1. Definitions
Capitalised terms have the meanings given in applicable data protection law, including the Jamaica Data Protection Act, 2020 (“JDPA”), the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the UK GDPR where applicable.
2. Roles & scope
The customer is the Controller and Construction OS is the Processor with respect to Customer Personal Data processed to provide the Service. This DPA applies to all such processing for the duration of the customer’s subscription.
3. Details of processing
- Subject matter: provision of the Construction OS construction and property lifecycle management platform.
- Duration: the term of the customer’s subscription plus any post-termination export period.
- Nature and purpose: hosting, storing, transmitting and processing Customer Data to deliver the Service and support.
- Categories of data subjects: customer’s employees, contractors, project participants and any individuals referenced in Customer Data.
- Categories of personal data: identification and contact details, employment/role information, project participation records, and any personal data the customer chooses to upload.
4. Construction OS obligations
Construction OS will:
- process Customer Personal Data only on documented instructions from the customer;
- ensure persons authorised to process the data are under confidentiality;
- implement appropriate technical and organisational measures (see Annex A);
- assist the customer in responding to data-subject requests and in fulfilling GDPR Articles 32–36 obligations;
- make available information necessary to demonstrate compliance and allow audits under Section 8.
5. Subprocessors
The customer authorises Construction OS to engage the subprocessors listed at /subprocessors. Construction OS will impose data protection obligations on each subprocessor no less protective than this DPA and remains liable for its subprocessors’ acts and omissions. Construction OS will give at least 30 days’ notice of new or replacement subprocessors; the customer may object on reasonable data protection grounds and the parties will work in good faith to resolve the objection.
6. Hosting & international transfers
Production customer data is hosted in a managed cloud region in Latin America. The Service is not currently offered to data subjects located in the European Union, EEA or United Kingdom. If the customer’s use of the Service brings EU/EEA or UK personal data within scope, the parties will, prior to any such processing, execute the European Commission Standard Contractual Clauses (Module 2, Controller-to-Processor) or an equivalent lawful transfer mechanism, with Construction OS as data importer.
7. Security
Construction OS maintains the technical and organisational security measures set out in Annex A, including encryption in transit, encryption at rest, workspace isolation via row-level security, role-based access control and audit logging.
8. Audits
Construction OS will make available on written request, and no more than once per 12-month period, its most recent security documentation. On-site audits are available for enterprise customers under NDA and with reasonable prior notice.
9. Personal data breach
Construction OS will notify the customer without undue delay and in any event within 72 hours of becoming aware of a Personal Data Breach affecting Customer Personal Data, and will provide the information required under Article 33(3) GDPR to the extent known.
10. Data-subject requests
Construction OS will, where possible, assist the customer to respond to data-subject requests. Construction OS will not respond to a data-subject request directly (except to confirm the request has been forwarded) unless legally required.
11. Return & deletion
On termination, and at the customer’s written choice, Construction OS will return or delete Customer Personal Data. Deletion from active systems occurs within 30 days; deletion from backups and residual copies occurs within one (1) year.
12. Liability
Each party’s liability arising out of or related to this DPA is subject to the limitations and exclusions in the underlying agreement (Terms of Service or MSA).
Annex A — Technical & organisational measures
- TLS 1.2+ for data in transit; AES-256 for data at rest at the storage layer.
- Row-level security policies enforcing workspace isolation.
- Role-based access control (owner, admin, member).
- Audit logging of authentication, role changes and privileged actions.
- Signed-URL access for private object storage with short-lived tokens.
- Secrets stored in managed secret store; no service-role keys in client code.
- Regular platform-vendor security updates and dependency scans.
- Access on the principle of least privilege; personnel bound by confidentiality.