Data Processing Terms

These Data Processing Terms (also called a Data Processing Addendum or "DPA") are part of the Terms of Service between Bousmah Capital Investment LLC ("FPDSP," "we," "us," or "Processor") and the business that uses fpdsp.com (the "Customer," "you," or "Controller"). They explain how we process Customer Personal Data on your behalf. Our Privacy Policy covers our own website, billing, and security uses. If this DPA and the Terms conflict on data processing, this DPA controls for that topic.

By agreeing to the Terms (including at sign-up or when you select Agree in the app), you agree to this DPA for yourself and your DSP. Accounts opened before October 21, 2026: this DPA applies from November 5, 2026, or from when you agree in the app, if sooner.

1. Roles

For Customer Personal Data that you or your users put into the service, or that we retrieve from accounts you connect (delivery portals, payroll, safety, hiring, messaging, spreadsheets, and similar), you are the Controller (or "business" under U.S. state privacy laws) and we are the Processor (or "service provider"). You decide what goes in and what your team does with it. We process it only to provide the service under your instructions.

For our own account records, billing, fraud prevention, product analytics that do not identify your drivers, and website visitors who are not using the product under a DSP account, we act as an independent controller, as described in the Privacy Policy.

2. Definitions

Customer Personal Data: personal information in Customer Data, including names, contact details, employee or driver identifiers, schedule and performance records, safety and coaching notes, HR files, delivery-related details you bring in (such as tracking numbers or addresses used for coaching or disputes), and credentials you save so agents can sign into connected accounts.
Data Protection Laws: privacy and data protection laws that apply to the parties' roles under this DPA, which may include the California Consumer Privacy Act as amended (CCPA/CPRA) and similar U.S. state laws, and, where they apply to a Customer, the EU GDPR, UK GDPR, and Swiss FADP.
Process / Processing: any operation on Customer Personal Data, including collecting, storing, retrieving, using, disclosing, deleting, or otherwise handling it in the service.
Security Incident: a breach of our security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data that we process.
Subprocessor: a third party we engage to Process Customer Personal Data so we can provide the service (for example, hosting, database, cloud browser, email, payments, or AI used for Help answers).

3. Your instructions

You instruct us to Process Customer Personal Data only to:

Provide, maintain, secure, and support the service under the Terms;
Run the automations and connected-account pulls you enable;
Follow documented configuration you set in the product (access, stations, preferences);
Comply with law, or with a documented instruction you give us in a support ticket.

We will not Process Customer Personal Data for our own marketing, sell it, or share it for cross-context behavioral advertising. We will not use Customer Personal Data to build profiles about your drivers for our own commercial purposes outside the service. Aggregated Learning Across DSPs, when you leave it on, uses only pooled statistics that cannot identify a person or DSP, as described in the Privacy Policy.

If we believe an instruction violates Data Protection Laws, we will tell you promptly (unless the law forbids it) and may pause that Processing until you clarify.

4. What we process

Subject matter: operating the service for your DSP. Duration: for the life of your account and the short retention window after deletion described in the Privacy Policy. Nature and purpose: hosting, display, calculation, agent automation, dispute and coaching tools, Driver Portal, billing of your subscription, and security. Types of data: as in Section 2 and the Privacy Policy. Categories of people: your owners, managers, drivers, other staff you invite, and, where you bring them in, limited delivery-recipient details used only for coaching or disputes.

5. Our obligations as Processor

We will:

Process Customer Personal Data only on documented instructions from you, unless law requires otherwise;
Ensure people who Process it for us are under confidentiality duties (contract or professional obligation);
Implement appropriate technical and organizational security measures (Section 6);
Use Subprocessors only as Section 7 allows;
Taking into account the nature of Processing, help you respond to requests from individuals about their data (you remain responsible for deciding the response);
Taking into account the nature of Processing and information available to us, help you with security, breach, and impact assessments that relate to our Processing;
Delete or return Customer Personal Data when the account ends, as described in the Privacy Policy, unless law requires us to keep a copy;
Make available information reasonably necessary to demonstrate this DPA, and allow audits as in Section 10.

6. Security

We maintain measures appropriate to the risk, including:

Encryption of passwords, verification keys, access tokens, and payroll API credentials at rest;
Encryption in transit (HTTPS / TLS) for the service;
Access controls so each DSP's data is separated by account; staff support access is limited to what is needed to run and support the product;
Authenticated sessions, role and permission controls you configure for managers and drivers;
Logging and monitoring of systems that hold Customer Data;
Use of reputable Subprocessors for hosting, databases, and secure cloud browsers used for connected-account sessions.

