Data Processing Addendum

Version: September 2026

Contents

• Introduction & Definitions
• Data Processing Overview
• 1. Processing of Client Data
• 2. General Obligations of the Parties
• 3. Sub-Pro­cessing & Cross-Border Data Transfers
• 4. Security & Compliance
• 5. Access to Data and Assistance to Controller
• 6. Miscellaneous
• Appendix 1: Description of Processing
• Appendix 2: Sub-Pro­cessors
• Appendix 3: OEM & Third-Party Integrations Data Processing Terms
• Appendix 4: Technical & Organ­iz­a­tional Measures
• Data Access Specification Sheet (under development)

Introduction & Definitions

• This Data Processing Addendum (including its appendices, collectively the DPA) supplements and is subject to the provisions of the agreement and any other terms and conditions binding the Controller and the Processor (collectively, the Parties, and, individually, each Party) in connection with Processor's provision of the WEBFLEET Service and Products to Controller (the Agreement). For the purposes of this DPA, Client (as defined in the Agreement) shall be deemed the Controller, and Webfleet Solutions B.V. shall be deemed the Processor.
• This DPA describes the Parties' obligations with respect to the processing and security of Client Data (defined below), including under applicable privacy, security, and data protection laws. This DPA constitutes an integral part of the Agreement and replaces any terms previously applicable to the processing and security of Client Data.
• Any capitalized term not defined herein shall have the meaning given to it in the Agreement and its schedules. To the extent the language in this DPA conflicts with the Agreement, this DPA shall control. For the purposes of this DPA:
  • Applicable Privacy Law(s) means binding national, state, European Union, or provincial laws or regulations in force concerning privacy, security, or data protection and applicable to the processing of Client Data;
  • Client Data means all (personal) data generated, collected, provided, or otherwise processed by Processor on behalf of and under the instructions of Controller for the provision of the WEBFLEET Service and Products;
  • GDPR collectively means both the United Kingdom's and the European Union's GDPR Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC;
  • Processor Security Incident means an event affecting Processor's security and leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Client Data on systems managed by or otherwise maintained by Processor;
  • Sub-Processor means a third party engaged by Processor to carry out a specific part of the Client Data processing activities necessary for the provision of the WEBFLEET Service and Products;
  • Supervisory Authority means a competent authority that is expressly vested with powers and authority to monitor compliance with and enforce any Applicable Privacy Laws; and
  • The terms personal data, data subject, processing, controller, processor, special categories of personal data, personal data breach, and anonymization as used in this DPA have the meanings given by the Applicable Privacy Law or, absent any such meaning or law, by the GDPR.

Data Processing Overview

This DPA governs the Parties' commitments with respect to the processing of personal data in the WEBFLEET Service and Products. For a comprehensive overview of the WEBFLEET Service and Products, Appendix 1 (Description of Processing) includes information relating to the processing of all categories of Client Data, including non-personal data.

1. Processing of Client Data

1.1. Appointment of Processor. Controller appoints Processor to process Client Data on its behalf and under its documented instructions under the Agreement, this DPA and throughout Controller's deployment, configuration, and use of the WEBFLEET Service and Products. To the extent required by Applicable Privacy Laws, where the Processor processes Client Data that qualifies as personal data, the Controller shall be deemed the controller and the Processor the processor of such personal data.

1.2. Purpose Limitation. The processing of Client Data is granularly detailed in Appendix 1 (Description of Processing), including all the types of personal data involved, as well as the duration and context of such processing in connection with each portion of the WEBFLEET Service and Products. Except as otherwise expressly agreed upon in the Agreement, Processor will only process personal data in the Client Data as described in this DPA as strictly necessary to provide the WEBFLEET Service and Products. The following groups of activities are considered strictly necessary to that end:

1. Enabling and delivering the requested functional capabilities of the WEBFLEET Service and Products as licensed to, configured, and used by Controller and its users;
2. Troubleshooting (preventing, detecting, investigating, mitigating, and repairing problems, including Processor Security Incidents and issues identified in the WEBFLEET Service and Products), providing customer (technical) support, advice on deployment and usability of the WEBFLEET Service and Products; and
3. Keeping the WEBFLEET Service and Products up to date and performant, and enhancing user productivity, reliability, efficacy, quality, and security.

1.3. Anonymization of Client Data. Controller authorizes Processor to anonymize Client Data processed under this DPA with a view to enable its further processing as permitted under the Agreement and Applicable Privacy Law. Anonymized data does not constitute personal data, shall not be deemed Client Data, and is not subject to this DPA. Processor may process anonymized data in the form of System Data, as governed by the Agreement.

