DPA Annex A — Processing Details
Version: 2026-10-13-draft
Executed between: To be confirmed: legal entity name and To be confirmed: customer legal name under DPA dated To be confirmed: dpa effective date. Processing-role approval: To be confirmed: data role model approval.
1. Subject, nature, purpose and duration
| Item | Agreed processing detail |
|---|---|
| Subject matter | Hosted management of Company/Project workspaces, memberships, role settings, inspection and incident records, observations, corrective actions, permits, daily reports, risk, schedule/P6/XER, commercial, equipment/assets, documents, notifications, reports, APIs and authorized exports |
| Nature of processing | Collection, upload, organization, storage, retrieval, display to authorized Project users, searching/filtering, workflow processing, controlled sharing, secure attachment delivery, export, audit, backup, correction and authorized deletion; conditional analysis by approved AI providers only where separately activated |
| Purpose | Supply and secure subscribed SiteAxis workflows for Customer-selected construction or infrastructure Projects; support and incident investigation as permitted |
| Duration | Order Term plus approved controlled export/retention/backup/legal-hold periods in Annex E; specific values To be confirmed: termination export window days, To be confirmed: primary data deletion days, To be confirmed: backup max age days |
| Frequency | Ongoing as Customer/users interact with the Services, and episodic for imports, exports, support and approved retention actions |
| Processing and hosting locations | To be confirmed: hosting primary region, To be confirmed: database region, To be confirmed: subprocessor processing regions; do not treat a serverless function region alone as complete data-residency evidence |
| Authority for joint Projects | To be confirmed: customer project authority model, governed by the Project Collaboration Schedule |
2. Categories of Data Subjects
- Customer and participating company employees, users, admins, project managers, schedulers, inspectors, site contacts, client representatives, contractors and subcontractor personnel.
- Incident reporters, injured workers, witnesses, supervisors, affected persons and other persons named in safety or environmental evidence; some may not have SiteAxis accounts.
- Persons appearing in photographs, attachments, witness statements, permits, drawings and imported records.
- Project supplier and consultant contacts, field operators, approvers and authorized external reviewers.
- Other identified individuals whose information Customer lawfully uploads into configurable record fields or files, subject to reasonable data minimization.
3. Categories of Personal Data
| Category | Examples and qualification | Handling requirement |
|---|---|---|
| Account and access | Names, work emails, company affiliations, job titles, project access, invited user status, role and MFA state | Distinguish Customer-controlled roles from SiteAxis's own account/security purposes |
| Project administration and contacts | Contractor/subcontractor business links, inspectors, superintendents, client and contractor representatives, location/sublocation assignment, authorized personnel lists | Project/tenant scope and legitimate multi-company visibility |
| Operational evidence | Reports, inspection answers, corrective actions, observations, comments, author/reviewer identities, activity history, photos, document versions and files | Restricted access, necessary collection, auditability |
| Safety / injury-related data | Injured worker name/company/trade/supervisor, medical attention category, affected body part, witness identity/statements, incident chronology, photos, injury summaries | Potentially sensitive; apply verified access/retention rules and To be confirmed: allowed injury data scope |
| Locations and timestamps | Project location and sublocation, site evidence location, inspection/request times, optional device-derived weather/geolocation when enabled | Collect only where relevant and lawful; inform users where geolocation access is requested |
| Schedule/commercial | Imported schedule assignments, planners/approvers, variations, contract contacts, invoices/references in uploaded files | Do not presume numeric/schedule data is non-personal |
| System/security metadata | Login, session/account, scoped audit and safe abuse event metadata, IP/device/network details if processed by hosting/provider | Service operational purposes may involve independent SiteAxis-controller processing |
| Billing/account management | Business contact, subscription and invoice metadata processed by SiteAxis as contracting party | Outside Customer-processor instructions to the extent SiteAxis decides own billing/tax purposes |
| Optional AI inputs/outputs | Uploaded text, document/image derivatives and generated project summaries only if authorized | No AI transfer of real customer data until To be confirmed: approved ai feature scope and provider controls confirmed |
*Do not import the generic General Legal template's assumption that all sensitive data is excluded. SiteAxis safety/incident workflows are designed to accept some injury-related information. Allowed and restricted classes require a completed business, employment/privacy and legal assessment. This does not* imply SiteAxis is HIPAA-eligible or permitted to process any category of medical records.
4. Prohibited or specially controlled data
Unless approved in writing under an Order Form and supported by controls, Customer must not deliberately submit full payment-card credentials, account passwords, authentication tokens, government identity scans/numbers, biometric templates used for identification, extensive medical histories unrelated to incident management, children’s records or data prohibited by law. The approved exception matrix is To be confirmed: additional sensitive data controls. Incident injury fields necessary for a lawful HSE workflow are not categorically excluded; they remain sensitive and subject to documented controls.
5. Role map by processing context
| Processing context | Proposed legal role | Evidence / decision |
|---|---|---|
| Customer-owned Project Records | Customer/authorized Project Sponsor generally controller or organization; SiteAxis processor/service provider | Proposed; requires project relationship analysis To be confirmed: data role model approval |
| Participation by separately contracted GC/owner/subcontractor | Could be independent controllers or other arrangement depending on project contract and real control | Do not assume all parties are subprocessors; resolve To be confirmed: customer project authority model |
| SiteAxis public website inquiries, direct sales and CRM | SiteAxis may be independent controller/organization | Privacy Policy applies; provider facts pending |
| SiteAxis account/billing, fraud/abuse, legal and tax compliance | SiteAxis may be independent controller for specified purposes | Identify disclosure and data retention separately |
| Authorized AI subcontracted processing | Depends on approved service, provider contract and actual purpose | To be confirmed: approved ai feature scope is mandatory before real personal data |
| Customer-specific hosted processing with cross-border access | Processor/service provider subject to applicable transfer obligations | Annex C/D verification required |
6. Customer obligations and instructions
Customer must furnish valid collection notices/grounds, role assignments and retention instructions; assess employment-related and health-sensitive data where applicable; identify legitimate recipient organizations; approve project/location access; maintain legal holds; and promptly update revoked roles. SiteAxis must follow lawful documented processing instructions within capabilities and approved schedules, preserve tenant/project authorization boundaries and provide agreed assistance.
7. Review record
Business owner: To be confirmed: privacy officer name · Data map revision: To be confirmed: data inventory approval version · Last verified: To be confirmed: processing facts last verified · Counsel sign-off: To be confirmed: counsel approval reference.
Questions before controlled trial use?
Contact SiteAxis before sharing production customer data, provider secrets, or sensitive screenshots.