Data Processing Addendum
This Addendum governs FleetHook’s processing of personal data on the Customer’s behalf and reflects the processor duties of the Texas Data Privacy and Security Act (Tex. Bus. & Com. Code ch. 541, including §541.104). If it conflicts with the Terms of Use regarding processing of Customer Personal Data, this Addendum controls. Capitalized terms not defined here have the meanings given in the TDPSA.
1. Roles
For the operational records the Customer enters into its FleetHook account — tow records, customer and vehicle details, photographs and signatures, driver and staff records, invoices — the Customer is the Controller and FleetHook is the Processor. FleetHook processes that data only on the Customer's documented instructions, which include the instructions expressed through the Customer's ordinary use of the product's features. FleetHook is an independent Controller of its own account-registration, billing, security and website data, which is governed by the Privacy Policy rather than this Addendum.
2. Scope of processing
Subject matter: provision of the FleetHook towing dispatch, tracking, impound, invoicing and record-keeping service. Duration: for the term of the account. Nature and purpose: hosting, storing, organising, transmitting, displaying and otherwise processing the data as needed to provide the service. Categories of data subjects: the Customer's owners, dispatchers, billing staff and drivers, and the customers and vehicle owners recorded on tows. Categories of personal data: as described in the Privacy Policy, which may include precise geolocation and driver-licence information.
3. FleetHook's obligations as Processor
- Instructions. Process personal data only on the Customer's documented instructions, including for transfers, unless required by law — in which case, where permitted, we will tell the Customer first.
- Confidentiality. Ensure that personnel authorised to process the data are bound by a duty of confidentiality.
- Security. Maintain reasonable administrative, technical and physical safeguards appropriate to the data, including the tenant isolation, encryption in transit, private file storage, hashed credentials and audit logging described in the Privacy Policy.
- Assistance with consumer rights. Taking into account the nature of the processing, provide reasonable assistance so the Customer can respond to consumer requests to access, correct, delete or obtain a portable copy of personal data — including through features in the product and, where needed, by responding to the Customer's reasonable requests.
- Assistance with security and assessments. Provide information reasonably necessary for the Customer to meet its own obligations, including cooperating with reasonable data-protection assessments.
- Breach notification. Notify the Customer without undue delay after becoming aware of a breach of security involving the Customer's personal data, with the information the Customer reasonably needs to meet its own notification duties (including under Tex. Bus. & Com. Code ch. 521).
- Deletion or return. At the Customer's direction, and on termination, delete or return the personal data as described in the Privacy Policy (within 90 days of a closure request), except where retention is required by law.
- Demonstrating compliance. Make available information reasonably necessary to demonstrate compliance with this Addendum and allow reasonable assessments by the Customer or its qualified independent auditor. FleetHook may satisfy an assessment request by providing a current independent audit report, certification, or security questionnaire where reasonably sufficient. Unless a security incident, regulator, or applicable law reasonably requires more, an on-site or records audit may occur no more than once in any 12-month period, on at least 30 days’ written notice, during normal business hours, without access to another customer’s data, and subject to confidentiality and security requirements. The Customer bears its audit costs, and reimburses FleetHook’s reasonable costs for assistance beyond the information FleetHook ordinarily makes available.
4. Sub-processors
The Customer authorizes FleetHook to use the sub-processors listed in the Privacy Policy, currently Supabase, Vercel, Stripe, Apple, Google, MapTiler, OpenStreetMap Nominatim, and NHTSA vPIC. FleetHook will impose data-protection obligations appropriate to each sub-processor’s services and remains responsible for its processor obligations. FleetHook will update the list when a sub-processor changes and will give account owners advance email notice of a material new sub-processor where reasonably practicable. The Customer may object on reasonable data-protection grounds within 15 days after notice. The parties will work in good faith toward a commercially reasonable solution. If none is available, either party may terminate the affected service without penalty before that sub-processor begins processing the Customer’s personal data.
5. No sale; limited use
FleetHook does not sell the Customer's personal data, does not process it for targeted advertising, does not combine it with data from other sources except as needed to provide the service or as the Customer instructs, and does not use it for its own purposes. FleetHook does not use the Customer's personal data to train any general-purpose model.
6. International and out-of-state processing
Customer Personal Data is stored in the United States in Supabase’s US East (Northern Virginia) region, us-east-1, and automated backups are held in the same region, as described in the Privacy Policy. By using FleetHook, the Customer instructs and authorizes that storage and the transfers required to provide the service.
7. Liability
Each party’s liability arising from this Addendum is subject to the exclusions and limitations of liability in the Terms of Use, except to the extent applicable law does not permit a particular exclusion or limitation.
8. Contact
Data-processing questions and instructions: support@fleethook.com. FleetHook is operated by Innovations App Lab LLC, a Texas limited liability company.