Data processing and retention

The production agreement must identify the parties’ privacy roles. Where the service provider processes customer data on documented instructions, it should use that data only to provide, secure and support TruckBase or to meet applicable law.

Customer records and files are scoped to an organisation. Access is limited by authenticated role and business need. Production safeguards, audit practices, backups, encryption arrangements and subprocessor controls should be documented and reviewed regularly.

Each customer should approve a retention schedule for driver, safety, job, invoice, location, account and support records. Periods may differ because of workplace, transport, tax, insurance, safety, contractual or legal requirements.

TruckBase must not advertise a universal deletion period unless it is implemented and contractually approved. Backup expiry, legal holds and deletion verification should be included in the production schedule.

The service provider should reasonably assist with access, correction, export, deletion and regulatory requests. At closure, data is returned or deleted according to the agreed process, subject to legal holds and required retention.