Business Agreements

1. Part 1. Service Terms
2. Part 2. Company Data Processing Agreement
3. DPA Schedule 1. Processing description
4. DPA Schedule 2. Security measures
5. DPA Schedule 3. Subprocessors
6. Part 3. Mutual Confidentiality Addendum

Part 1. Service Terms

These terms apply only to the features and account type you use. They are part of the Terms of Use and do not authorize new services or data processing by themselves.

1. Company subscription and recruiting

Every company account gets its first calendar month free from the moment its company profile is created, calculated as described in Terms Section 8. The free month isn't delayed until verification, first use, adding a card or publishing a job, and adding a card later doesn't restart it. During the free month the company gets Starter plan limits, and verified companies' job posts can be published. No card is needed and nothing is charged automatically: if the company doesn't subscribe, paid features stop at the end of the free month, while its data stays saved and viewable. If verification materially prevents use of the free month, contact us and we'll look into an appropriate extension. Creating duplicate accounts, using false identities or reopening a company to obtain another free month is prohibited. The launch promotion for the first 10 companies and first 10 service providers is described in Terms Section 8: its three free months start when the paid subscription starts, after any remaining free month.

Companies must identify the recruiting organization and the actual opportunity, give required pay and location disclosures, respect drivers' application choices and make lawful decisions. They may not export application information for unrelated marketing or another company's hiring without a lawful basis and appropriate notice or authorization. A driver's choice to share an application is not consent to consumer reports or marketing outreach. GigReadyGo does not guarantee applicants, qualifications or hires.

2. Route and dispatch software

Companies supply and approve assignments, business terms, routes and instructions. GigReadyGo is not a party to any transportation contract, doesn't select a carrier on a user's behalf and doesn't decide whether a driver should accept work. Users must resolve and document compensation, cancellation, cargo, insurance, safety and service obligations in their own lawful arrangements. Platform status changes are workflow records, not proof that every contractual or regulatory requirement has been met.

Do not direct drivers to violate safety or hours-of-service rules or to use the app while driving unsafely. Routing and timing estimates may not account for every vehicle restriction, weather or road condition. Route location is collected only as described in Terms Section 12, and only authorized company users can see route data. The Platform is not an emergency service or a substitute for required logs and driver qualification records.

3. Driver accounts, membership and applications

Driver profiles, readiness checks, matches and routes assigned by a company whose roster the driver is on are free. Applying to jobs through GigReadyGo and accepting marketplace route offers from other companies are free during the driver's first calendar month and then require Driver Membership at $19.99 per month, which renews monthly until canceled and can be canceled anytime under Billing > Manage billing. Nothing is charged unless the driver subscribes. Companies and providers may not use the Platform to charge drivers an application fee. A driver can review and correct profile information and choose application recipients. Readiness results are informational and don't promise approval, earnings or work. Companies make their own lawful decisions, including worker-status determinations, and drivers keep their employment and privacy rights regardless of the wording in a posting.

Company screening may require a separate disclosure and authorization. No profile checkbox gives access to driving records or background reports, and GigReadyGo does not offer a consumer-report product.

4. Service-provider listings and requests

Providers must state their legal business identity, material service limits, required credentials and accurate prices or quoting method. A request or referral alone isn't a completed service contract; before work starts, the provider and customer must agree directly on scope, price, taxes, timing, cancellation, refunds and any required consumer disclosures. Providers perform their own services and are responsible for their licenses and insurance. Membership fees pay for Platform access only: GigReadyGo does not collect, hold, split or release payments for third-party services or transportation. Verification covers only the checks described and is not a guarantee of workmanship or legitimacy. Report misleading or unsafe listings to support@gigreadygo.com.

5. Advertising, reviews and leads

Paid prominence is labeled where required and is never presented as a neutral qualification or safety endorsement. Advertising requires a separately accepted campaign order. If reviews are offered, they must reflect genuine experiences; fake reviews, undisclosed paid endorsements and unlawful suppression of reviews are prohibited. Lead information (including Source Leads) doesn't transfer ownership of anyone's information or give permission to call, text or email; users must have a lawful basis for outreach and honor contact restrictions and opt-outs.

Part 2. Company Data Processing Agreement

This Data Processing Agreement ("DPA") is between GigReadyGo LLC and the company or service provider that accepted the Terms of Use ("Customer"). It takes effect when Customer accepts the Terms of Use.

1. Scope and roles

This DPA covers personal information that GigReadyGo processes on Customer's behalf to provide the Platform services ("Customer Personal Data"). For that processing, Customer is the controller or business and GigReadyGo is the processor, service provider or contractor, as applicable. If Customer acts as a processor for another organization, Customer must have authority to appoint GigReadyGo and pass through lawful instructions. Actual roles are determined by applicable law and the facts. This DPA does not cover GigReadyGo's own account administration, billing or legally required processing, which our Privacy Policy describes; those activities may not be used to get around this DPA. Receiving a driver-directed application does not authorize unrelated resale or use.

