This addendum forms part of the Terms of Service where you require a processor agreement under UK GDPR. It applies only to personal data we process on your behalf.
1. Definitions
"UK GDPR", "controller", "processor", "data subject", "personal data" and "processing" have the meanings given in the Data Protection Act 2018 and the UK GDPR.
"Customer Personal Data" means personal data you put into the service that relates to someone other than your own users — for example a named contact at your buyer or your freight forwarder.
2. Roles
- For your account and users — the people who sign in — we are the controller. Our Privacy Policy applies.
- For Customer Personal Data, you are the controller and we are the processor.
3. What we process, and why
| Subject matter | Providing the Exportly service |
| Duration | While your account is open, plus the retention periods in the Privacy Policy |
| Nature and purpose | Storing, organising and displaying shipment information so Route Cards and documents can be produced |
| Types of personal data | Names, business contact details, business identifiers such as EORI or REX numbers, and anything else you choose to enter |
| Categories of data subject | Your staff, your customers' contacts, your suppliers' contacts |
| Special category data | None. The service is not designed for it and you must not upload it |
4. Our obligations
We will:
- Process Customer Personal Data only on your documented instructions, unless the law requires otherwise — in which case we will tell you first, unless the law forbids that.
- Ensure people authorised to process it are under a duty of confidentiality.
- Apply appropriate technical and organisational security measures — see §7.
- Not engage a subprocessor without the general authorisation in §5.
- Help you respond to data subject requests, so far as we reasonably can.
- Help you with security, breach notification and impact assessments, taking into account what we know and the tools available to us.
- Delete or return Customer Personal Data at the end of the contract, as you choose, except where the law requires us to keep it.
- Make available information reasonably necessary to demonstrate compliance, and allow audits — see §8.
5. Subprocessors
You give general authorisation for the subprocessors listed in the Privacy Policy. We will give 30 days' notice before adding or replacing one, and you may object on reasonable data-protection grounds. If we cannot resolve an objection, you may terminate the affected part of the service without penalty.
Each subprocessor is engaged under terms no less protective than these, and we remain liable to you for their performance.
6. International transfers
We will not transfer Customer Personal Data outside the UK except with appropriate safeguards — an adequacy decision, the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. Current locations are listed in the Privacy Policy.
7. Security
Encryption in transit and at rest; row-level isolation between organisations enforced by the database and proven by an automated test; strict access control; administrative database credentials never used to serve ordinary user requests; hashed IP addresses; rate limiting and origin checking.
Fuller detail is maintained in SECURITY.md and is available on request.
8. Audit
We will respond to reasonable written questions about our processing. Where you need more than that, we will agree a scope in advance; an on-site audit is at your cost, no more than once a year, unless a breach or a regulator requires otherwise.
9. Breach
We will tell you without undue delay, and in any event within 48 hours, of becoming aware of a personal data breach affecting Customer Personal Data, and give you the information you need for your own notification duties.
10. Liability
Liability under this addendum is subject to the limits in the Terms of Service, except where the UK GDPR does not permit it.
11. Precedence
Where this addendum conflicts with the Terms of Service in relation to Customer Personal Data, this addendum prevails.
Exportly is a trading name of Finlay Hunter. an address in Poole, Dorset (full postal address to be published). Contact: privacy@exportly.uk.