1.4. No Automated Decision-­Making. To the extent that Controller's contracted scope for WEBFLEET's Service and Products include automated processing as specified in Appendix 1 (Description of Processing), the Parties hereby acknowledge that Processor (by means of the WEBFLEET's Service and Products or otherwise) is incapable of making decisions that produce legal effects concerning individuals. Controller is solely responsible for interpreting the Client Data generated throughout the use of the WEBFLEET's Service and Products by its authorized users as well as for making and documenting its own independent decisions.

1.5. Engagement of Third Parties. Controller acknowledges and agrees that the processing of Client Data relies on Sub-Pro­cessors providing services that are necessary for the WEBFLEET Service, as set forth in Section 3 below and further detailed in Appendix 2 (Sub-Pro­cessors). Furthermore, and to the extent that Controller elects to connect either (a) Vehicles to the WEBFLEET Service by means of an OEM Onboard Unit; or (b) the WEBFLEET Service and Products to technologies provided by other independent service providers with the intention to establish shared processing of Client Data between Processor and those independent service providers for purposes defined by Controller in agreement with such service providers, then the provisions of Appendix 3 (OEM & Third-Party Integrations Data Processing Terms) will apply.

1.6. This DPA is incorporated by reference into the Agreement and will take effect on the date in which the Parties entered into the Agreement. If an Agreement was already in place upon receipt of this DPA by Controller, then this DPA will take effect as of the date communicated by Processor in its notice to Controller.

2. General Obligations of the Parties

2.1. Controller's Obligations. In addition to its other obligations under the Agreement and this DPA, the Controller shall comply with the Applicable Privacy Laws and:

1. Ensure that the processing of Client Data is lawful and that the processing of personal data is grounded on a valid legal basis under Applicable Privacy Law;
2. Be transparent about the processing of personal data towards data subjects and provide the necessary information about such processing and data subjects rights as required under Applicable Privacy Laws;
3. Ensure the security of Client Data when using the WEBFLEET Service and Products and when storing or otherwise using Client Data outside Processor's or Sub-Pro­cessors' systems, including by: (1) using adequate controls to ensure a level of security appropriate to the risk to the Client Data, (2) securing account authen­tic­ation credentials, systems and devices Controller uses to access the WEBFLEET Service and Products, and (3) backing up or retaining copies of Client Data as appropriate;
4. Provide adequate training on privacy, data protection and information security to its staff and contractors with respect to the processing and adequate protection of Client Data;
5. To the extent required under Applicable Privacy Laws, ensure that Controller's account­ab­ility obligations relating to the processing and protection of Client Data are met, including keeping accurate and up-to-date records about the decisions made relating to its own activities; and
6. Make lawful use of the WEBFLEET Service and Products and only provide instructions for the processing of Client Data in compliance with Applicable Privacy Laws.

2.2. Processor's Obligations. In addition to its other obligations under the Agreement and this DPA, the Processor shall comply with the Applicable Privacy Laws and:

1. Process personal data only on documented instructions from the Controller, unless required to do so by force of a binding legal obligation for the Processor, in which case Processor shall inform the Controller of that legal requirement before processing, unless applicable law prohibits Processor from disclosing such information;
2. Subject to the product- and service-spe­cific conditions on data retention laid out in Appendix 1 (Description of Processing), and unless Applicable Privacy Laws prevent Processor from doing so, irreversibly anonymize or delete personal data in the Client Data at the end of the applicable retention periods, as well as allow Controller to export, retrieve or otherwise access Client Data in accordance with the provisions of Section 5 below while this DPA remains in force;
3. Only engage Sub-Pro­cessors and transfer Client Data across jurisdictions in accordance with the requirements set forth in Section 3 below;
4. Provide adequate training on privacy, data protection and information security to its staff and contractors with respect to the processing and adequate protection of Client Data;
5. Maintain an appropriate level of security for Client Data in accordance with the provisions of Section 4 below by implementing appropriate technical and organ­iz­a­tional measures to that effect and ensure that Sub-Pro­cessors, employees and other persons authorized to process the Client Data have committed themselves to confid­en­ti­ality or are under an appropriate statutory obligation of confid­en­ti­ality.
6. To the extent required under Applicable Privacy Laws, ensure that accurate and up-to-date records of the activities it carries out involving the processing of Client Data are maintained; and
7. Where Processor becomes aware that an instruction clearly infringes Applicable Privacy Laws, it shall immediately notify Controller, who may then withdraw or modify its instructions accordingly. For the avoidance of doubt, and in particular due to the nature of Controller's instructions to Processor as referred to in Section 1.1 above, Controller understands and agrees that (1) it is unlikely that Processor can form an opinion on whether instructions from Controller infringe Applicable Privacy Laws; (2) Processor is under no obligation to actively monitor or audit Controller's instructions or deployment decisions; and (3) Processor is not responsible for providing legal advice to Controller.

