Data Processing Addendum

For personal information that your organisation ("the controller") submits to the platform, the operator acts as processor and processes that information only on documented instructions from the controller.

This addendum applies for the duration of your organisation's subscription to the Service and continues thereafter for as long as the operator retains personal information on the controller's behalf.

The categories of data subjects and personal information processed correspond to the controller's use of the Service — typically organisation members and individuals referenced in project, register, approval and document records.

The operator maintains technical and organisational measures appropriate to the risk, as summarised on the Security page.

The operator may engage subprocessors for hosting, authentication, storage, AI inference and email delivery. The current list is available on request and the operator remains responsible for subprocessor compliance with terms equivalent to those of this addendum.

Where transfers occur between jurisdictions, the operator relies on the lawful transfer mechanisms applicable to those jurisdictions.

The operator will provide reasonable assistance to the controller in fulfilling its obligations to respond to data subject requests and security incidents, taking into account the nature of the processing and information available.

At the controller's election and on termination of the subscription, the operator will return or delete personal information processed on the controller's behalf, subject to any retention required by applicable law.

The operator will make available information reasonably necessary to demonstrate compliance with this addendum, on reasonable notice and without compromising the security or confidentiality of other customers.

Requests under this addendum should be directed to the contact published on the Security page.