Data Processing Addendum
1. Roles
Customer is the data fiduciary (controller) of personal data in its content. We are its data processor and act only on its documented instructions, which include these terms and its use of the service.
2. Details of processing
| Subject | Hosting and processing data to provide Spacevera |
|---|---|
| Duration | The subscription, plus the export and deletion period |
| People | Customer's staff, clients, contractors, suppliers and site workers |
| Data | Names, contact details, roles, and personal data in project records, documents, photos and drawings |
| Sensitive data | Not needed for the service. Customer should not upload it unless the parties agree in writing. |
3. Our duties
- Keep data confidential and limit access to staff who need it.
- Apply the security measures in section 5.
- Help Customer respond to requests from individuals and regulators, as is reasonable.
- Tell Customer if we believe an instruction breaks the law.
4. Subprocessors
Customer authorizes the listed subprocessors. We will give at least 30 days' notice of a new one. Customer may object on reasonable data protection grounds, and if we cannot resolve the objection, may end the affected service. We bind subprocessors to equivalent data protection duties and remain responsible for them.
5. Security
- Encrypted connections between users and the service.
- Hashed passwords, role-based access and single sign-on options.
- Logical separation of customers' data.
- Audit logs of significant actions.
- Daily backups, kept for 14 days.
6. Personal data breach
We will notify Customer without undue delay, and within 72 hours, after we become aware of a personal data breach affecting its data. We will share what we know and help Customer meet its duties.
7. Transfers
Data may be processed in the countries shown on the subprocessor list. We follow any restriction set under Indian law. For EEA or UK data, the parties will use an approved transfer mechanism on request.
8. Audits
We will provide information reasonably needed to show compliance. Customer may audit once a year on 30 days' notice, during business hours, under confidentiality, and without access to other customers' data.
9. Return and deletion
When the subscription ends, Customer may request an export for 30 days. We then delete Customer's data within 30 days. Backups expire within 14 days after that. We keep only what the law requires.