3. Sub-Pro­cessing & Cross-Border Data Transfers

3.1. Authorization to Engage Sub-Pro­cessors. Controller acknowledges that the provision of the WEBFLEET Service and Products requires Processor to put in place complex technical and organ­iz­a­tional arrangements for the adequate processing and protection of Client Data, including with specific Sub-Pro­cessors providing specialized services. Controller therefore gives general authorization for Processor to engage Sub-Pro­cessors under the terms of this DPA. The entities listed in Appendix 2 (Sub-Pro­cessors) are the Sub-Pro­cessors engaged by Processor for the provision of the WEBFLEET Service and Products to Controller. Controller further authorizes Processor's engagement of other third parties as Sub-Pro­cessors provided that such engagement is strictly necessary for the adequate provision of the WEBFLEET Service and Products. Processor shall notify Controller of intended changes to Appendix 2 (Sub-Pro­cessors) in accordance with Sections 3.2 and 6.4 below.

3.2. Controller's Objection to Sub-Pro­cessors. When Processor engages any new Sub-Processor not listed in Appendix 2 (Sub-Pro­cessors), Processor will, at least 30 days before the new Sub-Processor starts processing any Client Data, update Appendix 2 (Sub-Pro­cessors) accordingly, including the name, location and activities of the new Sub-Processor. Controller may, within 15 days after the publication of the updated Appendix 2 (Sub-Pro­cessors), object to the appointment of the new Sub-Processor(s) by notifying Processor in writing. When objecting to new Sub-Pro­cessors, Controller will include a documented explanation of the grounds for non-approval together with the termination notice to permit Processor to re-evaluate any such new Sub-Processor based on the concerns expressed by Controller. Upon receipt of such an objection by Processor, the Parties shall discuss in good faith and attempt to find a commercially reasonable resolution. If after such discussion Controller does not approve the new Sub-Processor, then Processor may, at its sole discretion, either (a) refrain from appointing the objected Sub-Processor; or (b) allow Controller to (partially) terminate any subscription for the affected portion of the WEBFLEET Service and Products which would otherwise rely on that Sub-Processor, without liability to either Party.

3.3. Conditions Applicable to Sub-Pro­cessors. Where a Sub-Processor fails to fulfill its data protection obligations, Processor shall remain liable to Controller for the performance of that Sub-Processor's obligations. Processor shall ensure that, as between Processor and each Sub-Processor, a written contract is in place whereby:

1. Sub-Processor undertakes to process personal data in the Client Data only to the extent required to perform the specific obligations subcontracted to it; and
2. To the extent required under the Applicable Privacy Laws, Sub-Processor abides to data protection obligations in a manner that is substantially consistent with Processor's obligations under this DPA. This shall include, in particular, Sub-Processor's obligations to implement appropriate technical and organ­iz­a­tional measures to ensure the security of Client Data.

3.4. Cross-Border Processing of Client Data. Controller is solely responsible for defining where the WEBFLEET Service and Products will be used by authorized users, including the geographic locations where Controller's vehicles managed with the WEBFLEET Service and Products will be moved through. Controller acknowledges that the provision of the WEBFLEET Service and Products requires Processor to process Client Data in different jurisdictions, because of the physical location of the processing facilities used by Processor and Sub-Pro­cessors. Data processing activities carried out by Processor will generally take place within the European Economic Area. Other jurisdictions on which Client Data will be processed, as well as the specific conditions applicable to such cross-border processing under Applicable Privacy Laws, if any, are laid out in Appendix 2 (Sub-Pro­cessors). Controller shall inform Processor in advance in case it intends to use the WEBFLEET Service and Products in a jurisdiction that imposes privacy obligations that add to or conflict with those considered in this DPA. If additional or conflicting obligations are communicated by Controller, then the Parties shall engage in good faith negotiations about (1) the necessary amendments to this DPA to address said obligations, and (2) the potential impacts to the commercial conditions applicable to the WEBFLEET Service and Products as a result of such amendments in a way that meets Controller's requirements and maintains the commercial balance of the Agreement.

