This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Construct Software Ltd (“we”, the “Processor”) and the organisation that uses our Services (“you”, the “Controller”). It applies from 22 October 2026, whenever we process personal data on your behalf. It is accepted by your organisation’s administrator for the organisation.
1. Definitions
In this DPA, “Data Protection Law” means the UK GDPR, the Data Protection Act 2018 and any other data protection law that applies to the processing, and, where it applies, the EU GDPR. “Personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meanings given in Data Protection Law. “Customer Personal Data” means the personal data in your content that we process for you under the Terms of Service. “Sub-processor” means a third party we engage to process Customer Personal Data.
2. Roles and scope
2.1 You are the controller and we are the processor of Customer Personal Data. Where your organisation is itself a processor for another organisation (for example as a service provider managing a client’s account), we are your sub-processor and you confirm that your client has authorised our appointment.
2.2 The subject matter, nature, purpose and duration of the processing, the types of personal data and the categories of data subjects are set out in Annex 1.
2.3 This DPA does not apply to personal data for which we are the controller, such as user accounts, sign-in records and billing contacts. Our Platform Privacy Notice covers that data.
3. Your responsibilities
3.1 You are responsible for having a lawful basis for the processing, for the accuracy of Customer Personal Data, and for giving data subjects any information Data Protection Law requires, including about our role.
3.2 You must not instruct us to process personal data in a way that breaks Data Protection Law, and must not put special category or criminal offence data into the Services unless a Service is designed for it and you have a lawful basis.
4. Our obligations
4.1 Instructions. We process Customer Personal Data only on your documented instructions, which are the Terms of Service, this DPA and your use and configuration of the Services, unless the law requires otherwise. If the law requires us to process it otherwise, we will tell you first unless the law prevents us. We will tell you if we believe an instruction breaks Data Protection Law.
4.2 Confidentiality. We make sure that everyone we authorise to process Customer Personal Data is bound by a duty of confidentiality.
4.3 Security. We take the technical and organisational measures described in Annex 2 to protect Customer Personal Data, appropriate to the risk. We may update those measures, provided the overall level of security is not reduced.
4.4 Data subject requests. Taking into account the nature of the processing, we help you, by appropriate measures and within the functions of the Services, to respond to requests from data subjects to exercise their rights. If we receive a request directly that relates to Customer Personal Data, we will pass it to you without undue delay and will not respond to it ourselves except on your instructions. You instruct us to deal directly with requests from people invited to meetings through MeetingScheduler, who have no account, for a copy of their invitation details or for those details to be deleted: we find their invitations by email address, send them a copy, or delete their details from every meeting they were invited to. The meeting organiser sees that an invitee was removed at their request.
4.5 Assistance. We give you reasonable help, taking into account the information available to us, with your obligations on security, personal data breach notification, data protection impact assessments and prior consultation with the Information Commissioner.
4.6 Personal data breaches. We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. We will give you the information you reasonably need to meet your own obligations, as it becomes available, and take reasonable steps to contain the breach and reduce its effects.
4.7 Records and audits. We make available to you the information reasonably necessary to show that we comply with this DPA, and allow for and contribute to audits, including inspections, by you or an auditor you appoint. Audits are limited to once a year unless a breach has occurred or a regulator requires one, must be on at least 30 days’ notice, during normal working hours and under a duty of confidentiality, and are at your cost. We may first answer your questions in writing or provide existing reports, if that is enough to show compliance.
5. Sub-processors
5.1 You give us general authorisation to engage sub-processors. The sub-processors we use for each Service are listed in the supplement for that Service in our Platform Privacy Notice.
5.2 We will tell you at least 30 days before we add or replace a sub-processor that handles Customer Personal Data, by publishing a new version of the relevant supplement and notifying your organisation’s administrators. If you object on reasonable data protection grounds, we will discuss your concerns in good faith. If we cannot resolve them, you may end your subscription to the affected Service without penalty and we will refund any fees paid for the period after it ends.
5.3 We impose on each sub-processor, by written contract, data protection obligations that give at least the same level of protection as this DPA. We remain responsible to you for the performance of our sub-processors.
