Data Processing Agreement

Last updated: 2026-04-22Version 1.1

Version: 1.1

Effective Date: April 22, 2026

This Data Processing Agreement ("DPA") is entered into between CargoParse LLC ("CargoParse," "we," "us," or "our") and the customer identified at execution ("Customer," "you," or "your"). This DPA supplements the CargoParse Terms of Service (the "Agreement") and governs the processing of Personal Information by CargoParse on behalf of Customer.

In the event of a conflict between this DPA and the Agreement, this DPA controls with respect to the processing of Personal Information.

1. Definitions

Capitalized terms not defined here have the meanings given in the Agreement.

  • "Personal Information" means any information relating to an identified or identifiable natural person, including information contained in documents Customer uploads to the Service (such as driver names, contact information, license numbers, and similar details).
  • "Processing" means any operation performed on Personal Information, including collection, storage, use, disclosure, and deletion.
  • "Data Subject" means the natural person to whom Personal Information relates.
  • "Sub-processor" means any third party engaged by CargoParse to process Personal Information on behalf of Customer.
  • "Security Incident" means a confirmed unauthorized access to, disclosure of, or loss of Personal Information processed by CargoParse on behalf of Customer.
  • "Applicable Privacy Laws" means all data protection and privacy laws applicable to the processing of Personal Information under this DPA, including the California Consumer Privacy Act and similar U.S. state laws.

2. Roles of the Parties

Customer is the "business" or "controller" of Personal Information. CargoParse is the "service provider" or "processor," processing Personal Information only on Customer's documented instructions as set out in this DPA and the Agreement.

CargoParse will not:

  • Sell or share Personal Information
  • Retain, use, or disclose Personal Information for any purpose other than providing the Service
  • Retain, use, or disclose Personal Information outside the direct business relationship with Customer
  • Combine Personal Information received from Customer with Personal Information received from other sources, except as necessary to provide the Service or as permitted by Applicable Privacy Laws

3. Scope and Purpose of Processing

3.1 Subject Matter

CargoParse processes Personal Information to provide the document-processing Service described in the Agreement.

3.2 Duration

Processing continues for as long as Customer uses the Service, subject to the data retention provisions of the Agreement and Section 7 below.

3.3 Nature and Purpose

CargoParse processes Personal Information to:

  • Store documents uploaded by Customer
  • Extract structured data from documents using AI models
  • Make extracted data available to Customer through the Service
  • Provide related features such as templates, exports, and notifications

3.4 Categories of Personal Information

Personal Information processed under this DPA may include:

  • Customer account information (name, email, phone)
  • Information contained in freight and logistics documents uploaded by Customer, which may include names, addresses, contact information, driver license and CDL numbers, and other information appearing on Bills of Lading, Proofs of Delivery, Rate Confirmations, Carrier Invoices, Commercial Invoices, Lumper Receipts, and Warehouse Receipts

3.5 Categories of Data Subjects

Data Subjects may include:

  • Customer's personnel who use the Service
  • Drivers, shippers, consignees, brokers, and other individuals whose information appears in documents uploaded by Customer

4. Customer Obligations

Customer represents and warrants that:

  • It has a valid lawful basis under Applicable Privacy Laws for uploading Personal Information to the Service
  • It has provided all required notices and obtained all necessary consents from Data Subjects
  • Its instructions to CargoParse, including those set out in the Agreement, comply with Applicable Privacy Laws
  • It will not upload Personal Information that is subject to heightened regulatory protection (such as protected health information under HIPAA, cardholder data under PCI-DSS beyond what Stripe handles, or children's information under COPPA) without first entering into a separate written agreement with CargoParse

5. Security Measures

CargoParse implements and maintains appropriate technical and organizational measures designed to protect Personal Information against unauthorized or unlawful processing and against accidental loss, destruction, or damage. These include:

  • Encryption in transit using TLS 1.2 or higher
  • Encryption at rest using AWS-managed encryption keys
  • Access controls using least-privilege IAM policies and role-based access
  • Authentication via Amazon Cognito with support for multi-factor authentication
  • Credential security using SHA-256 hashing for API keys (plaintext keys are never stored)
  • Logging and monitoring of administrative access and security-relevant events
  • Network security through AWS VPC, security groups, and WAF
  • Regular review of infrastructure security configurations
  • Personnel practices limiting access to Personal Information to personnel with a legitimate business need

CargoParse will update these measures as necessary to maintain an appropriate level of security, provided that any updates will not materially degrade the security of the Service.

6. Sub-processors

6.1 Authorization

Customer authorizes CargoParse to engage Sub-processors to process Personal Information in connection with the Service. A current list of Sub-processors is maintained at cargoparse.com/subprocessors.

