GDPR Policy

Last updated: 9 May 2026 · v3.0 · Effective immediately

Applicable Regulations: EU General Data Protection Regulation (2016/679), Irish Data Protection Act 2018

1. Our Commitment

YARDtwin Ltd is committed to full compliance with the General Data Protection Regulation (GDPR). As both a data controller (for our own customer data) and a data processor (handling operational data on behalf of our customers), we implement appropriate technical and organisational measures to protect personal data at every stage.

2. Roles & Responsibilities

YARDtwin as Data Controller: We determine the purposes and means of processing personal data for account management, billing, newsletter subscriptions, and website analytics.

YARDtwin as Data Processor: When our customers enter operational data (appointments, carrier details, driver names, inspection records) into the platform, YARDtwin acts as a data processor on their behalf. Each customer (tenant) is the data controller for their operational data.

Customer Responsibilities: Customers are responsible for ensuring they have lawful bases for the personal data they enter into YARDtwin (e.g. driver names, carrier contact details, vehicle registrations). Customers must inform their own data subjects about data processing through YARDtwin.

3. Data Processing Agreement (DPA)

All customers can review and accept our Data Processing Agreement via the self-service DPA page. Standard and Founder plan customers also receive a countersigned Data Processing Agreement that covers: the scope and purpose of processing, types of personal data processed, categories of data subjects, obligations of both parties, sub-processor management, data breach notification, international transfers, and audit rights. For DPA execution, email admin@yardtwin.com (cc the Data Protection Officer at dpo@yardtwin.com).

4. Technical Measures (Art. 32 GDPR)

4.1 Encryption

All data encrypted in transit (TLS 1.2+). Passwords hashed with bcrypt (12 rounds). PostgreSQL Flexible Server uses transparent data encryption at rest. Azure Blob Storage encrypted at rest. Application-level field encryption (AES-256-GCM) for biometric data (driver licence images, signature images) with keys held in Azure Key Vault. JWT tokens cryptographically signed (HS256). Secrets managed via Azure Key Vault accessed by App Service managed identity — no secrets in code, environment files, or container images.

4.2 Access Control

Role-based access control (RBAC) with six defined roles (admin, ops_manager, gate_guard, warehouse_operator, carrier, super_admin). Principle of least privilege enforced via middleware on every authenticated route. Tenant isolation verified by an automated 25-test cross-tenant audit on every release. SSO supported via Google and Microsoft for multi-factor authentication.

4.3 Audit Trails

Complete audit logging of user actions: user identity, timestamp, IP address, action verb, entity affected, old and new values. GMP-relevant actions flagged separately (is_gmp_relevant=1). Append-only at the application layer; 6-year retention. Pseudonymised but not deleted on Art. 17 erasure (Art. 17(3)(b) legal-obligation override).

4.4 Infrastructure Security

Hosted on Microsoft Azure (Sweden Central + Norway East, EEA). Containerised App Service deployed via Azure Container Registry with staging-slot-then-swap. Only ports 80/443 exposed; PostgreSQL not directly internet-reachable. Azure NSG and Front Door (planned). Application Insights with schema-drift alert on Postgres "column / relation does not exist" errors (15-minute window). End-to-end /health/db-write probe verifies the application can write+read the database on every deploy.

4.5 Data Minimisation

We only collect data necessary for service delivery. Optional driver fields (phone, email) can be left blank where the customer's process allows. Biometric verification is off-by-default per site; site admin opts in. Newsletter only collects email and optional company name.

4.6 Software Supply Chain

Every pull request runs through automated security checks: npm audit (dependency CVEs at HIGH+ block deploy), Trivy (container CVE scan), Semgrep SAST (OWASP top-ten + Node.js + React + secrets rules), gitleaks (secret scan over full git history), and OWASP ZAP (DAST against staging on schedule). Dependabot opens PRs for new CVEs as they're disclosed.

5. Data Subject Rights (Chapter III GDPR)

We facilitate the exercise of all data subject rights:

Right of Access (Art. 15): Users can request a copy of all personal data we hold. Tenant admins can export their organisation's data. All other data subjects (drivers, newsletter subscribers, prospective customers) can submit a request via the DSAR Portal.

Right to Rectification (Art. 16): Users can update their profile data through the Settings page. Tenant admins can update any user within their organisation.

Right to Erasure (Art. 17): Account deletion requests processed within 30 days. Submit via the DSAR Portal. Internally fulfilled by POST /api/v1/dsar/erase/by-email which pseudonymises across all PII tables. Note: audit data is retained 6 years per Art. 17(3)(b) legal-obligation override.