3.5. Non-EEA/UK Processing of Personal Data. Where Processor engages a Sub-Processor hereunder for carrying out personal data processing activities on behalf of Controller which entail transfers of personal data outside the European Economic Area and the United Kingdom, Processor will only transfer personal data outside the European Economic Area and the United Kingdom if the appropriate GDPR requirements are met. Processor will only engage Sub-Pro­cessors to process personal data in the Client Data outside the European Economic Area or the United Kingdom if either (a) an adequacy decision in the meaning of Article 45 GDPR is in place to cover the geography where processing by the relevant Sub-Processor is set to take place; or (b) standard contractual clauses adopted by the European Commission (EEA) or the Information Commissioner's Office (UK) in accordance with of Article 46(2) GDPR are in place between Processor and Sub-Processor, provided that the conditions for the use of those standard contractual clauses are met. Specific information applicable to the processing of personal data carried out by each Sub-Processor is laid out in Appendix 2 (Sub-Pro­cessors).

4. Security & Compliance

4.1. Confid­en­ti­ality of Client Data. Processor will not access, use, or disclose to any third party, any Client Data, except as (a) directed by Controller, (b) described in this DPA, or as (c) necessary to comply with the law or a valid and binding order of a governmental body (such as a subpoena or court order). If a competent (government) authority requests access to Client Data, the Processor will, where legally permitted and reasonably practicable, seek to redirect the authority to request the data directly from the Controller. If the Processor is legally required to disclose Client Data, it will provide the Controller with prompt notice of the request and await instructions, unless prohibited to do so by law.

4.2. Processor's Security Measures. Processor will implement and maintain technical, organ­iz­a­tional, and physical measures to protect Client Data against Processor Security Incidents in a manner consistent with its obligations under Applicable Privacy Laws as described in Appendix 4 (Technical & Organ­iz­a­tional Measures). Processor may update such measures from time to time provided that such updates do not result in a material reduction of the security of the Client Data processed within the WEBFLEET Service and Products.

4.3. Controller's Security Assessment. Controller is solely responsible for making an independent determination as to whether the technical and organ­iz­a­tional measures for the security of the WEBFLEET Service and Products meet Controller's requirements, including any of its security obligations under Applicable Privacy Laws. By entering into this DPA, Controller agrees that the WEBFLEET Service and Products and in particular the security practices and policies implemented and maintained by Processor provide a level of security appropriate to the risk to Client Data, taking into account the state of the art, the costs of imple­ment­ation and the nature, scope, context and purposes of the processing of Client Data as well as the risks to individuals.

4.4. Security Incidents. Processor will notify Controller promptly and without undue delay after becoming aware of a Processor Security Incident, take reasonable steps to minimize harm and secure Client Data, and continue to provide reasonable assistance to Controller to that effect. Processor may provide information about a Processor Security Incident in phases in so far as more information about the Security Incident becomes available. To enable Controller to notify a Processor Security Incident to a Supervisory Authority and/or data subjects, Processor will cooperate with and assist Controller by including in the notification under this Section 4.4 such information about the Processor Security Incident as Processor is able to disclose to Controller, taking into account the nature of the processing and the information available to Processor. Processor's notification of or response to a Processor Security Incident to Controller hereunder will not be construed as an acknow­ledgement by Processor of any fault or liability with respect to the Processor Security Incident. Controller must notify Processor promptly about any possible misuse of its accounts or authen­tic­ation credentials or any other security incident, breach or adverse event related to the WEBFLEET Service and Products.

5. Access to Data and Assistance to Controller

5.1. Data Access. At all times during the term of the Agreement and this DPA, Processor will enable Controller, in a manner consistent with the function­al­ities of the WEBFLEET Service and Products, to access and to export Client Data, including where necessary for further use of Client Data by Controller outside the WEBFLEET Service and Products. Processor keeps a Data Access Specification Sheet up to date with the purpose of transparently informing Controller about the different data points generated by Processor throughout the Agreement, as well as the means available for Controller to access and export such data. This can be consulted at webfleet.com/dpa.

5.2. Control and Respons­ib­ility Over Client Data. Notwith­standing the specific­a­tions of the processing of Client Data for the purposes of the adequate provision of the WEBFLEET Service and Products under this DPA, Controller retains exclusive respons­ib­ility for assessing whether the processing of Client Data commissioned to Processor as described in this DPA and Agreement fulfills the legal, technical, and operational requirements of the Controller. This includes the specific retention periods applicable to the different categories of Client Data outlined in Appendix 1 (Description of Processing) and Controller's obligations and potential interests in keeping Client Data for periods that differ from those laid out in this DPA. During the term of this DPA, Controller retains control over Client Data, including where necessary to rectify, update, export, make copies of, and erase Client Data. Processor shall reasonably cooperate and assist Controller to that extent in accordance with the provisions of this DPA.

