LastFolk — Data Processing Agreement (DPA)

• Data Protection Laws — all laws applicable to the processing of personal data under this DPA, including the EU General Data Protection Regulation (EU) 2016/679 ("EU GDPR"), the UK GDPR and Data Protection Act 2018, the California Consumer Privacy Act as amended ("CCPA/CPRA"), the Brazilian LGPD, and other applicable privacy laws.
• Controller, Processor, Data Subject, Personal Data, Processing, Personal Data Breach — as defined in the EU GDPR.
• End Customer Data — personal data relating to a Merchant's End Customers that LastFolk processes to provide the Service.
• Fleet Personnel Data — personal data relating to members of the Merchant's own delivery fleet (the drivers the Merchant invites to the LastFolk Driver app) that LastFolk processes to provide the Service.
• Subprocessor — any third party engaged by LastFolk to process personal data on the Merchant's behalf.
• Standard Contractual Clauses (SCCs) — the clauses annexed to European Commission Implementing Decision (EU) 2021/914.
• UK IDTA — the UK International Data Transfer Addendum issued by the UK Information Commissioner.

Terms not defined here have the meaning given in the Agreement.

2.1 As between the parties, the Merchant is the Controller and LastFolk is the Processor of End Customer Data and Fleet Personnel Data processed to provide the Service. LastFolk may act as an independent controller for its own operational purposes (security, billing, product operation, and the accounts, sign-in, and phone notifications of the Merchant's fleet members), which are governed by the LastFolk Privacy Policy, not this DPA.

2.2 This DPA applies to LastFolk's processing of Personal Data on the Merchant's behalf for the duration of the Agreement. The subject matter, nature, purpose, duration, types of Personal Data, and categories of Data Subjects are described in Annex I.

3.1 LastFolk will process Personal Data only on the Merchant's documented instructions, including as set out in the Agreement, this DPA, and the Merchant's use of the Service, unless required to process by applicable law (in which case LastFolk will, where legally permitted, inform the Merchant beforehand).

3.2 LastFolk will inform the Merchant if, in its opinion, an instruction infringes Data Protection Laws.

3.3 The Merchant is responsible for ensuring it has a lawful basis and has provided all required notices and, where necessary, obtained consents to have End Customer Data processed through the Service and shared with Courier Partners, and, where it runs its own delivery fleet through the Service, to have Fleet Personnel Data processed through the Service.

LastFolk ensures that personnel authorized to process Personal Data are bound by a duty of confidentiality and are granted access on a least-privilege, need-to-know basis.

5.1 LastFolk implements appropriate technical and organizational measures to protect Personal Data against a Personal Data Breach, taking into account the state of the art, costs, and the risks to Data Subjects, in accordance with Article 32 of the EU GDPR. A summary of these measures is set out in Annex II.

5.2 Current measures include encryption of Personal Data in transit (TLS/HTTPS) and at rest, role-based access controls, least-privilege practices, logging and monitoring, and secure development practices.

6.1 The Merchant grants LastFolk general authorization to engage Subprocessors to process Personal Data, provided LastFolk: (a) enters into a written agreement imposing data-protection obligations no less protective than this DPA; and (b) remains liable to the Merchant for each Subprocessor's performance.

6.2 The current categories of Subprocessors are: third-party courier networks; payment processor; cloud hosting and infrastructure; address and mapping services (Google); and analytics, communications, and error-monitoring providers. Where the Merchant plans routes with several stops, the address and mapping services also put the stops in order (route optimization). Where the Merchant imports a file of deliveries, an AI service (Google, through the paid Gemini API or Vertex AI) recognizes which column holds what; it receives only the file's column headings and at most five of its rows, with the personal data in them masked. A current list of specific Subprocessors is available on request via contact@lastfolk.com.

6.3 LastFolk will give the Merchant at least thirty (30) days' advance notice of any intended addition or replacement of a Subprocessor. The Merchant may object on reasonable data-protection grounds within that period; if the parties cannot resolve the objection, the Merchant may terminate the affected part of the Service.

7.1 Data Subject requests. Taking into account the nature of the processing, LastFolk will assist the Merchant by appropriate technical and organizational measures, insofar as possible, to respond to Data Subject requests to exercise their rights. If LastFolk receives a request directly, it will not respond except to acknowledge and direct the Data Subject to the Merchant, unless legally required otherwise, and will promptly notify the Merchant.

7.2 Security, breach, and DPIAs. LastFolk will assist the Merchant in ensuring compliance with its obligations regarding security of processing, Personal Data Breach notification, data protection impact assessments, and prior consultation, taking into account the information available to LastFolk.

LastFolk will notify the Merchant without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a Personal Data Breach affecting the Merchant's Personal Data, and will provide information reasonably available to enable the Merchant to meet its own notification obligations (including the 72-hour supervisory-authority deadline under the EU/UK GDPR).

