Data Processing Addendum (DPA)
This Data Processing Addendum (“DPA”) forms part of the agreement between Book It Technologies LLC, an Indiana limited liability company, doing business as “Book It Rides” (“Book It Rides,” “Company,” “we,” “us,” or “our”), and the transportation operator identified in the applicable Operator Agreement executed via DocuSign or Adobe Sign (“Operator,” “you,” or “your”).
This DPA applies where Book It Rides processes Personal Data on behalf of Operator in connection with the Book It Rides Platform.
1 Definitions
“Personal Data” means any information relating to an identified or identifiable natural person, as defined under applicable data protection laws.
“Processing” means any operation performed on Personal Data, including collection, storage, use, disclosure, transmission, analysis, or deletion.
“Applicable Data Protection Laws” means data protection and privacy laws that (i) apply to the processing of Personal Data under this DPA, and (ii) are binding on the parties in their respective roles. This may include, where applicable, the EU GDPR and UK GDPR. Any additional requirements (including any required transfer mechanisms) apply only to the extent expressly set forth in a DPA executed by the parties.
2 Roles of the Parties
Operator is the data controller of Personal Data relating to its end-customers and is responsible for determining the purposes and means of Processing of Operator-controlled Personal Data.
Book It Rides acts as a data processor with respect to Operator-controlled Personal Data processed on behalf of Operator.
Book It Rides acts solely as a data processor with respect to Operator-controlled data and does not act as a controller of end-rider transportation services.
Book It Rides is a data controller only for Personal Data it processes for its own business purposes (e.g., Operator account administration, billing, and platform security/usage logs) and is not a controller of Operator-controlled End-Customer transportation/booking data.
3 Scope of Processing
Book It Rides processes Personal Data solely to:
- Provide, operate, and maintain the Platform;
- Enable Operator-configured booking and reservation workflows within the Platform;
- Provide customer support and technical assistance;
- Maintain platform security and integrity; and
- Comply with legal obligations.
Book It Rides does not provide transportation services and does not control Operator pricing, fulfillment, or customer relationships.
4 Operator Obligations
Operator represents and warrants that:
- It has all rights, consents, and lawful bases required to provide Personal Data to Book It Rides;
- Its instructions comply with Applicable Data Protection Laws; and
- It is responsible for responding to end-customer data subject requests related to Operator-controlled Personal Data.
5 Book It Rides Obligations
Book It Rides shall:
- Process Personal Data only on documented instructions from Operator, which include Operator’s configuration and use of the Platform, the Terms of Service, the applicable Operator Agreement, and any written instructions mutually agreed in writing;
- Ensure that persons authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
- Implement reasonable administrative, technical, and organizational safeguards;
- Not sell or share Personal Data, as those terms are defined under applicable U.S. state privacy laws, or use Operator-controlled end-customer Personal Data for advertising purposes; and
- Assist Operator with data subject requests where legally required and technically feasible.
- Upon Operator’s reasonable request, provide reasonable assistance (to the extent required by Applicable Data Protection Laws and technically feasible) with DPIAs and prior consultation requests strictly relating to Operator-controlled Personal Data processed under this DPA.
6 Data Subject Requests
If Book It Rides receives a request from an end-customer relating to Operator-controlled Personal Data, Book It Rides shall, where appropriate:
- Refer the request to Operator; and
- Assist Operator as required by Applicable Data Protection Laws and as technically feasible.
7 Subprocessors
Operator authorizes Book It Rides to engage subprocessors for hosting, infrastructure, analytics, messaging, support tooling, and related services necessary to operate the Platform.
Book It Rides shall: (a) impose data protection obligations on subprocessors consistent with this DPA; and (b) remain responsible for its subprocessors’ performance to the extent required by Applicable Data Protection Laws.
Where required by Applicable Data Protection Laws, Book It Rides will provide reasonable advance notice of material changes to subprocessors through the Platform, email notice, or by updating a published subprocessor list. Operator may object on reasonable data protection grounds by providing written notice within a reasonable period, in which case the parties will work in good faith to address the objection.
8 International Data Transfers
Personal Data may be processed in the United States and other jurisdictions where Book It Rides or its subprocessors operate. Operator acknowledges that the Platform is hosted and supported from the United States.
