Data processing agreement
Version: 2026-11-12 ·
This data processing agreement (GDPR Art. 28) sets out how MB Tilfortis (trading as Tillforty), company code 304448018, Jurbarko g. 2A, Kaunas, Lithuania (the „Processor“) processes the personal data that a client (the „Controller“) enters into, or sends to, the OpenTMS system.
It forms part of the services agreement. Where the Controller uses the system without a signed agreement, this one applies from the moment they begin using it.
Data we process for our own purposes — website enquiries and correspondence — is covered by the privacy policy, not by this agreement.
1. The parties and their roles
The Controller is the company using OpenTMS. It decides what data goes into the system and what it is used for, and is responsible for the legal basis.
The Processor is MB Tilfortis. It processes the data only to deliver the service, and only on the Controller’s instructions.
The Controller’s instructions are: this agreement, the services agreement, and what the Controller’s users do inside the system. Any other instruction is given in writing.
2. Subject matter, data and data subjects
Subject matter and purpose: providing a transport management system — orders, trips, trucks, driver tasks, documents and invoices.
Nature: storing, displaying, editing and transmitting data between parts of the system and its sub-processors, and taking backups.
Duration: for the term of the services agreement, and thereafter for the period in section 10.
| Data subjects | Categories of data |
|---|---|
| The Controller’s staff (dispatchers, managers, accountants) | Name, work email, phone, role, login credentials, a history of their actions in the system |
| Drivers | Name, phone, language, assigned tasks and trips, delivery confirmations, notes |
| Contact people at the Controller’s clients and carriers | Name, role, email, phone, company |
| Consignors and consignees | Loading and unloading contacts, addresses, and the names and signatures on documents such as CMRs |
The system is not intended for special-category data (GDPR Art. 9). The Controller undertakes not to put such data into it unless agreed in writing.
3. The Controller’s obligations
- have a legal basis for the data it puts into the system, and inform its own data subjects;
- upload only the data that transport and accounting actually need;
- manage its own users’ access, and switch off people who have left in good time;
- tell the Processor promptly if instructions change, or if data turns up in the system that should not be there.
4. The Processor’s obligations
- process the data only on the Controller’s documented instructions, including on transfers outside the EEA;
- ensure everyone with access is bound by confidentiality;
- apply the security measures in section 5;
- help the Controller answer data subjects (access, rectification, erasure, portability) — the system has export and editing tools for this, and where they are not enough we help by hand;
- help the Controller meet its Art. 32–36 duties, including a data protection impact assessment;
- tell the Controller if, in the Processor’s view, an instruction breaches the GDPR.
5. Security measures
- data travels only over an encrypted connection (HTTPS/TLS);
- access is through personal accounts with rights matched to the job; shared accounts are not used;
- the Processor’s staff reach the Controller’s data only as far as support or fixing a fault requires;
- backups are taken regularly and their restoration is tested;
- an action history makes it traceable who changed a record and when;
- servers and databases are kept in the EU.
The measures may change, but not downwards.
6. Sub-processors
The Controller agrees to the sub-processors listed below. Each is under a contract meeting GDPR Art. 28, and the Processor answers for their work as for its own.
| Sub-processor | What it does | Where |
|---|---|---|
| Hetzner Online GmbH | Servers and backups | Germany (EU) |
| Noium | Document recognition, invoices and accounting data | EU |
| Oaura | The AI agent and the support window | EU |
A new sub-processor is announced by email at least 30 days in advance. If the Controller objects on reasonable grounds within that time and no solution is found, it may terminate the services agreement with no further charge for the remaining term.
7. Transfers outside the EEA
The system and its backups are kept in the EU. If any processing were to require a transfer outside the EEA, it would happen only under the European Commission’s standard contractual clauses or another ground in GDPR Chapter V, and the Controller would be told in advance.
8. Personal data breaches
On becoming aware of a personal data breach, we tell the Controller without undue delay and no later than 48 hours afterwards. The notice says what happened, which data and roughly how many people it touched, the likely consequences, and what we have done about it.
Notifying the supervisory authority and the data subjects is the Controller’s to do; we provide everything needed for it.
9. Audits
On request we provide the information needed to show that we meet this agreement. The Controller may audit us, itself or through an auditor who is not our competitor, no more than once a year and on 30 days’ notice. Audits happen during working hours, without disrupting other clients, and at the Controller’s cost unless they find material non-compliance.
10. Return and deletion
When the services agreement ends, the Controller has 30 days to export the data itself or to ask us for a copy in a common format.
90 days after the end we delete the data from the live system; it then ages out of the backups on their rotation. Where law requires something to be kept longer, we keep only that, and only for as long as required.
11. Final provisions
Where this agreement and the services agreement conflict on personal data, this one prevails.
We may update it when the law, the security measures or the sub-processor list changes; updates are emailed and the version date at the top moves. A previous edition is available on request.
Questions about this agreement: hello@opentms.app.
This English text is a translation provided for convenience. The Lithuanian version is the original and prevails if the two differ.