On termination of the Agreement, LastFolk will, at the Merchant's choice, delete or return all Personal Data processed on the Merchant's behalf and delete existing copies, unless applicable law requires continued storage. Absent instruction, LastFolk will delete or anonymize the Personal Data within ninety (90) days of termination, subject to legal retention requirements.

LastFolk will make available to the Merchant information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by the Merchant or an auditor it mandates. The Merchant may exercise audit rights no more than once per year (absent a Personal Data Breach or regulatory requirement), on reasonable prior notice, during business hours, subject to confidentiality, and LastFolk may satisfy audit requests by providing relevant third-party audit reports or certifications where available.

11.1 Where LastFolk processes Personal Data originating in the EEA, the United Kingdom, or Switzerland in a country without an adequacy decision, the parties enter into the applicable SCCs, which are incorporated by reference:

• Module Two (Controller-to-Processor) applies where the Merchant is a controller and LastFolk is a processor;
• Module Three (Processor-to-Processor) applies where the Merchant is itself a processor.

11.2 For transfers of UK Personal Data, the UK IDTA (or the UK Addendum to the EU SCCs) applies. For Swiss data, the SCCs apply with Swiss-specific adaptations.

11.3 Where required, the parties will complete a transfer impact assessment and apply supplementary measures. The docking clause and the parties' details are completed in Annex III.

Each party's liability under this DPA is subject to the limitations and exclusions of liability set out in the Agreement. Nothing in this DPA limits either party's liability to Data Subjects or supervisory authorities to the extent such liability cannot be limited under Data Protection Laws.

This DPA takes effect when the Merchant accepts the Agreement and continues until LastFolk has ceased all processing of Personal Data on the Merchant's behalf and completed deletion or return under Section 9.

• Subject matter: provision of the LastFolk delivery-operations platform (rating, dispatch, tracking, reconciliation), including, where the Merchant uses them, the delivery chat and the LastFolk Driver app for the Merchant's own delivery fleet.
• Duration: the term of the Agreement, plus any legally required retention period.
• Nature and purpose: processing End Customer Data to rate, dispatch, track, and reconcile local deliveries on the Merchant's behalf, and to provide related support; sending End Customers service notices about their delivery on the Merchant's behalf (for example, that it is on its way, has been delivered, or was cancelled), never marketing; operating the delivery chat between the End Customer, the Merchant, and the assigned driver; and, where the Merchant runs its own delivery fleet through the Service, processing Fleet Personnel Data to invite drivers, offer and assign deliveries, follow each delivery while it is under way, and record its proof of delivery.
• Types of Personal Data: recipient and sender names; delivery and pickup addresses; contact phone numbers; End Customer email addresses; package attributes (size/weight); order identifiers; delivery status and tracking events; the messages written in the delivery chat (in the conversation with the driver, phone numbers, email addresses, and the delivery's verification code typed in the text are hidden); for members of the Merchant's delivery fleet, their name (and legal name, if the Merchant records it), email address or phone number, relationship to the Merchant, vehicle type, profile photo, the time the Driver app last connected, position during a delivery, pickup and proof-of-delivery photos and where they were taken, delivery events, chat messages, and notes on a delivery where the driver leaves one; and, for Merchant users, account and contact details and billing identifiers. No special categories of data are intended to be processed.
• Categories of Data Subjects: the Merchant's End Customers; the Merchant's authorized users; members of the Merchant's own delivery fleet (the drivers the Merchant invites to the LastFolk Driver app); and, where applicable, senders/pickup contacts.
• What End Customers see of the Merchant's fleet: on the tracking page of their own delivery, while a driver is assigned to it, the driver's first name; the driver's phone number only if the driver has agreed; the driver's profile photo only if the driver has uploaded one in the app (by uploading it, the driver agrees that it can be seen); the driver's latest position only between pickup and delivery; and the proof-of-delivery photo for 24 hours after delivery.
• Retention: delivery chat messages are deleted 30 days after they are written; drivers' position points are deleted 72 hours after they are recorded; the personal details of a driver removed from the Merchant's fleet are erased 90 days after removal; other Personal Data is kept for the Duration above.

Encryption in transit (TLS/HTTPS) and at rest; role-based and least-privilege access controls; authentication controls; logging, monitoring, and alerting; secure software development and change management; segregation of environments; backup and recovery; vendor/subprocessor due diligence; and incident-response procedures. Measures are reviewed and updated periodically.

• Data exporter: the Merchant (name and address as provided at sign-up).
• Data importer: Pictorica Devs LLC (LastFolk), 30 North Gould Street, Sheridan, Wyoming, United States.
• Competent supervisory authority: as determined under Clause 13 of the SCCs / the relevant Data Protection Law.
• Signature / acceptance: entering into the Agreement and this DPA constitutes signature of the applicable SCC modules and the UK IDTA.

Pictorica Devs LLC (LastFolk) — Data Protection Officer / privacy contact: contact@lastfolk.com — 30 North Gould Street, Sheridan, Wyoming, United States.