purposes or means of processing personal data within Customer Data beyond what is necessary to provide the Service.

2. Subject matter and duration

The subject matter of processing is the automated extraction of shipment data from documents you submit to the Service. Processing continues for as long as your account remains active, and thereafter only as necessary to comply with the retention periods described in Section 7 of our Privacy Policy.

3. Nature and purpose of processing

• Receiving documents you upload or forward for extraction;
• Running extraction, including via third-party AI sub-processors (Section 6);
• Returning structured data to you as exports, dashboard records, or TMS-formatted output;
• Retaining records for the duration of your plan's history window;
• Providing customer support relating to the above.

4. Categories of data subjects

Typically your employees, and the carrier contacts, shippers, and consignees named in the documents you submit for processing.

5. Categories of personal data

Names, business contact details (email, phone), and business addresses appearing on rate confirmations, bills of lading, and related shipment documents. Freyt does not intentionally process special categories of personal data (such as health or biometric data) and asks that you avoid including such data in documents submitted to the Service. If special-category data is submitted despite this, Freyt will apply the same security measures described in Section 7 to it.

6. Sub-processors

You authorize Freyt to engage the sub-processors on its current sub-processor list (available on request), which includes cloud infrastructure providers, third-party AI providers used for document extraction, and payment processors. Freyt imposes data protection obligations on each sub-processor that are no less protective than those in this DPA, and remains responsible for each sub-processor's performance as if performed directly by Freyt. Freyt will provide reasonable advance notice of any new sub-processor or material change to the list, and you may object on reasonable data-protection grounds by contacting legal@freyt.space within 14 days of notice; if the parties cannot resolve the objection, you may terminate the affected portion of the Service as your exclusive remedy.

7. Security measures

Freyt maintains technical and organizational measures appropriate to the risk presented by the processing, including: encryption of data in transit (TLS 1.2 or higher) and at rest (AES-256); role-based access controls restricting personal data to employees on a need-only basis; logging of administrative access; regular vulnerability assessments; and a documented incident-response process. Further detail is available on our security page.

8. International transfers

Where personal data is transferred outside the EEA, UK, or Switzerland, Freyt relies on the Standard Contractual Clauses (or the UK International Data Transfer Addendum, as applicable) with the relevant sub-processor, or another valid transfer mechanism recognized under applicable law, to ensure an adequate level of protection.

9. Assistance with data subject requests

Taking into account the nature of the processing, Freyt will provide reasonable assistance to help you respond to data subject requests (access, correction, deletion, portability, and objection) and to fulfil your obligations relating to data protection impact assessments and consultations with supervisory authorities, to the extent required by applicable law and to the extent you cannot reasonably fulfil the request without Freyt's assistance.

10. Personal data breach notification

Freyt will notify you without undue delay, and in any event within 72 hours where required by applicable law, after becoming aware of a confirmed personal data breach affecting your data, and will provide information reasonably available to it necessary for you to meet your own notification obligations to regulators or affected individuals.

11. Deletion and return of data

On termination or expiration of the Service, Freyt will, at your election, delete or make available for export the personal data processed on your behalf, in accordance with the retention and export terms in our Privacy Policy and Terms of Service, except to the extent applicable law requires continued retention.

12. Audit rights

Freyt will make available information reasonably necessary to demonstrate compliance with this DPA, including relevant security documentation, and will permit and contribute to audits, including inspections, conducted by you or an independent auditor you designate, subject to reasonable advance notice, reasonable frequency (no more than once per 12-month period absent a security incident), and the auditor's written confidentiality obligations. You are responsible for the reasonable costs of an audit you initiate, unless it identifies a material non-compliance by Freyt.

13. Requesting a signed copy

This page constitutes Freyt's standard DPA terms and applies automatically to all customers processing personal data through the Service. If you require an executed, counter-signed copy for your own vendor-review process, email legal@freyt.spacewith the subject line "DPA Request"; we will return a signed copy, typically within 3 business days.

14. Liability

Each party's liability arising out of or related to this DPA, whether in contract, tort, or otherwise, is subject to the limitations of liability set out in Section 13 of our Terms of Service, which apply to this DPA as if fully restated here.

15. Contact

Questions about this DPA and signed-copy requests: legal@freyt.space · Security incidents: security@freyt.space