5.3. Data Subject Requests. Should Processor receive a request from a data subject that relates to Client Data, Processor will (1) advise the data subject to submit their request to Controller, (2) notify Controller without undue delay, and (3) refrain from responding to the request without authorization from Controller. Controller will be responsible for responding to any such request including by using the functionality of the WEBFLEET Service. Processor will (taking into account the nature of the processing of Client Data) assist Controller in fulfilling its obligations under Applicable Privacy Law to respond to requests for exercising the data subject's rights by either instructing Controller on how to use the WEBFLEET Service to that end or, if that proves insufficient, and upon Controller's express request, by providing Controller with additional reasonable cooperation and assistance.

5.4. Assistance for Compliance. Upon Controller's express request, Processor will (taking into account the nature of the processing and the information available to Processor) reasonably assist Controller where necessary in ensuring compliance with its obligations relating to data protection impact assessments, prior regulatory consultations with Supervisory Authority(ies) or equivalent procedures under Applicable Privacy Law. Processor will provide such cooperation and assistance by providing the requested information, which shall never be construed by Controller as legal advice, related to the processing activities and technical and organ­iz­a­tional measures relevant to the WEBFLEET Service and Products, unless the requested information is otherwise already available to Controller. To the extent that Controller requests assistance, support or cooperation that materially exceeds the scope of Processor's obligations under this DPA or Applicable Privacy Laws, Processor may charge Controller for its reasonable and demonstrable costs incurred in providing such additional assistance. Controller shall reimburse Processor for all such reasonable and demonstrable costs and expenditures, provided that Processor notifies Controller in advance and obtains Controller's prior written approval for such costs.

5.5. Audits. Processor uses independent third-party auditors to verify the adequacy of its security measures according to ISO 27001 standards. At Controller's written request, and under appropriate confid­en­ti­ality covenants, Processor will provide Controller with as much information and records as reasonably necessary so that Controller can verify Processor's compliance with its obligations under this DPA, including by providing access to relevant third-party audit reports, certi­fic­a­tions, and summaries thereof. Controller agrees to use such reports and certi­fic­a­tions as the primary means of verifying Processor's compliance. To the extent that Applicable Privacy Laws provides for audit rights and Controller reasonably determines that the information provided is insufficient to verify Processor's compliance with its obligations under this DPA, Processor will allow Controller (or a demonstrably independent auditor appointed by Controller) to verify Processor's compliance with its obligations under this DPA. During an audit, Processor will reasonably cooperate with Controller or its auditor, including by providing any relevant documents relating to Processor's measures applied by Processor to comply with this DPA. Controller remains responsible for any fees charged by an auditor appointed by Controller or otherwise incurred for the carrying out of any such audit. Following an audit request hereunder, the Parties will discuss and mutually agree in advance on:

1. the reasonable start date, scope and duration of the audit; and
2. each Party's security and confid­en­ti­ality obligations, controls, and covenants applicable to the audit and to any related evidence or other documents, as well as any ensuing reports and agreements.

6. Miscellaneous

6.1. Termination of this DPA. This DPA shall remain in force for the duration of the Agreement and for so long thereafter as the Processor continues to process Client Data on behalf of the Controller during the applicable retention periods specified in Appendix 1 (Description of Processing). This DPA shall automatically terminate upon the Processor's cessation of all processing activities involving personal data in the Client Data.

6.2. Severability. If any provision of these DPA is at any time held by a competent court to be invalid or unenforceable, it shall be ineffective only to the extent of such invalidation or unenforce­ab­ility without invalidating the remaining portions hereof, and such remaining portions of this DPA shall continue to be in full force and effect. In the event that any provision of this DPA shall be determined to be invalid or unenforceable, the Parties will negotiate in good faith to replace such provision with another provision that will be valid or enforceable and that is as close as practicable to the provisions held invalid or unenforceable.

6.3. Return or Deletion of Client Data. In addition to Controller's right to retrieve/obtain access to Client Data under Section 5.1 above, Processor will further enable Controller, at all times during the term of this DPA, to delete Client Data in a manner consistent with the function­al­ities of the WEBFLEET Service and Products. If Controller is technically unable to access or delete Client Data via the dedicated function­al­ities provided in the WEBFLEET Service and Products, Controller may submit a request in writing to that effect and Processor will enable Controller to access or irreversibly delete Client Data following such request.

6.4. Notices & Communication. Except where expressly stated otherwise, all notices from Processor to Controller under this DPA will be delivered to one or more of Controller's admin­is­trators, either by dedicated notifications via the WEBFLEET Service interface or email. Notice is given as of the date it is made available by Processor. It is Controller's sole respons­ib­ility to ensure Controller's admin­is­trators maintain accurate contact information on the WEBFLEET Service's management console and secure transmission at all times. Notices and other commu­nic­a­tions from Controller to Processor referring to the subject matter of this DPA will be delivered by Controller's authorized repres­ent­atives to digitaltrust@bridgestone.com.

