Data Processing Addendum

Last updated: April 21, 2026  ·  Version 1.0

This Data Processing Addendum ("DPA") forms part of the agreement between Inspect360 Suite ("Processor", "we") and the customer organisation ("Controller", "you") for use of the Inspect360 Suite platform (the "Service"). It governs the processing of personal data on your behalf in accordance with the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, and the Saudi Arabia Personal Data Protection Law ("PDPL") where applicable.

1. Definitions

1. Personal Data, Processing, Controller, Processor, Data Subject have the meanings in GDPR Art. 4 and PDPL Art. 1.
2. Sub-processor means any third party engaged by the Processor to process Personal Data on behalf of the Controller. Current sub-processors are listed at /subprocessors.html.
3. SCCs means the Standard Contractual Clauses adopted by Commission Decision 2021/914/EU of 4 June 2021, and — where the UK GDPR applies — the UK International Data Transfer Addendum (IDTA) to those SCCs, each as updated from time to time.
4. Service Agreement means the subscription agreement, order form, or terms of service under which the Controller has purchased or accessed the Service, including the Terms of Service.

2. Roles & Scope

The Controller determines the purposes and means of Processing; the Processor acts on the Controller's documented instructions as set out in the Service Agreement and this DPA. The Processor shall not process Personal Data for any other purpose unless required by applicable law, in which case the Processor shall notify the Controller of that legal requirement before Processing (unless that law prohibits such notification on important grounds of public interest).

3. Subject Matter, Duration, Nature & Purpose

See Annex I below.

4. Processor Obligations

4.1 Instructions

The Processor shall process Personal Data only on documented instructions from the Controller, including with regard to transfers of Personal Data to a third country or international organisation, unless required to do so by applicable law.

4.2 Confidentiality

The Processor ensures that persons authorised to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

4.3 Security (GDPR Art. 32)

The Processor implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk — see Annex II.

4.4 Sub-processors (GDPR Art. 28(2) & (4))

The Controller authorises the Processor to engage the sub-processors listed in Annex III and at /subprocessors.html. The Processor will give the Controller at least 30 days' prior notice by email of any intended addition or replacement of a sub-processor. The Controller may object on reasonable data-protection grounds within that period; if the parties cannot resolve the objection in good faith, the Controller may terminate the affected portion of the Service without penalty. The Processor imposes data-protection obligations on every sub-processor that are no less protective than those set out in this DPA.

4.5 Assistance with Data Subject Requests (Art. 12–22)

Taking into account the nature of the Processing, the Processor assists the Controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Controller's obligation to respond to requests for exercising data-subject rights. Self-service tooling is available in-product: data export (Art. 15 & 20), account deletion (Art. 17, 14-day grace), profile edit (Art. 16), AI disable (Art. 21 / 22).

4.6 Assistance with Security, DPIA & Breach (Art. 32–36)

The Processor assists the Controller in ensuring compliance with GDPR Art. 32 to 36 taking into account the nature of Processing and the information available to the Processor.

4.7 Personal Data Breach (Art. 33)

The Processor notifies the Controller without undue delay and in any event within 72 hours after becoming aware of a Personal Data Breach affecting the Controller's Personal Data. The notification will include, to the extent known, the nature of the breach, categories and approximate number of data subjects and records concerned, likely consequences, and measures taken or proposed.

4.8 Return or Deletion on Termination (Art. 28(3)(g))

On termination of the Service, the Processor will, at the Controller's choice: (a) return all Personal Data; or (b) delete all Personal Data and certify deletion — subject to the retention periods and legal holds described in our Privacy Policy.

4.9 Audits (Art. 28(3)(h))

The Processor makes available to the Controller all information necessary to demonstrate compliance with Art. 28 and allows for and contributes to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller, subject to reasonable confidentiality, security, and scheduling requirements. In practice, the Processor satisfies this via SOC-2-style controls documentation, the sub-processor register, and written responses to customer security questionnaires; on-site audits are available for Enterprise customers under NDA.

5. International Data Transfers

Default customer Personal Data hosting is Singapore (AWS ap-southeast-1) via Supabase. Singapore does not benefit from a UK or EU adequacy decision. Enterprise customers may elect a dedicated tenant in an alternative region — including Saudi Arabia (GCP me-central2, Dammam) for PDPL residency, London (eu-west-2), or Frankfurt (eu-central-1) — documented in the order form. All transfers of UK and EEA Personal Data into the Service, and onward transfers to AI inference providers, transactional email, and payment processing, are governed by:

• The EU Standard Contractual Clauses (2021/914/EU), Module Two (controller-to-processor) between the Controller and the Processor, which are incorporated by reference into this DPA;
• The UK International Data Transfer Addendum where UK Personal Data is transferred; and
• Where applicable, the EU–US Data Privacy Framework for US sub-processors that are certified under it.

Docking clause (SCC Clause 7): additional controllers may accede by signing Annex I.A.

6. Liability & Order of Precedence

Each party's liability under this DPA is subject to the limitations and exclusions of liability set out in the Service Agreement. If and to the extent of any conflict between this DPA, the SCCs, and the Service Agreement, the order of precedence is: (1) the SCCs, (2) this DPA, (3) the Service Agreement.

7. Term & Termination

This DPA takes effect on the earlier of (a) the date it is countersigned by the Controller and (b) the date on which the Controller begins using the Service, and continues until the termination of the Service Agreement and the completion of any post-termination data return or deletion.

Annex I — Details of Processing

I.A Parties

I.B Description of Processing

Annex II — Technical & Organisational Measures (GDPR Art. 32)

Annex III — Sub-processors

The current list of sub-processors is maintained at /subprocessors.html. At execution of this DPA, the sub-processors named in that register are deemed authorised. Changes follow the 30-day notice process in §4.4.

Signature Block

Request a countersigned DPA →