Data processing addendum

Ask through the contact page — choose “Sales or pricing question” and put “DPA” in the message, with the legal name of your business and the name and email of the person who will sign. We send it back for electronic signature.

The signed addendum is available on every plan. It sits above these web terms in order of precedence, so it wins if the two ever conflict.

You are the business (controller); Porch Route is your service provider (processor). The processing covered:

• Subject matter and purpose: planning delivery routes, sending them to drivers, notifying recipients, recording proof and outcomes, and returning them to your systems.
• Duration: the life of your account, plus the deletion window that follows.
• People: your delivery recipients, your drivers and your staff.
• Data: names, delivery addresses, phone numbers and email addresses, delivery instructions and order contents, driver GPS positions while a route runs, proof photos and signatures, ratings and comments, message logs.

1. Documented instructions only. We process personal data to provide the service as you configure it, and tell you if we think an instruction is unlawful.
2. Confidentiality. Anyone who works on the service is bound to keep your data confidential.
3. Security measures as described on the security page: server-side tenant isolation, row-level security, encryption in transit, private proof storage with expiring links, hashed credentials, role-based access and logging.
4. Subprocessors. Only those on the subprocessors page, under written terms at least as protective as the DPA, with advance notice of changes and a right to object.
5. Help with requests. We help you answer access, correction, deletion and opt-out requests from your recipients and drivers, and with assessments the law asks you to do.
6. Breach notice. If personal data we hold for you is breached, we tell you without undue delay and no later than [breach notification deadline], with what we know and what we are doing.
7. Return and deletion. You can export your data at any time; after the agreement ends we delete it within [deletion window], except backup copies that expire on their own schedule.
8. Evidence. We provide the information reasonably needed to show we meet these commitments, and allow assessments on reasonable notice.

As a service provider under the California Consumer Privacy Act (and the equivalent role under other state laws), Porch Route:

• does not sell or share personal information;
• processes it only for the business purposes listed above, and not outside the direct relationship with you;
• does not combine it with personal information received from anyone else, except as the law permits;
• complies with the CCPA and provides the same level of privacy protection it requires of you;
• tells you if it can no longer meet these obligations, and lets you take reasonable steps to stop and remediate unauthorised use;
• helps with consumer requests, and keeps the duties of confidentiality, deletion, compliance information, assessment and written subcontractor terms that state processor laws (for example Virginia’s) require.

Cross-border transfers

Porch Route serves US businesses today. If we accept customers in the EU or UK, the DPA will add the transfer mechanism those laws require first.

• Annex 1 — processing details (the scope above, completed for your business).
• Annex 2 — technical and organisational measures (the security page, in contractual form).
• Annex 3 — the subprocessor list as of signing.