Version 1.0 Effective from 5 November 2026

This is an English translation provided for convenience. In case of any discrepancy, the Polish version prevails. Wersja polska

Data Processing Agreement

Annex No. 1 to the Booklio Terms of Service

Version 1.0, effective from 5 November 2026.

§ 1. Parties and conclusion

This data processing agreement (the “DPA”) is concluded between the Client as the data controller (the “Controller”) and NORDLOGIS SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, registered office: ul. Starowiejska 16/2, 81-356 Gdynia, entered in the Register of Entrepreneurs of the National Court Register (KRS) under number [KRS number: to be completed], registry court: [registry court: to be completed], NIP 5862378673, REGON [REGON: to be completed], share capital: [share capital: to be completed], e-mail: [Booklio e-mail address: to be completed] as the processor (the “Processor”).
The DPA is concluded together with the Booklio service Agreement upon acceptance of the Terms and forms an integral part of them. Terms defined in the Terms have the same meaning in the DPA. “GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.
Matters not regulated in the DPA are governed by the Terms. In case of conflict concerning the protection of personal data, the DPA prevails.

§ 2. Subject matter, nature and purpose of processing

The Controller entrusts the Processor with processing the personal data contained in the Client Data to the extent and for the purpose necessary to provide the Service in accordance with the Terms.
The nature of processing covers operations performed in an IT system, in particular: collection, recording, organisation, structuring, storage, consultation, retrieval, use, alignment, transmission (including to External Services on the Controller’s instruction), restriction, erasure and destruction.
The purpose of processing is to enable the Controller to conduct its business using the Service, including handling transport and freight forwarding orders, fleets and drivers, invoicing and settlements, correspondence, contacts with business partners and analyses.
The DPA remains in force for the term of the Agreement and for the period after its termination required to export and delete data in accordance with § 9.

§ 3. Categories of data subjects and types of data

Processing may concern the following categories of data subjects: the Controller’s employees, associates and drivers; Users; contact persons, representatives and employees of the Controller’s business partners, clients, carriers and suppliers; natural persons conducting business activity who are the Controller’s business partners; other persons whose data the Controller enters into the Service.
Processing may cover the following types of data:
1. identification and contact data (first name, surname, position, company name, tax identification number, address, telephone number, e-mail address);
2. data from drivers’ documents entered by the Controller (e.g. numbers and expiry dates of driving licences, tachograph cards, medical examinations, qualifications, residence documents) and scans of those documents;
3. location data (GPS position of the device, speed, heading) and trip events reported in the Mobile Apps, photographs of documents and cargo;
4. the content of messages, voice recordings, their transcriptions and translations in conversations held in the Service;
5. data from invoices, bank statements, transfers and settlements (e.g. bank account numbers, amounts, transfer titles);
6. vehicle data linked to persons (e.g. registration numbers, driver assignment);
7. technical data related to the use of the Service by the Controller’s Users to the extent processed on behalf of the Controller.
The Controller does not entrust the Processor with special categories of personal data (Article 9 GDPR) or data relating to criminal convictions (Article 10 GDPR), unless it enters them into the Service at its own responsibility where it is entitled to do so; the Processor then processes them on the terms of the DPA.

§ 4. Obligations of the Processor

The Processor processes personal data only on documented instructions from the Controller. Documented instructions are the Terms, the DPA and the actions performed by the Controller and the Users in the Service, including the configuration of integrations and automatic features. The Processor informs the Controller if, in its opinion, an instruction infringes data protection provisions.
The Processor may also process personal data where required to do so by Union or Polish law; in such a case it informs the Controller of that legal requirement before processing, unless that law prohibits such information.
The Processor ensures that persons authorised to process personal data have committed themselves to confidentiality or are under a statutory obligation of confidentiality.
The Processor applies the technical and organisational measures referred to in Article 32 GDPR appropriate to the risk, in particular: encryption of data in transit (HTTPS/TLS); authentication of Users by password with the option of multi-factor authentication; a system of roles and permissions limiting Users’ access to data; separation of data of individual Clients at application level; storage of selected authentication data (e.g. device keys and access tokens) in hashed or encrypted form; storage of document files outside the server’s public directory; logging of logins and write operations; backups; limiting the access of the Processor’s personnel to the necessary scope.
Taking into account the nature of processing, the Processor assists the Controller by appropriate technical and organisational measures in fulfilling its obligation to respond to requests from data subjects (Chapter III GDPR), in particular by making available in the Service features for searching, exporting, rectifying and erasing data.
Taking into account the nature of processing and the information available, the Processor assists the Controller in ensuring compliance with the obligations under Articles 32–36 GDPR. Assistance going beyond making available the features of the Service and the information held by the Processor is chargeable at the Processor’s rates agreed with the Controller.
The Processor maintains a record of categories of processing activities referred to in Article 30(2) GDPR where that obligation applies to it.

§ 5. Sub-processors

The Controller grants the Processor general authorisation to engage sub-processors to the extent necessary to provide the Service. The Processor imposes on sub-processors data protection obligations corresponding to those under the DPA, in particular through agreements or terms of service containing the commitments required by Article 28 GDPR.

