Data Processing Agreement (DPA)

1. Object and Duration of Processing

This Data Processing Agreement (hereinafter, "DPA") governs the conditions under which BlueCMR S.L.U. (hereinafter, "the Processor") processes personal data on behalf of the Client (hereinafter, "the Controller") in the context of providing the BlueCMR platform services.

The processing of personal data shall have the same duration as the contractual relationship between the Controller and the Processor. Once the relationship has ended, the Processor shall delete or return all personal data in accordance with the Controller's instructions, unless there is a legal obligation to retain the data.

This DPA supplements the General Terms and Conditions of Use (Terms of Service) of BlueCMR and is entered into in accordance with Article 28 of Regulation (EU) 2016/679 (GDPR).

2. Nature and Purpose of Processing

The Processor shall process personal data solely for the purpose of providing the services contracted by the Controller through the BlueCMR platform, which include:

• Management of digital transport documents (eCMR, consignment notes, DCA and other transport documents).
• Processing of electronic signatures on transport documents.
• Storage and retrieval of transport documents and their associated data.
• Operation as a future certified eFTI platform in accordance with Regulation (EU) 2020/1056 on electronic freight transport information.

The Processor shall not process personal data for purposes other than those indicated in this DPA, unless expressly instructed by the Controller or when required by a legal obligation.

3. Types of Personal Data Processed

In the context of providing the services, the Processor may process the following types of personal data:

• Full name of drivers, recipients, senders and signatories of transport documents.
• Identity document (national ID/tax ID/passport) of parties involved in transport documents.
• Signature (electronic or digitized) of drivers, recipients and signatories.
• Contact data (phone, email, address) of drivers, recipients and signatories.

The electronic signature processing includes biometric data of the handwritten signature (dynamic stroke data), which is encrypted end-to-end and processed solely as evidence of the signature, with the signatory's explicit consent. Beyond that, the Processor shall not process special categories of personal data (sensitive data) unless the Controller includes them in transport documents under their sole responsibility.

4. Categories of Data Subjects

The personal data processed corresponds to the following categories of data subjects:

• Drivers: natural persons responsible for the transport of goods.
• Recipients: natural persons who receive the transported goods.
• Senders: natural persons who dispatch the goods.
• Document signatories: any natural person who signs or participates in a transport document managed through the platform.

5. Processor Obligations (BlueCMR)

The Processor undertakes to:

• Process personal data only in accordance with the Controller's documented instructions, including transfers of data to third countries or international organizations, unless required to do so by Union or Member State law.
• Ensure that persons authorized to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
• Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including encryption of data, the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems, and the ability to restore the availability and access to personal data in a timely manner in the event of an incident.
• Assist the Controller, by appropriate technical and organizational measures and taking into account the nature of the processing, in fulfilling its obligation to respond to requests for the exercise of data subjects' rights (Articles 15 to 22 GDPR), forwarding to the Controller without undue delay any such request received directly.
• Notify the Controller without undue delay, and in any case within 72 hours at the latest, of any personal data breach of which it becomes aware.
• Assist the Controller in fulfilling its obligations regarding the security of processing, notification of data breaches, data protection impact assessments and prior consultations with the supervisory authority.
• At the choice of the Controller, delete or return all personal data after the end of the provision of services, and delete existing copies unless Union or Member State law requires storage of the data.

6. Controller Rights (Client)

The Controller has the right to:

• Conduct audits and inspections to verify the Processor's compliance with the obligations under this DPA and the GDPR. The Processor shall make available to the Controller all information necessary to demonstrate compliance with its obligations.
• Provide documented instructions to the Processor regarding the processing of personal data. The Processor shall immediately inform the Controller if, in its opinion, an instruction infringes the GDPR or other data protection provisions.
• Request the deletion or return of all personal data upon termination of the contractual relationship, in accordance with section 5 of this DPA.

7. Sub-processors

The Controller authorizes the Processor to engage the following sub-processors for the provision of services:

• Amazon Web Services EMEA SARL: Service: Cloud infrastructure (computing, storage and databases). Regions: eu-south-2 (Spain) and eu-west-3 (Paris, France), both in the EU. Safeguard: AWS DPA. AWS complies with the GDPR and holds ISO 27001 and SOC 2 certifications.
• Amazon SES / Amazon SNS (AWS): Service: Transactional email and SMS delivery (notifications, confirmations). Region: eu-west-3 (Paris, France, EU). Safeguard: AWS DPA.
• Signaturit Solutions, S.L.U.: Service: Qualified electronic signature services and, through its IvSign solution, time stamping. Country: Spain (EU). Safeguard: data processing agreement in place.
• Meta Platforms Ireland Ltd. (WhatsApp Business Platform): Service: Delivery of transactional signature request messages (signatory's phone number and access link). Country: Ireland (EU), with possible transfer to Meta Platforms, Inc. (USA) safeguarded under the EU-U.S. Data Privacy Framework and Standard Contractual Clauses.
• Google LLC (Firebase Cloud Messaging): Service: Delivery of push notifications to mobile devices, via Amazon SNS. Country: USA. Safeguard: EU-U.S. Data Privacy Framework.

The Processor shall notify the Controller of the addition or replacement of sub-processors at least 15 days in advance, and the Controller may object to such changes on justified grounds. Sub-processors shall be subject to the same data protection obligations set out in this DPA.

8. Competent Authorities Access (eFTI Regulation)

The Controller acknowledges and accepts that BlueCMR operates as an eFTI platform (current and future certified) in accordance with Regulation (EU) 2020/1056 of the European Parliament and of the Council on electronic freight transport information.

Under said Regulation, transport data stored on the platform, including personal data contained in transport documents (drivers, recipients, signatories), may be accessed by competent authorities during inspections and legal verification processes. Such access constitutes a legal obligation under Regulation (EU) 2020/1056 and applicable national legislation, and is not based on the data subject's consent.

BlueCMR, as an eFTI platform, shall provide competent authorities with immediate and free-of-charge access to transport information in accordance with the eFTI Regulation.

For further details on the economic operator's obligations regarding competent authorities' access, please refer to the eFTI clause contained in the BlueCMR General Terms and Conditions of Use (Terms of Service).

9. Operations Log

The Processor maintains an automated operations log (Operations Log) that records in an immutable and non-repudiable manner each operation performed on transport documents on the platform (creation, editing, signing, reading). This log constitutes a processing of personal data necessary for compliance with legal obligations under Regulation (EU) 2020/1056 (eFTI).

User identities in the Operations Log are pseudonymized for privacy purposes. However, the Processor has a legal obligation to resolve such pseudonymized identities (reveal the actual identity of the user who performed the operation) when a competent authority makes a justified request in the context of an inspection or legal verification.

10. Processing Activity Records from Authority Access

Processing activities of personal data arising from competent authorities' access to transport information stored on the platform shall be recorded in the platform's operation logs in accordance with Regulation (EU) 2020/1056.

Such records shall include, at a minimum, the identification of the authority that accessed the data, the date and time of access, and the data or documents consulted, ensuring traceability and transparency of the processing.