2. Instructions and permitted purposes

Customer instructs GigReadyGo to process Customer Personal Data only to: host and maintain Customer's authorized users and records; deliver Customer-directed recruiting and applications; support Customer-approved route, status, location and proof-of-delivery workflows; operate selected service-provider workflows; troubleshoot and secure those services; and return or delete data as directed (Schedule 1). The Terms, the features Customer turns on and documented support requests are instructions within that scope. GigReadyGo will tell Customer if it believes an instruction violates privacy law and may pause that instruction while the parties resolve it. A materially new purpose or data category requires a documented agreement and any required notices or consents. If the law requires processing outside Customer's instructions, GigReadyGo will tell Customer unless legally prohibited and will limit processing to what is required.

3. Restrictions and California terms

GigReadyGo will not sell or share Customer Personal Data as those terms are defined in California privacy law; retain, use or disclose it for purposes other than the contracted purposes; use it for an unrelated commercial purpose; or retain, use or disclose it outside the direct business relationship, except as the law expressly allows. GigReadyGo will not combine it with data from another customer or its own interactions with individuals except as the law permits and consistent with the contracted purpose, and will not use identifiable Customer Personal Data for general-purpose AI training or cross-context behavioral advertising. GigReadyGo will comply with applicable privacy obligations, provide the level of protection the law requires, and promptly tell Customer if it can no longer meet these requirements. Customer may take reasonable steps to verify compliance and to stop and remediate unauthorized processing, including under Section 8. GigReadyGo certifies that it understands and will comply with these restrictions.

4. Customer responsibilities

Customer must have a lawful basis and give required notices and obtain required permissions or consents for the data it provides and the instructions it gives, including for employee and applicant data and precise location. Customer must limit uploads and access to authorized purposes, keep information accurate and handle lawful rights requests. Customer must not use the Platform to bypass FCRA, driver-record, employment, transportation or sensitive-data obligations.

5. Confidentiality and security

GigReadyGo limits access to Customer Personal Data to personnel with a legitimate need who are bound by confidentiality, and maintains the safeguards in Schedule 2. GigReadyGo will not materially reduce overall protection during the service term. Customer is responsible for its account permissions, its own systems and lawful use; GigReadyGo is responsible for safeguards within its control.

6. Subprocessors

Customer authorizes the subprocessors in Schedule 3. GigReadyGo will give at least 30 days' notice before adding or replacing a subprocessor, by email to Customer's account owner and by updating Schedule 3. Customer may object within 15 days on reasonable data-protection grounds; the parties will work in good faith on an alternative, and if none is reasonably available, Customer may end the affected service before the change and receive a refund of unused prepaid fees for it. If an urgent replacement is needed for security or continuity, GigReadyGo will give notice as soon as reasonably practicable and explain why, and Customer keeps its objection and termination remedy. Each subprocessor must be bound by written terms with relevant privacy, security and confidentiality duties, and GigReadyGo remains responsible for its subprocessors' performance.

7. Requests, assistance and security incidents

GigReadyGo will promptly refer requests about Customer-controlled information to Customer, unless the law requires a direct response, and will reasonably help Customer respond to access, correction, deletion, portability and opt-out requests, assessments and regulator inquiries. Ordinary assistance through the Platform is included.

A "Security Incident" is a confirmed or reasonably suspected breach of security leading to accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Customer Personal Data. Unsuccessful attempts that don't compromise data are not Security Incidents. GigReadyGo will notify Customer without undue delay and no later than 48 hours after becoming aware of a Security Incident affecting Customer Personal Data, or sooner if the law requires, without waiting for a complete investigation. The notice will describe the known facts, affected data and people where known, likely consequences, containment and remediation steps, and a contact for follow-up, with updates as facts become known. GigReadyGo will preserve relevant evidence, mitigate the incident and reasonably cooperate. Customer decides its notices to individuals and authorities unless the law separately requires GigReadyGo to notify. Incident notices go to Customer's account owner email, which Customer must keep current.

8. Compliance information and review

On reasonable request, GigReadyGo will provide information needed to demonstrate compliance with this DPA, including descriptions of its security measures. Customer or a qualified independent assessor may conduct a reasonable assessment on advance notice, normally once a year, without accessing other customers' information or disrupting operations, with document review first where sufficient. Additional review is allowed after a material incident, a credible noncompliance concern or a regulator requirement. GigReadyGo does not currently hold third-party security certifications (such as SOC 2 or ISO 27001).

9. Return, deletion and duration

Processing lasts for the service term plus the return and deletion period. On termination, Customer may request an export within 30 days. GigReadyGo will delete or anonymize remaining Customer Personal Data in active systems within 60 days after termination or a documented deletion instruction, subject to the retention exceptions in the Privacy Policy and the law. Backups expire within 14 days after deletion from active systems; until then they stay protected and are not used for any other purpose, and any restored backup will have deletions re-applied. If the law requires retention, GigReadyGo will identify the legal basis where permitted, isolate and restrict the retained data, and delete it when the obligation ends. On reasonable request GigReadyGo will confirm deletion or identify a lawful exception.