6.5. Updates. This DPA may be updated from time to time by Processor, including as needed to comply with updates to applicable laws and reflect the release of improvements or other material changes to the WEBFLEET Service and Products. The most up-to-date version of this DPA can be consulted at webfleet.com/dpa.

6.6. Governing Laws & Dispute Resolution. The provisions relating to the choice of applicable laws and dispute resolution contained in the Agreement shall apply in full to this DPA.

Appendices

• Appendix 1: Description of Processing
• Appendix 2: Sub-Pro­cessors
• Appendix 3: OEM & Third-Party Integrations Data Processing Terms
• Appendix 4: Technical & Organ­iz­a­tional Measures

The most up-to-date version of this DPA as well as of each of the documents above can be found on webfleet.com/dpa.

Throughout Client's use of the WEBFLEET Service and Products, the following categories of data may be generated and further processed by Webfleet Solutions:

• User-Managed Data and Created Content: Data created or otherwise (manually) inserted into and/or edited in the Webfleet Telematics Service Platform.
• Transactional Data: Data automatically generated by Client's use of the WEBFLEET Service and Products.
• Aggregated Data: Data derived by applying statistical analysis as part of the WEBFLEET Service.

In the tables below, a detailed description of the different data points processed by Webfleet Solutions is presented. These tables include: (1) a general reference to each data category, (2) a description of the (more granular) data contained in each such data category, and (3) a reference to the retention period that Webfleet Solutions applies by default to the data points in each such data category.

Product- or Service-Spe­cific Processing. Certain components and modules of the WEBFLEET Service and Products have specific data processing capabilities that apply only to them. Individual tables are set out below to describe this where applicable. To jump straight to the product- and service-spe­cific data tables, please refer to the links below:

• Webfleet Services:
  • Cold Chain
  • EV Charger Monitoring & Optimization
  • Fleet Advisor
  • Fleet Insights
  • In-App Translation Service
  • Tachograph Manager
  • TachoShare
  • Tire Pressure Monitoring
  • Webfleet Video
  • Working Times & Remaining Driving Time
• Webfleet Mobile Applications:
  • Logbook App
  • TPMS Tools App
  • Vehicle Check App
  • Webfleet Mobile App
  • Work App

The entirety of Client Data listed in this Appendix 1 is processed and made available to Client via the Webfleet Telematics Service Platform. To the extent that Client does not use certain components or modules of the WEBFLEET Service or Products, the data processing specific­a­tions that apply only to those unused components or modules will not apply to Client.

General Data Processing Overview

The tables below describe the general data processing capabilities that are enabled with the use of core features of the Webfleet Telematics Service Platform, as well as with most function­al­ities from the LINK and PRO devices.

User Managed Data and Created Content

Data created by users of the WEBFLEET Service and Products

Transactional Data

Data generated by using the WEBFLEET Service and Products

Aggregated Data

Data derived by applying statistical analysis as part of the WEBFLEET Service

Product- and Service-Spe­cific Processing

The tables below describe product- and service-spe­cific data processing specific­a­tions. To the extent that Client does not use (a portion of) the following products or services, the corresponding data processing specific­a­tions will not apply.

Cold Chain

Webfleet Cold Chain gives you complete visibility of your refrigerated fleet for worry-free cold chain logistics. With real-time temperature monitoring and control, this adaptable solution helps you both protect temperature sensitive products and achieve cold chain compliance. Learn more about Cold Chain here.

EV Charger Monitoring & Optimization

Gain comprehensive insights into your EV charging routine by connecting your private chargers to the Webfleet EV monitoring system. Effortlessly monitor your chargers across multiple sites without the need for additional hardware. Stay on top of charging costs and occupancy to improve operational reliability. Chargers must comply with OCPP 1.6 and be connected to the internet. Learn more about EV Charger Monitoring & Optimization here.

Fleet Advisor

Webfleet Fleet Advisor is an advanced AI fleet management feature designed to help fleet managers make data-driven decisions with ease and precision. Learn more about Fleet Advisor here.

Fleet Insights

Webfleet Fleet Insights helps fleet managers transform complex fleet data into practical action. Fleet benchmarks, trends, and a recom­mend­a­tions dashboard allows for faster, actionable understanding of fleet performance. By unifying key aggregated metrics from your fleet, benchmarking against similar fleets, surfacing trends, and with seamless link to Fleet Advisor for tailored recom­mend­a­tions and deeper analysis, you get to make faster, more confident decisions that reduce costs, improve efficiency, and elevate safety and operational performance. Learn more about Fleet Insights here.