Right to Restrict Processing (Art. 18): Users can request restriction. We will mark the data and cease processing except for storage.

Right to Data Portability (Art. 20): Data can be exported in CSV and JSON formats. Appointment data, carrier data, and audit logs are all exportable.

Right to Object (Art. 21): Users can object to processing based on legitimate interests. Newsletter unsubscribe is available via one-click link in every email.

Right re Automated Decision-Making (Art. 22): YARDtwin does not make solely automated decisions that significantly affect individuals.

6. Consent Management

Newsletter: Explicit opt-in consent required. Consent timestamp and IP recorded. Unsubscribe link in every communication. Consent can be withdrawn at any time without affecting service access.

Service Terms: Account creation constitutes acceptance of Terms of Service (contractual basis). Users are informed during signup about data processing.

Cookies: A cookie consent banner is displayed on first visit in compliance with the ePrivacy Directive. Users can choose essential cookies only or all cookies. Preferences stored locally and can be changed at any time.

7. Data Breach Procedures (Art. 33-34)

Automated Detection: A breach-monitor worker runs every 5 minutes against the audit log and flags anomalies as potential incidents:

≥10 failed logins for one email address in 1 hour
≥5 distinct source IPs targeting one email in 24 hours
Successful login from a source IP not previously seen for that user within the last 30 days
HTTP 5xx error rate > 5% over a 5-minute window
Postgres "column / relation does not exist" errors (schema-drift, App Insights)
/health/db-write probe failure (read+write check on every deploy and continuously)

Breach Register: Every detected anomaly is written to the breach_register table with a state machine (detected → investigating → confirmed → notified → closed), severity, scope, affected data subjects, DPC-deadline countdown, and audit history. Visible in the SuperAdmin "Breach Register" panel.

Alert Routing: Detection events route to Azure Monitor Action Group yardtwin-breach-actions, which emails admin@yardtwin.com plus the on-call addresses on file. Schema-drift events use the existing yardtwin-schema-drift-actions group.

Assessment: Within 24 hours of detection, the technical team triages the incident in the breach-register panel: scope, affected data subjects, severity (Art. 33(1) "risk to rights and freedoms" criterion), and root cause.

Notification to DPC (Art. 33): Within 72 hours of becoming aware of a breach that poses a risk. The breach-register panel shows a live 72-hour countdown timer once the incident is marked confirmed.

Notification to Data Subjects (Art. 34): Without undue delay if the breach poses a high risk to their rights and freedoms.

Notification to Customers: Affected tenant administrators are notified within 48 hours of confirming a breach that affects their tenant's data.

Documentation: Every entry in the breach register is retained for the life of the platform plus 6 years (audit retention), regardless of whether external notification was required.

8. Sub-Processors

Sub-Processor	Purpose	Location	Safeguards
Microsoft Azure	Cloud infrastructure (App Service, Postgres, Blob, Key Vault, App Insights)	EEA (Sweden Central + Norway East)	Microsoft Online Services DPA + EU SCCs, ISO 27001, SOC 2 Type II
Stripe	Subscription billing & payment processing	Stripe Ireland (EEA), some US support	Stripe DPA + SCCs + PCI DSS
Resend	Transactional email (welcome, trial reminders, DSAR responses)	US (Delaware)	DPA + SCCs (verification ongoing)
Google Cloud Vision	Driver licence OCR (where customer enables licence verification)	EU regions	Google Cloud DPA + EU SCCs, ISO 27001, SOC 2
Google / Microsoft (OAuth SSO)	Single sign-on identity tokens for users who choose SSO	EEA (Microsoft Entra ID), Global (Google Workspace)	Microsoft / Google Cloud DPAs
Anthropic	Claude API for in-product AI assistant + licence-OCR text parsing	US (California)	Anthropic DPA + zero-retention claim + SCCs

Customers will be notified 30 days before any new sub-processor is added.

9. Data Protection Impact Assessment (DPIA)

We conduct DPIAs for processing activities that pose high risks to data subjects. Given that YARDtwin processes primarily business operational data (dock schedules, carrier names, vehicle registrations) rather than sensitive personal data, the risk profile is moderate. DPIAs have been completed for: audit trail processing, cross-tenant analytics (platform admin module), and newsletter subscriber management.

10. Data Protection by Design & Default (Art. 25)

By Design: Multi-tenant architecture with mandatory tenant isolation. RBAC built into every API endpoint. Passwords never stored in plaintext. Minimal data collection at every stage.

By Default: New accounts have minimal permissions. Optional fields are truly optional. Newsletter requires active opt-in. Data visibility restricted by role.