6. International transfers
We store Customer Personal Data in the United Kingdom and the European Union. We, and our sub-processors, transfer Customer Personal Data outside the UK only where Data Protection Law allows it, for example to a country covered by UK adequacy regulations, or with appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
7. Return and deletion
7.1 You can export Customer Personal Data using the export features in each Service while you have access. On your request while you use a Service, or within 90 days after your subscription to it ends, we will return Customer Personal Data by providing the export described in the Terms of Service, section 8.6.
7.2 When your subscription to a Service ends, we keep Customer Personal Data in that Service for 90 days from the day we tell your administrators that it has ended, so that you can export it or restart the subscription, and then delete it. We keep it longer if the law requires it, if you ask us to, while a dispute or legal claim about your account is being resolved, or for a short time while we finish an export you asked for or make sure you have been told. In ContractorCompliance, information contractors hold in their own portal accounts, which they may share with other organisations, is not deleted with your data; your own records about them are. Deleted data remains in our backups for a limited period, normally no more than 90 days, and is then permanently removed. Copies made for an export are deleted when the download link expires, normally 7 days after the export is made available and never more than 15 days after it was made. MeetingScheduler has no subscription; its supplement explains what happens to meetings, and to exports, when access to it ends. Until deletion, this DPA continues to apply.
8. Liability and duration
8.1 The limits and exclusions of liability in the Terms of Service apply to this DPA, to the extent Data Protection Law allows.
8.2 This DPA lasts for as long as we process Customer Personal Data for you.
8.3 If this DPA and the Terms of Service conflict, this DPA takes priority in relation to Customer Personal Data.
Annex 1: Details of the processing
| Subject matter | Providing the Services described in the Terms of Service. |
|---|---|
| Duration | For as long as you use the Services, and until deletion under section 7. |
| Nature and purpose | Hosting, storing, organising, displaying, transmitting, backing up, exporting and deleting Customer Personal Data so that you can use the Services; sending the emails and messages you set the Services to send; providing support. |
| Categories of data subjects | Your staff and users; your contractors, subcontractors, suppliers and service providers and their staff; engineers, testers and inspectors; applicants; site contacts, building occupants and visitors; people you invite to meetings; people who submit information through public pages linked to your account. |
| Types of personal data | Names, job titles, company names, business contact details; qualifications, accreditations, insurance and compliance documents; signatures; photographs (which may show people incidentally) and their location; records of work, tests, inspections, permits and meetings; any other personal data you choose to put into the Services. |
| Additional data in ContractorCompliance | For contractors’ employees: dates of birth, National Insurance numbers, photographs, right-to-work documents and status, training and induction records, and DBS check status and date. |
| Additional data in ContractorApplications | Subcontractors’ bank account names, sort codes and account numbers, VAT numbers and payment records. |
| Special category and criminal offence data | No special category data is intended. ContractorCompliance can hold DBS check status, which is criminal offence data: you must have a lawful basis and a condition under Schedule 1 of the Data Protection Act 2018 before recording it. You must not put special category data into the Services. |
Annex 2: Security measures
- All connections to the Services are encrypted in transit (HTTPS/TLS).
- Uploaded files are encrypted with AES-256 before they are stored, where the Service supports it (the supplement for each Service says which), and selected sensitive fields are encrypted in our databases.
- Each organisation’s data is kept logically separate, and access within an organisation is controlled by role.
- Sign-in is protected by password hashing, account lockout after repeated failures, and optional two-step verification by authenticator app, email or SMS.
- Our staff access Customer Personal Data only where needed to provide or support the Services, using individual accounts with role-based permissions and two-step verification, and significant actions are recorded in audit logs.
- Servers and databases are hosted in UK data centres. Uploaded files are stored on those servers or in EU-jurisdiction storage, as the supplement for each Service says. Deleted data remains in our backups for a limited period, normally no more than 90 days. Our hosting provider keeps its backups on separate, isolated backup systems, and holds ISO 27001 (information security) and ISO 22301 (business continuity) certification, Cyber Essentials Plus and an independent SOC 2 Type 2 report.
- Exports made at your request are encrypted by us before they are stored in EU-jurisdiction storage, can be downloaded only by your organisation’s administrators after signing in, and are deleted when the download link expires.
- Software is kept up to date, and configuration and secret files are protected from public access.
- We review these measures regularly and after any security incident.
Construct Software Ltd
Registered in England and Wales, company number [COMPANY NUMBER]
Registered office: [REGISTERED ADDRESS]
Data protection contact: compliance@constructsoftware.co.uk