In-App Translation Service

In-App Translations enables authorized users to request translations of text messages and order descriptions exchanged through Webfleet, Webfleet Mobile, and the Work App. When a user selects the translation function, the relevant text and requested target language are processed using an AI-powered translation service, and the translated text is returned for display alongside the original content. Translations may be temporarily cached within the Client's account to improve performance and avoid repeated translation of identical content.

Tachograph Manager

Webfleet Tachograph Manager is the reliable all-in-one software solution for downloading, analyzing and archiving tachograph data for your HGVs and LCVs. Learn more about Tachograph Manager here.

TachoShare

Webfleet TachoShare is a Remote Download Module that downloads tachograph data from vehicles on the road and offers connectivity to 3rd party analysis software. You get complete control of how you use your data and who you share it with, from a secure, accessible archive. Learn more about TachoShare here.

Tire Pressure Monitoring

Webfleet Tire Pressure Monitoring System (TPMS) checks your tire pressure and temperature in real-time. With predictive tire management, problems are detected before they lead to costly repairs or downtime. Whether you are transporting passengers or cargo – TPMS helps you ensure you get to your destination safely and on time. Learn more about TPMS here.

Webfleet Video

Combined with Webfleet Video, fleet cameras provide comprehensive insights into road incidents and driving events. AI technology detects risky driving behavior like mobile phone use and tailgating, then notifies drivers so they can immediately adjust their driving style. Learn more about Webfleet Video here.

CAM 50 (Legacy Solution)

CAM Lite & Pro

Working Times & Remaining Driving Time

Webfleet delivers accurate, up-to-date remaining driving times, helping you and your drivers to stay compliant with regulations. Precise data on how many hours your drivers have left each day also enables your dispatchers to plan more effectively and efficiently. Learn more about Remaining Driving Time here.

About Webfleet's Mobile Apps

The Webfleet mobile apps help fleet managers run their fleets on the go and effectively communicate with their mobile workforce. Driver­-ori­ented apps also help streamline workflows wherever drivers are. Learn more about Webfleet's Mobile Apps here. Most data points listed below reflect the same data that is processed in the context of the WEBFLEET Service as a whole. Unless expressly stated otherwise, the retention time for such data points will follow the data lifecycle defined for the WEBFLEET Service in general, as per the tables above. Webfleet's mobile apps data processing activities are also subject to Webfleet's privacy notice.

Mobile App: Logbook App

Mobile App: TPMS Tools App

Mobile App: Vehicle Check App

Mobile App: Webfleet Mobile App

Mobile App: Work App

Webfleet Solutions has engaged the following entities to process Client Data to deliver core features of the Webfleet Telematics Service Platform and the WEBFLEET Service more broadly:

Product- and Service-Spe­cific Sub-Pro­cessors

Webfleet Solutions has engaged the following entities to process Client Data to deliver specific features of the Webfleet Telematics Service Platform, as individually highlighted below. To the extent that Client does not use certain features listed below, the Sub-Processor involvement that apply only to those unused features will not apply to Client:

* Data processing outside the European Economic Area carried out based on Article 45 GDPR.

** Data processing outside the European Economic Area carried out based on Article 46(2)(c) GDPR.

1. Applicability & Precedence. This Appendix governs Client-ini­tiated processing of Client Data in connection with third parties other than the Sub-Pro­cessors listed in Appendix 2. Third parties may include OEMs and independent providers offering integrations with the WEBFLEET Service (each a Third-Party Integration Provider and, together with OEMs, Integration Providers). For clarity, this Appendix 3 does not apply to Vehicles from OEM brands listed in Section 3 that have not been linked to the WEBFLEET Service via the applicable OEM Platform under the OEM Schedule. If there is a conflict between this Appendix 3 and the DPA, this Appendix 3 prevails with respect to the processing of Client Data in Client-ini­tiated integrations to the extent of any inconsistency.

2. On-Demand Third-Party Data Processing Enablement. By enabling a connection between the WEBFLEET Service and an Integration Provider, Client issues documented instructions to Webfleet Solutions to send, receive, and otherwise process Client Data to/from that Integration Provider as needed for inter­op­er­ab­ility with the WEBFLEET Service:

1. OEM Onboard Units. If Client uses OEM Onboard Unit interfaces, Webfleet Solutions' enablement thereof in the WEBFLEET Service is (1) subject to the OEM Schedule and (2) contingent on per-Vehicle authen­tic­ation and consent via Webfleet Solutions' secure methods and/or the OEM Platform following each OEM's requirements.
2. Third-Party Integration Providers. If Client links services from Third-Party Integration Providers to the WEBFLEET Service, Webfleet Solutions' enablement thereof occurs upon (1) Client's request (via the WEBFLEET Service user interface or Webfleet Solutions' support channels) and (2) the ensuing linkage of Client's WEBFLEET Service environment to the provider using credentials securely managed by Webfleet Solutions.

