Data Processing Addendum

Scope and roles

This Data Processing Addendum (DPA) forms part of the Terms of Service or master subscription agreement between ATAHSKIA BUSINESS SOLUTIONS PRIVATE LIMITED and the Customer. It applies when ATAHSKIA processes personal data contained in customer content: D&D invoices, carrier and terminal correspondence, EDI 315 and 322 messages, gate and appointment records, dispute packets and the contact details of the people named in them.

For that personal data, the Customer is the controller (a Data Fiduciary under the DPDP Act, and a business under the CCPA) and ATAHSKIA is the processor (a Data Processor under the DPDP Act, and a service provider under the CCPA). Where the Customer is itself a processor for its own clients, as an NVOCC or forwarder may be, ATAHSKIA acts as its subprocessor.

Processing details

The subject matter, nature and purpose of processing is the provision of the ATAHSKIA platform: auditing invoices against 46 CFR Part 541, reconciling milestones, generating dispute and charge complaint materials, delivering deadline notifications and maintaining audit history. Processing lasts for the subscription term plus the deletion periods in section 10.

• Data subjects: Customer employees and users; billing contacts at ocean carriers, NVOCCs and marine terminal operators; drayage dispatchers and drivers named in gate records; customs brokers and consignee contacts.
• Categories of personal data: names, business email addresses, phone numbers, job titles, user IDs, IP addresses, driver or truck identifiers appearing in gate transactions, and signatures on correspondence.
• Special categories: none are required, and Customer agrees not to upload them.

Processor obligations

ATAHSKIA processes personal data only on the Customer's documented instructions, which consist of this DPA, the agreement and the Customer's configuration of the platform. We will tell the Customer promptly if we believe an instruction infringes applicable data protection law.

As a service provider under the CCPA and similar US state laws, we will not sell or share the personal data, retain, use or disclose it outside the direct business relationship or for any purpose other than the business purposes in the agreement, or combine it with personal data we receive from other sources except as those laws permit.

Confidentiality of personnel

Everyone at ATAHSKIA authorised to process customer personal data is bound by written confidentiality obligations, completes security and privacy training at onboarding and annually, and receives access only on a least-privilege basis tied to their role. Production access is granted through SSO with MFA and time-limited role elevation, and is logged.

Security measures

ATAHSKIA maintains the technical and organisational measures described in its SOC 2 Type II report, which the Customer may request under NDA through /security/trust-center.

• Encryption: AES-256 at rest for databases, object storage and backups; TLS 1.3 in transit.
• Tenant isolation: per-tenant data partitioning with row-level access enforcement.
• Identity: SAML SSO, MFA, role-based access control for customer users.
• Monitoring: centralised logging, intrusion detection and 24x7 alerting on production infrastructure.
• Resilience: hosting in AWS us-east-1 with failover to us-west-2, daily encrypted backups and tested restore procedures.
• Assurance: annual third-party penetration testing and continuous vulnerability scanning.

Subprocessors

The Customer gives general authorisation for ATAHSKIA to engage the subprocessors listed at /legal/subprocessors. We impose data protection obligations on each subprocessor that are no less protective than those in this DPA, and we remain responsible for their performance.

We will give at least 30 days' notice of a new subprocessor by updating the list and emailing customers who subscribe to notifications. The Customer may object on reasonable data protection grounds within that period; if we cannot address the objection, the Customer may terminate the affected service and receive a refund of prepaid fees for the remaining term.

International transfers

Customer content is hosted in the United States (AWS us-east-1 and us-west-2) and accessed by ATAHSKIA personnel in India for support and engineering. Transfers of personal data subject to the GDPR are governed by the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor) or Module Three (processor to processor) as applicable, which are incorporated by reference. Transfers subject to the UK GDPR use the UK International Data Transfer Addendum.

Transfers of personal data subject to the DPDP Act will comply with any country restrictions notified by the Central Government under Section 16 of that Act.

Data subject requests and assistance

The platform lets Customer administrators export, correct and delete contact data within their tenant. If ATAHSKIA receives a request directly from a data subject concerning customer content, we will redirect it to the Customer and will not respond except to confirm the redirection, unless the law requires otherwise.

We will provide reasonable assistance with data protection impact assessments, prior consultations with supervisory authorities, and responses to regulators, to the extent the Customer cannot meet these obligations using the platform's own features.

Personal data breach notification

ATAHSKIA will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting customer content. The notice will describe the nature of the breach, the categories and approximate volume of data affected, likely consequences, and the measures taken or proposed, and will be updated as facts become available.

We will cooperate with the Customer's own notification duties, including intimation to the Data Protection Board of India under the DPDP Act and notifications under the GDPR and US state breach notification laws.

Return, deletion and audits

On termination, the Customer may export all customer content for 30 days. ATAHSKIA then deletes customer content from production systems within 30 days and from encrypted backups within a further 35 days, except where retention is required by law, and will certify deletion on request.

ATAHSKIA will make available its current SOC 2 Type II report and responses to reasonable security questionnaires to demonstrate compliance with this DPA. Where those materials are insufficient, or a regulator requires it, the Customer may conduct an audit once every 12 months on 30 days' notice, during business hours, at its own cost, and subject to confidentiality terms.