11. Compliance Status & Continuous Improvement

Resolved (as of May 2026)

✓ Migration to PostgreSQL Flexible Server (Azure managed, transparent data encryption at rest, 7-day point-in-time recovery)
✓ Migration to Microsoft Azure (Sweden Central + Norway East, EEA) with App Service + ACR + Key Vault
✓ Secrets management via Azure Key Vault (no secrets in .env or container images; managed-identity access)
✓ Automated DSAR auto-export (POST /api/v1/dsar/export/by-email — Art. 15 / 20)
✓ Automated DSAR auto-erasure (POST /api/v1/dsar/erase/by-email — Art. 17 with audit-retention compliance)
✓ Cookie banner v2 with four categories (essential / functional / analytics / marketing) and Reject / Customise / Accept-all
✓ Cross-tenant isolation audit automated; 25/25 cross-tenant access vectors blocked, regression-tested every release
✓ CI/CD security pipeline: npm audit + Trivy + Semgrep + gitleaks + ZAP DAST
✓ Schema-drift alerting on Application Insights (15-minute window)
✓ End-to-end /health/db-write probe verifying writable DB on every deploy
✓ App Insights schema-drift Action Group emails the on-call address on Postgres "column / relation does not exist" errors
✓ Field-level encryption (AES-256-GCM) for biometric data (driver licence images, signature_data)
✓ Automated data retention purge (configurable per site; pii-cleanup worker)
✓ 30-day trial harmonised everywhere (signup, marketing site, terms, emails)
✓ 5,000-truck end-to-end regression test covering every Site Admin endpoint with yard-view fidelity assertions at every transition (53,650/53,651 = 100%)
✓ Data inventory and Records of Processing Activities (Art. 30) published
✓ Sub-processor register maintained and reviewed annually
✓ Privacy by design and by default documented (Art. 25)
✓ Web Application Firewall (Azure Front Door + managed WAF) protecting yardtwin.com with OWASP Core Rule Set, bot-protection, and L7 DDoS mitigation
✓ Automated breach detection — auth-anomaly worker (failed-login spikes, multi-IP attacks, country-change logins), 5xx-rate alerts, schema-drift alerts and /health/db-write probe
✓ Breach register persistent table with full state machine and DPC-deadline countdown, visible in the SuperAdmin panel
✓ Action Group yardtwin-breach-actions emails admin@yardtwin.com and on-call addresses on every detection

Remaining Improvements

11.1 First External CREST Penetration Test

No third-party penetration test has been conducted. Engagement scoped (Cobalt.io, ~€6–8k for web app + authenticated test). Internal testing has cleared 27 findings to date. Priority: High. Target: Q3 2026.

11.2 Data Protection Officer Appointment

An external fractional DPO will be contracted before the first paying enterprise pharmaceutical customer. Required for credible vendor onboarding even where not strictly mandated by Art. 37. Priority: High. Target: Before first paying enterprise customer.

11.3 ISO 27001 Certification

Statement of Applicability skeleton complete, mapping all 93 Annex A controls (~32 IN PLACE, ~25 PARTIAL, ~22 GAP, ~14 NA). External lead-auditor engagement is the next step; full certification path is 9–12 months. Priority: Medium. Target: Q4 2026 — certification audit Q1 2027.

11.4 SOC 2 Type II

Required for US enterprise customers. Best pursued after ISO 27001 is in place — most controls overlap. Priority: Medium. Target: 2027.

11.5 Geo-redundant Secondary Region

YARDtwin runs on Azure App Service with point-in-time backup recovery (7-day window) but is single-region. A geo-redundant secondary in another EEA region can reduce RTO from hours to minutes for region-level failures. Priority: Medium. Target: Q4 2026.

11.6 Resend & Anthropic SCC Verification

Both sub-processors transfer data to the US under SCCs. Written confirmation of FISA 702 supplementary measures is being collected as part of the annual sub-processor review. Priority: Medium. Target: Q3 2026.

11.7 Bug Bounty Programme

A private bug bounty programme (HackerOne / Intigriti) is planned after the second clean external pen test, providing continuous external coverage between annual tests. Priority: Low. Target: 2027.

12. Contact & Data Protection Officer

Data Protection Officer: dpo@yardtwin.com — an external fractional DPO is being contracted (see 11.2); until appointment, mail sent to this address routes to admin@yardtwin.com for handling.

General queries: admin@yardtwin.com

Data Subject Requests: Submit via our DSAR Portal

Data Processing Agreement: Review and accept at /dpa

Supervisory Authority: Data Protection Commission (DPC), Ireland · www.dataprotection.ie · +353 (0)761 104 800