10. Location, liability and precedence

Storage and access locations are described in Schedule 3. GigReadyGo will not introduce a restricted international transfer without appropriate safeguards and any required agreement. This DPA is designed for U.S. privacy law and does not include GDPR standard contractual clauses or UK transfer terms. Liability is governed by the Terms of Use, except that nothing limits a regulator's powers, an individual's non-waivable rights, or liability that cannot lawfully be limited. For conflicts involving Customer Personal Data, this DPA controls, and an order form cannot reduce protections the law requires. Obligations about retained data survive while the data is held.

Schedule 1. Processing description

Subject matter: the recruiting, fleet and route, service-provider and account features Customer uses. Nature of processing: collection on Customer's instructions, organization, storage, retrieval, user-directed transmission, access control, correction, export and deletion. Frequency: ongoing during use, and event-based for applications, routes and service requests. Duration: the service term plus the period in Section 9.

Individuals: Customer's authorized users; applicants, drivers and contractors; service-provider contacts; and customers or recipients whose details Customer lawfully uploads. Data categories: contact and professional profile information; organization and role; authorized application contents; route assignments and status; delivery contact and address details; proof-of-delivery photos and signatures; activity records; and precise route location only for drivers who turn on location sharing for Customer's route. No Social Security numbers, immigration documents, bank credentials, biometric identification or health records are authorized; any additional sensitive category requires a written amendment and appropriate controls.

Contacts: Customer's contact is its account owner unless an order form names another privacy or security contact. GigReadyGo's contact is support@gigreadygo.com, 43313 Woodward Ave, #1115, Bloomfield Hills, MI 48302.

Schedule 2. Security measures

• Access: production systems are administered only by GigReadyGo's founder account; company data is separated by organization in every database query, and companies control their own team members' roles and permissions. Access is removed promptly when it's no longer needed.
• Protection: all traffic uses HTTPS encryption in transit; API keys are stored only in hashed form; secret keys are kept in the hosting provider's secret storage and never in code.
• Backups: nightly backups of Platform data, each kept 14 days, with an admin-only download.
• Application security: changes are deployed as versioned releases that can be rolled back; input is validated and sign-in is required for all private data.
• Operations: automated monitoring of scheduled jobs and outside services, alerts to the founder, and a documented outage, backup and rollback procedure.
• Data handling: data minimization (yes/no readiness answers instead of document numbers), self-serve account deletion, and automatic deletion on the schedule in the Privacy Policy.

Schedule 3. Subprocessors

Locations: the Platform serves the United States. Subprocessors may store, process or access data in the United States and in other countries where they or their own providers operate, under their security and contract commitments. GigReadyGo does not use analytics or session-recording vendors. Our website uses a Google Ads tag to measure which of our own ads lead to sign-ups, as described in our Privacy Policy; it receives page addresses, browser and cookie information, not the records companies manage in the Platform.

Part 3. Mutual Confidentiality Addendum

This addendum applies to company and service-provider accounts. "Party" means GigReadyGo or the account's organization.

1. Protected information

Confidential Information is nonpublic information disclosed in connection with the services that is marked confidential or that reasonably should be understood as confidential given its nature or context. It includes private customer lists, nonpublic pricing and commercial terms, operating plans, route details, security information and technical materials. Personal information remains subject to the DPA, Privacy Policy and applicable law even if not marked confidential.

2. Use and protection

The receiving Party will use Confidential Information only to perform or receive the agreed services, exercise its rights under the agreement or comply with law, and will protect it with reasonable care and at least the care it uses for its own similar information. Disclosure is limited to personnel, professional advisers and approved service providers who need to know and are bound by confidentiality duties. The receiving Party is responsible for its representatives' handling. No ownership or intellectual-property license is granted beyond the agreement's stated purposes.

3. Exceptions and required disclosure

Information is not Confidential Information to the extent the receiver can show it was already lawfully known without restriction, became public without a breach, was lawfully obtained from another source without confidentiality duties, or was independently developed without using the protected information. These exceptions don't remove privacy duties under law. A Party may disclose information when legally required by a court, regulator or other authority, giving advance notice where permitted and reasonably assisting a lawful protective request, and disclosing only what is required. Nothing restricts protected whistleblowing, reporting suspected violations to authorities, legally protected discussions or other non-waivable rights.

4. Incidents, return and survival

The receiving Party will promptly notify the disclosing Party of unauthorized use or disclosure and reasonably cooperate to mitigate it; a personal-data incident follows the DPA's more specific notice duties. On written request or termination, the receiver will return or destroy Confidential Information within a reasonable period, subject to required retention, protected short-term backups and legally necessary records, which stay restricted and are not used commercially. Confidentiality duties last three years after termination, and for trade secrets as long as they remain trade secrets under applicable law. Personal-data restrictions continue as long as the DPA and the law require. Either Party may seek lawful injunctive relief where the legal standard is met. The Terms of Use govern other remedies and liability.