6.2 Sub-processor Obligations

Before engaging a Sub-processor, CargoParse will:

  • Conduct reasonable due diligence regarding the Sub-processor's security and privacy practices
  • Enter into a written agreement with the Sub-processor imposing data protection obligations no less protective than those in this DPA
  • Remain responsible for the Sub-processor's performance

6.3 Changes to Sub-processors

CargoParse will provide at least 30 days' advance notice of any addition or replacement of a Sub-processor by updating the Sub-processor list and notifying Customer via email to the account on file. If Customer reasonably objects to a new Sub-processor on legitimate data protection grounds, Customer may terminate the Agreement without penalty within 30 days of such notice.

7. Data Subject Rights

CargoParse will provide reasonable assistance to Customer in responding to requests from Data Subjects exercising rights under Applicable Privacy Laws (including rights of access, correction, deletion, and portability). Customer is responsible for verifying the identity of Data Subjects and determining whether requests must be fulfilled.

Customer may fulfill many such requests directly through the Service's self-service features (data export, document deletion, account deletion). For requests requiring CargoParse assistance, Customer may contact support@cargoparse.com.

8. Deletion and Return of Personal Information

Upon termination of the Agreement, and subject to the retention periods set out in the Agreement, CargoParse will delete or return Personal Information to Customer in accordance with its standard data deletion practices. Customer acknowledges that some Personal Information may be retained in backup or archival systems for a commercially reasonable period before permanent deletion.

Customer may at any time delete individual documents or the entire account through the Service's self-service features.

9. Security Incident Notification

CargoParse will notify Customer without undue delay, and in any event within 72 hours after becoming aware of a Security Incident affecting Customer's Personal Information. The notification will include, to the extent known at the time:

  • A description of the nature of the Security Incident
  • The categories and approximate number of Data Subjects affected
  • The categories and approximate volume of Personal Information affected
  • The likely consequences of the Security Incident
  • The measures taken or proposed to address the Security Incident and mitigate its effects

CargoParse will provide reasonable cooperation to Customer in investigating, mitigating, and remediating Security Incidents, and in making required notifications to regulators or Data Subjects.

Notification of a Security Incident is not an acknowledgment of fault or liability.

10. Audits

Customer may verify CargoParse's compliance with this DPA by:

  • Reviewing documentation CargoParse makes available regarding its security and privacy practices
  • Submitting reasonable written questions to support@cargoparse.com, which CargoParse will respond to within a reasonable timeframe

Any on-site audit or penetration testing requires separate written agreement, reasonable advance notice, confidentiality obligations, scheduling to minimize disruption, and Customer bearing its own costs. CargoParse may, at its discretion, substitute independent third-party audit reports (such as SOC 2 reports, if available) for direct audits.

11. International Data Transfers

The Service is hosted in the United States (AWS us-east-1 region). By executing this DPA, Customer acknowledges that Personal Information will be processed in the United States.

If Customer wishes to transfer Personal Information subject to the EU/UK/Swiss GDPR or similar cross-border transfer regulations, Customer and CargoParse will enter into additional transfer mechanisms (such as the Standard Contractual Clauses) as a separate written agreement. Absent such additional agreement, Customer agrees not to upload Personal Information subject to such cross-border transfer requirements.

12. Liability

The liability of each party under or in connection with this DPA is subject to the limitations and exclusions in the Agreement.

13. Term and Termination

This DPA takes effect upon execution and remains in effect for the duration of the Agreement. Termination of the Agreement automatically terminates this DPA, subject to provisions that by their nature survive termination (including Sections 8, 9, 12, and this Section 13).

14. Miscellaneous

14.1 Order of Precedence. In case of conflict: (a) this DPA controls over the Agreement with respect to processing of Personal Information; (b) mandatory requirements of Applicable Privacy Laws control over this DPA.

14.2 Amendments. CargoParse may update this DPA from time to time to reflect changes in Applicable Privacy Laws or our practices. Material changes will be communicated with at least 30 days' notice, and Customer may terminate the Agreement without penalty if it reasonably objects to the changes on data protection grounds.

14.3 Governing Law. This DPA is governed by the same governing law as the Agreement.

15. Execution

This DPA becomes effective when Customer electronically accepts it in their CargoParse account under Profile & Security → Data Processing Agreement. The acceptance record includes the DPA version, timestamp, IP address, typed signatory name and title, and the accepting user's identity — this record is the binding execution and is available to Customer on request.

For procurement teams that require a countersigned PDF copy (for example, to route through internal review or an e-signature platform), email support@cargoparse.com with the signatory's name, title, and the legal entity name. We will return a countersigned PDF within 5 business days.

---

← Back to CargoParse