Where Applicable Data Protection Laws require a lawful transfer mechanism for cross-border transfers, the parties will rely on the transfer mechanism(s) specified in the DPA executed by the parties (for example, EU Standard Contractual Clauses and/or the UK International Data Transfer Addendum/UK IDTA, as applicable). This public webpage does not itself constitute an executed transfer mechanism.
9 Data Security
Book It Rides will implement and maintain commercially reasonable administrative, technical, and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.
Operator acknowledges that no system is completely secure and that Operator is responsible for securing its own accounts, devices, credentials, and access by its users.
10 Data Retention & Deletion
Book It Rides retains Personal Data only for as long as necessary to:
- Provide the Platform;
- Comply with legal obligations;
- Resolve disputes; and
- Enforce agreements.
Upon termination of services, Book It Rides will, at Operator’s written request and to the extent technically feasible, delete or return Operator-controlled Personal Data within a commercially reasonable period, unless retention is required by applicable law, required for security/audit logging, or stored in backup systems that are overwritten in accordance with normal backup cycles.
11 Audits
To the extent required by Applicable Data Protection Laws, Book It Rides will make available information reasonably necessary to demonstrate compliance with this DPA. Any audit request must be reasonable, limited in scope, scheduled in advance, and subject to confidentiality obligations.
Audits shall not include access to Book It Rides’ source code, trade secrets, or systems beyond what is reasonably necessary, and may be satisfied by provision of written responses, security summaries, or third-party reports where available, unless Applicable Data Protection Laws require otherwise.
12 Limitation of Liability
This DPA is subject to the limitation of liability provisions in the executed Operator Agreement (and any executed DPA incorporated therein), and not this public webpage, except to the extent such limitation is prohibited by Applicable Data Protection Laws.
13 Governing Law
This DPA is governed by the laws of the State of Indiana, without regard to conflict-of-laws principles, unless the executed DPA specifies otherwise for the limited subject matter of Applicable Data Protection Laws that mandate a different governing law.
14 Order of Precedence
If there is a conflict between this DPA and the Terms of Service, this DPA shall control with respect to data protection matters. If there is any conflict between this public webpage and an executed DPA, the executed DPA controls.
15 Contact
Book It Technologies LLC (DBA Book It Rides)
Data Protection Contact: bookittechnologies@gmail.com
Annex A Processing Details
1) Subject matter of Processing
Processing of Personal Data to provide the Book It Rides Platform and related functionality to Operator, including quote generation, booking/reservation workflows, operator communications, support, and platform security.
2) Duration of Processing
For the term of the Operator’s use of the Platform and thereafter as necessary for (i) legal compliance, (ii) dispute resolution, and (iii) enforcement of agreements, consistent with Section 10.
3) Nature and purpose of Processing
- Hosting and storing Operator-controlled Personal Data within the Platform
- Transmitting booking/reservation information as configured by Operator
- Providing customer support and troubleshooting
- Security monitoring, abuse prevention, and integrity controls
- System logging and platform performance analytics
4) Categories of data subjects
- Operator end-customers (riders and passengers)
- Operator representatives and staff users of the Platform
- Driver-related contact details only if provided by Operator for operational communications
5) Categories of Personal Data
- Contact details (name, phone, email)
- Trip details (pickup/drop-off addresses, dates/times, vehicle preferences, notes)
- Booking/reservation metadata (status, identifiers, communications logs)
- Account and authentication data for Operator users
- Billing and transaction references for Operator accounts (note: payment card data is generally handled by payment processors)
6) Special categories of data
The Platform is not intended for processing special categories of data (e.g., health data) and Operator agrees not to submit such data unless expressly agreed in writing. If special categories are submitted, Operator remains responsible for ensuring a lawful basis and appropriate safeguards.
7) Technical and organizational security measures (high-level)
- Access controls and authentication protections
- Least-privilege administrative access
- Encryption in transit where supported
- Monitoring and logging of system events
- Vendor/subprocessor management for hosted infrastructure
8) Personal Data breach notification
Book It Rides will notify Operator of a confirmed personal data breach affecting Operator-controlled Personal Data without undue delay. Such notice will include, to the extent reasonably available, the nature of the breach, categories and approximate number of affected data subjects/records, likely consequences, and measures taken or proposed to address the breach. Operator is responsible for any required notifications to authorities and/or data subjects unless otherwise required by law.