Data Processing Addendum

• “Controller” — the Supplier entity that determines the purposes and means of processing Fleet Data.
• “Processor” — Tugboat Supply, which processes Fleet Data on behalf of the Controller.
• “Fleet Data” — personal data relating to Fleet companies, captains, and (pseudonymous) crew members that the Supplier uploads to or generates within its Tugboat Supply tenant.
• “Subprocessor” — a third-party engaged by Tugboat Supply to process Fleet Data on behalf of the Controller.
• “Applicable Law” — U.S. federal and state data protection and privacy laws applicable to the processing of Fleet Data, including the California Consumer Privacy Act (CCPA/CPRA), Virginia CDPA, Colorado CPA, and other state privacy statutes as enacted.

The Supplier warrants and undertakes that:

• It has a lawful basis under Applicable Law for providing Fleet Data to Tugboat Supply for processing.
• It has provided appropriate notice to its Fleet customers, captains, and crew that their data is processed by Tugboat Supply as a service provider.
• It will not instruct Tugboat Supply to process Fleet Data in a manner that violates Applicable Law.
• It will promptly notify Tugboat Supply if it receives a data subject rights request relating to Fleet Data so Tugboat Supply can assist in fulfilling it within required timeframes.
• It will not onboard individual crew members’ personal information (names, SSNs, personal email addresses) into the platform; crew are to be represented solely by pseudonymous PINs.

Tugboat Supply undertakes to:

• Process only on instructions. Process Fleet Data only on documented instructions from the Supplier, except where required to do so by Applicable Law.
• Maintain confidentiality. Ensure that personnel authorized to process Fleet Data are bound by confidentiality obligations.
• Implement security measures. Maintain appropriate technical and organizational measures, including per-tenant data isolation, encryption in transit and at rest, and access controls, to protect Fleet Data against unauthorized access, disclosure, or loss.
• Subprocessor engagement. Engage Subprocessors only under written agreements imposing equivalent data protection obligations. The current list of Subprocessors is available at /legal#subprocessors and will be updated with reasonable notice before engaging new Subprocessors.
• Data subject rights assistance. Assist the Supplier in responding to Fleet Data subject rights requests (access, deletion, correction, portability) to the extent technically feasible within the platform.
• Breach notification. Notify the Supplier without undue delay and in any event within 72 hours of becoming aware of a personal data breach affecting Fleet Data. Notification will be sent to the Supplier’s account administrator email.
• Deletion or return. Upon termination of the Supplier’s subscription, make Fleet Data available for export for 30 days, then delete or anonymize it in accordance with the retention schedule, unless retention is required by Applicable Law.
• Audit rights. Provide the Supplier with information reasonably necessary to demonstrate compliance with this DPA, and permit audits (which may be conducted by an independent third party bound by confidentiality) upon reasonable written notice and no more than once per calendar year.
• No sale of Fleet Data. Not sell, rent, or otherwise commercially exploit Fleet Data. Not use Fleet Data for Tugboat Supply’s own commercial purposes outside of providing the platform services.

Each Supplier’s Fleet Data is stored and processed within a logically isolated tenant. Isolation is enforced at the data model level through the fleet_suppliers association model, not merely by application-layer access controls. Specifically:

• No Supplier can query, view, or modify another Supplier’s Fleet Data.
• Shared infrastructure components (databases, object storage, queues) are partitioned by tenant identifier with query-level row security policies.
• Platform administrators who have cross-tenant access are subject to enhanced authentication, logging of all data access, and confidentiality obligations.

Tugboat Supply processes all Fleet Data within the United States. We do not transfer Fleet Data to any country or territory outside the United States and do not engage Subprocessors located outside the United States for Fleet Data processing. This DPA does not include Standard Contractual Clauses or other cross-border transfer mechanisms because no such transfers occur.

To the extent that Fleet Data constitutes “personal information” under the California Consumer Privacy Act, Tugboat Supply processes such data as a “service provider” as defined by the CCPA. Tugboat Supply:

• Will not retain, use, or disclose Fleet Data for any purpose other than performing the platform services specified in the Terms of Use and this DPA.
• Will not retain, use, or disclose Fleet Data for a commercial purpose other than providing those services.
• Will not combine Fleet Data received from a Supplier with personal information received from other sources except as permitted under CCPA regulations.
• Certifies that it understands the restrictions set forth in this Section and will comply with them.

In the event of a conflict between this DPA and the Terms of Use, this DPA prevails with respect to the processing of Fleet Data. In the event of a conflict between this DPA and any applicable Order Form, the Order Form prevails to the extent it provides greater protection for Fleet Data subjects.

Questions about this DPA or to exercise rights under it should be directed to legal@tugboatsupply.com.