Data Processing Addendum
This addendum applies where we process personal data on your behalf and forms part of the Terms of Service.
Roles. You are the Data Fiduciary. We are the Data Processor.
Scope of processing. Subject matter: photographs of a construction or fit-out site, project drawings, and specifications. Duration: the term of your subscription plus the retention periods at /privacy. Nature and purpose: automated assessment of physical work progress and workmanship. Categories of data principals: persons who may incidentally appear in site photographs. Categories of personal data: facial images, blurred irreversibly at ingestion. No special-category or biometric data is processed.
Our obligations. We will: process only on your documented instructions; apply the security measures at /security; ensure personnel are bound by confidentiality; assist you in responding to data principal requests; notify you of a breach without undue delay and within 24 hours of confirmation; delete or return data on termination; and make available the information reasonably needed to demonstrate compliance.
Your obligations. You will: ensure you have a lawful basis and the legal right to photograph the site and upload the images; give every person at the site clear written notice that photographs are being captured and analysed, and for what purpose; not upload personal data beyond what the purpose requires; and not instruct us to act unlawfully.
Sub-processors. You authorise the sub-processors listed at /sub-processors. We give 30 days' notice before adding one, and you may terminate without penalty if you object.
Transfers. Site media is not transferred outside India.
Audit. Customers on the Contractor tier may audit compliance once per year on 30 days' notice, subject to confidentiality.
Deletion. On termination we delete all site media within 30 days and confirm in writing.
Contact: dpa@oneeye.in