3. OEM Integrations. Depending on the OEM integration(s) selected by Client, Client acknowledges and agrees that Client Data will be further processed by the following OEMs, as the case may be:

* Data processing outside the European Economic Area carried out based on Article 45 GDPR.

4. Processing of Client Data by Integration Providers. Webfleet Solutions does not control and is not responsible for Integration Providers' services, including their security, availability, or compliance. Furthermore, given the limited scope of Client Data processed per selected integration, Client acknowledges and agrees that each Integration Provider will independently:

1. Technical Specific­a­tions. Define, maintain, and update the technical methods/specific­a­tions for data made available to Webfleet Solutions for further processing within the WEBFLEET Service. All such data is provided as is/as available without any repres­ent­ation or warranty by Webfleet Solutions to Client regarding accuracy or quality;
2. Purposes and Means. Determine the purposes and means of processing for data generated, collected, or otherwise processed under the services each Integration Provider provides to Client, including any further (sub-)processing on its behalf;
3. Security. Implement and maintain its own technical and organ­iz­a­tional measures to protect Client Data, ensure lawful processing, and conduct its own security audits/assessments of data processing environments;
4. Security Incidents. Receive notifications from Webfleet Solutions of (suspected) personal data breaches, including and related follow-up commu­nic­a­tions aimed at protecting Client Data and complying with applicable law;
5. External Access Requests. Receive notifications from Webfleet Solutions of binding requests for access to Client Data by governmental (law-en­forcement) authorities or comparable requests, to the extent permitted by law;
6. Cooperation. Remain responsible for cooperation requested by Client relating to security of processing, access to data, data subject requests, DPIAs, audits, breaches, and prior consultation with Supervisory Authorities insofar as those requests concern processing by the Integration Provider. Requests for audits or assessments of an Integration Provider's environment must be pursued by Client under Client's agreement with that Integration Provider; Webfleet Solutions will reasonably coordinate to the extent such requests involve the WEBFLEET Service, in line with the provisions of the DPA;
7. Service Changes and Availability. Subject to the terms of the agreements referred to in Items 5 and 6 below, suspend, terminate, or change their services. Disruptions in an Integration Provider's services may result in irretrievable loss of Client Data expected from that provider, without liability of Webfleet Solutions. Webfleet Solutions' service levels, availability, support, and data-­freshness commitments under the Agreement exclude data feeds, functionality, latency, or outages attributable to Integration Providers outside of Webfleet Solutions' control.

5. Client's Independent Agreements. Client's use of Integration Providers with the WEBFLEET Service depends on Client's lawful use of the relevant Vehicles, Onboard Units, and services those providers supply to Client. Client's separate agreements with each Integration Provider (including the OEM Platform terms) solely govern that relationship. Client is exclusively responsible for complying with those terms, including in its use of the WEBFLEET Service. Client may consult (1) its own contracts and the websites listed in Item 3 (for OEMs) and (2) its contracts and websites of each Third-Party Integration Provider to understand features, behavior, settings, specific­a­tions, requirements, and limitations applicable to the offerings of each Integration Provider.

6. Webfleet Solutions' Independent Agreements. Webfleet Solutions maintains OEM Agreements with the OEMs listed in Item 3 and separate agreements with Third-Party Integration Providers. Shared processing of Client Data between Webfleet Solutions and any Integration Provider at Client's direction is subject to the continued effectiveness of these agreements. If any such agreement terminates, affected WEBFLEET Service features or data-­pro­cessing capabilities will be adjusted accordingly. Where an OEM Agreement involves an OEM processing personal data in Client Data in the capacity of a Sub-Processor, then Section 3 of the DPA applies to Webfleet Solutions' engagement of that OEM.

Webfleet Solutions maintains an ISO/IEC 27001 certification (available on request) which covers Webfleet Solutions' scope of processing of Client Data detailed in the DPA and includes the below technical and organ­iz­a­tional measures to ensure the security of Client Data:

Technical & Organ­iz­a­tional Measures | Confid­en­ti­ality of Client Data

Technical & Organ­iz­a­tional Measures | Integrity of Client Data

Technical & Organ­iz­a­tional Measures | Availability of Client Data & Resilience

Technical & Organ­iz­a­tional Measures | Organ­iz­a­tional Management

This Data Access Specification Sheet is currently under development.

The most up-to-date version, once available, can be consulted at webfleet.com/dpa.