No method of transmission or storage is perfectly secure. You are responsible for strong account credentials, who you invite, and the connected accounts you authorize.

7. Subprocessors

You authorize us to use Subprocessors to provide the service. We remain responsible for their performance for the Processing they do for us. We require them to protect Customer Personal Data with confidentiality and security obligations appropriate to their role.

Categories of Subprocessors we use today include:

Cloud hosting and database;
Authentication / identity;
Secure cloud browser for connected portals;
Email and push notification delivery;
Payment processing;
AI model providers for the in-app Help assistant (under terms that do not allow training on your prompts for their own models, as described in the Privacy Policy).

A current high-level list lives in the Privacy Policy under "How We Share Information." If we add a new Subprocessor that will Process Customer Personal Data in a material new way, we will update that list and, for material changes, give notice in the product or by email with a reasonable chance for you to object before the change applies to your account. If you object on reasonable data-protection grounds and we cannot accommodate you, you may cancel as allowed in the Terms.

8. Connected accounts and credentials

When you connect an outside account (including a delivery portal, payroll system such as ADP, safety platform, hiring tools, or messaging workspace), you instruct us to access that account using the credentials or session you provide, solely to pull or sync the data needed for the features you enable. We do not use those credentials for any other Customer's account. You can revoke a connection in the product. You are responsible for having the right to grant that access under your agreements with that provider.

9. Security incidents

If we become aware of a Security Incident affecting your Customer Personal Data, we will notify you without undue delay and, where feasible, within seventy-two (72) hours of confirming the incident, and will include information we reasonably have about the nature of the incident, likely consequences, and measures taken or proposed. We will cooperate with your reasonable investigation and notification obligations. Our notice is not an admission of fault or liability.

10. Assistance, records, and audits

On written request (support ticket), we will provide information reasonably needed to show we meet this DPA. If that is not enough for your compliance needs, you may request an audit of our Processing of your Customer Personal Data, limited to once in any twelve (12) month period (unless a Security Incident or regulator requires more), with reasonable notice, during business hours, under confidentiality, and without disrupting other customers. You may use your own auditor or a mutually agreed independent auditor. You pay third-party auditor costs unless the audit finds a material breach of this DPA by us.

11. International transfers

We primarily host and Process Customer Personal Data in the United States. If Data Protection Laws that restrict international transfers apply to you (for example EU GDPR), and a transfer of Customer Personal Data from the EEA, UK, or Switzerland to the United States requires a transfer mechanism, the parties will work in good faith to put in place an appropriate mechanism (such as the European Commission's Standard Contractual Clauses, Module 2, controller to processor, and the UK Addendum where required). Until then, you are responsible for confirming the service is appropriate for the data you choose to put in it.

12. U.S. state privacy (including CCPA)

When we Process Customer Personal Data subject to the CCPA/CPRA or similar U.S. state laws as your service provider, we will not: sell or share that personal information; retain, use, or disclose it for any purpose other than the business purposes in the Terms and this DPA, or as otherwise permitted for service providers; retain, use, or disclose it outside the direct business relationship with you; or combine it with personal information from other sources except as allowed for service providers (including to build the anonymous Learning Across DSPs pool when you allow it). We certify that we understand these restrictions. You are responsible for providing any notices to individuals that those laws require for your business.

13. Your responsibilities

You will:

Have a lawful basis and any notices or consents needed for the Customer Personal Data you put in the service;
Not instruct us to Process data in a way that would make us violate Data Protection Laws;
Configure access for your users appropriately;
Respond to individual requests about your Customer Personal Data (we will help as in Section 5).

14. Liability

Each party's liability under this DPA is subject to the disclaimers and limits in the Terms, except to the extent Data Protection Laws forbid limiting liability for a particular claim.

15. Term and changes

This DPA lasts as long as we Process Customer Personal Data for you under the Terms. We may update this DPA the same way we update the Terms: by posting a new version and, for existing accounts, giving notice and an Agree step when the change is material. Continued use after the effective date you are given, or selecting Agree, means you accept the update.

16. Governing law

This DPA follows the governing law and dispute process in the Terms (State of Florida), except where Data Protection Laws require a different rule for a specific right.

fpdsp.com is a service of Bousmah Capital Investment LLC, a Florida limited liability company based in Miami. Questions? Open a support ticket.