Data Processing Addendum

This addendum forms part of the Terms of Service between the customer (controller) and [LEGAL ENTITY NAME] (processor). It applies to personal data in the content the customer adds to Civvio, under Article 28 UK GDPR.

• Subject matter: hosting, indexing and AI processing of project content to provide Civvio.
• Duration: the term of the subscription, plus the deletion period below.
• Nature and purpose: storage, search, AI answers and drafting, record keeping and reporting for the customer.
• Data categories: names, roles, work contact details, signatures, employee numbers, trades, hours worked and squad allocations, site photos, and any personal data in documents uploaded.
• Data subjects: customer staff, subcontractors and suppliers named in records, client and consultant contacts, and site personnel in allocations and diaries.

• Process only on the customer's documented instructions, including these terms.
• Ensure staff with access are bound by confidentiality.
• Maintain appropriate security measures, as described in the Privacy Policy.
• Assist with data subject requests, security, impact assessments and consultation with the ICO.
• Notify the customer of a personal data breach without undue delay.

The customer authorises the sub-processors on the sub-processors page. We will give [NOTICE PERIOD — TO CONFIRM] notice of new sub-processors, and the customer may object on reasonable grounds. We impose equivalent data protection terms on each and remain responsible for them.

At the end of the service we will, at the customer's choice, return or delete customer personal data within [30 DAYS — TO CONFIRM], unless the law requires us to keep it.

We will make available the information needed to show compliance and allow audits on reasonable notice, at the customer's cost, no more than once a year unless required by a regulator or following a breach.

Where personal data is transferred outside the UK to a country without UK adequacy, we will use the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or another lawful mechanism.