As at the effective date of the DPA, the Processor uses the following categories of sub-processors:

Entity / category	Scope	Place of processing
[hosting provider: to be completed]	hosting of application servers, the database and files, backups	[server location: to be completed]
[SMTP mail provider: to be completed]	sending e-mail messages from the Service	to be completed together with the provider
OpenAI (OpenAI Ireland Ltd and affiliates)	AI Features: reading documents and photographs, transcription and translation of speech, voice assistant, suggestions and proposed content	EEA and the United States
Google (Google Ireland Ltd, Google LLC)	Firebase Cloud Messaging — notifications in the Mobile Apps; Gmail API — handling of mailboxes connected by the Controller; browser notification services	EEA and the United States
Apple (Apple Distribution International Ltd and affiliates)	delivery of notifications to iOS devices (APNs)	EEA and the United States
HERE (HERE Europe B.V.)	maps, routing, address geocoding, road tolls — processing of addresses and coordinates	EEA; the provider may use entities outside the EEA
[invoice PDF rendering service provider: to be completed]	generating PDF prints of invoices from XML files	to be completed together with the entity
Browser notification service providers (Google, Microsoft, Mozilla, Apple)	delivery of browser notifications to office devices; the content of notifications is encrypted	EEA and the United States

Transfers of data to third countries take place only, where applicable, on the basis of a European Commission adequacy decision (including under the EU-U.S. Data Privacy Framework if the provider participates in it) or standard contractual clauses adopted by the European Commission, together with supplementary safeguards where required.
External Services launched by the Controller using its own accounts and agreements (in particular freight exchanges, banking systems, the National e-Invoice System (KSeF), the Speed ERP system, business partner credit assessment services, fuel cards, the Controller’s mailboxes) are not sub-processors of the Processor — data are transferred to those services on the Controller’s instruction, and their providers act under agreements with the Controller or as separate controllers. Public registers and data services (e.g. the VAT taxpayer register, VIES, Statistics Poland, CEPiK, the National Bank of Poland, MET Norway, OpenStreetMap) receive only the data necessary for the query (e.g. tax identification number, VIN, approximate coordinates).
The Processor informs the Controller of intended changes concerning the addition or replacement of a sub-processor by publishing an updated list in the DPA or notifying the Controller electronically at least 14 days in advance. The Controller may raise a reasoned objection within that period. If the Parties do not agree on a solution, the sole consequence of the objection is the Controller’s right to terminate the Agreement with effect on the date the change is introduced.
The Processor is liable to the Controller for the performance of the obligations by a sub-processor in accordance with Article 28(4) GDPR, within the limits set out in § 10.

§ 6. Personal data breaches

The Processor notifies the Controller of a personal data breach concerning the Controller’s data without undue delay, no later than 48 hours after becoming aware of it, at the e-mail address of the Client Administrator.
The notification contains, to the extent the information is available: a description of the nature of the breach, the categories and approximate number of data subjects and records, likely consequences, measures taken or proposed. Information not available at the time of notification is provided in phases.
Notification of the breach to the supervisory authority and communication to data subjects are made by the Controller.

§ 7. Obligations of the Controller

The Controller represents that it is entitled to process the entrusted personal data and to entrust them, has legal grounds for processing and has fulfilled its information obligations towards data subjects, including with respect to location data and recordings.
The Controller is responsible for the scope of data entered into the Service, for the configuration of Users’ permissions and for decisions to transfer data to External Services and recipients indicated in the Service.

§ 8. Inspections and audits

The Processor makes available to the Controller the information necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR, primarily in the form of written answers to the Controller’s questions and documents describing the protection measures applied.
If the information referred to in section 1 proves insufficient, the Controller may carry out an audit or inspection no more often than once per calendar year, after notifying the Processor at least 30 days in advance, on Business Days, in a manner that does not disrupt the Processor’s operations and does not infringe the Processor’s trade secrets or the data of other clients. The auditor must conclude a confidentiality agreement with the Processor.
The costs of the audit are borne by the Controller, including reasonable costs of the working time of the Processor’s personnel at the Processor’s rates. The limitations in section 2 do not apply to an inspection carried out by a supervisory authority or after a data breach attributable to the Processor has been established.

§ 9. End of processing

After the provision of the Service ends, the Controller may export the data within 30 days using the Service’s features. Making the export available constitutes the return of data within the meaning of Article 28(3)(g) GDPR.
After the period referred to in section 1 expires, the Processor deletes the personal data unless Union or Polish law requires their further storage. Data in backups is deleted in the backup overwrite cycle, no later than after [number of days backups are retained: to be completed] days.

§ 10. Liability

The Processor’s liability towards data subjects and authorities is governed by the GDPR, in particular Articles 82 and 83 GDPR.
In the relations between the Parties, the Processor’s liability under the DPA is subject to the limitations and exclusions set out in § 12 of the Terms, including the aggregate liability cap, to the extent permitted by law. The Processor is liable only for damage caused by processing where it has not complied with obligations of the GDPR specifically directed to processors or where it has acted outside or contrary to lawful instructions of the Controller (Article 82(2) GDPR).

§ 11. Final provisions

The DPA is governed by Polish law. The competent court is the court specified in the Terms.
The DPA is amended in the procedure for amending the Terms.
The Polish version of the DPA prevails.