ConstructVerify Data Processing Addendum

This DPA applies to Personal Data processed by ConstructVerify on behalf of a customer in connection with the Services.

Where applicable:

• Customer acts as Controller or Processor, as determined by applicable data-protection law.
• ConstructVerify acts as Processor or Subprocessor when processing Personal Data on documented customer instructions.

ConstructVerify may separately act as a Controller for information necessary to administer accounts, legal obligations, security, billing, fraud prevention, and business operations.

ConstructVerify will process Customer Personal Data only:

• to provide the Services
• on documented Customer instructions
• as required by applicable law

Persons authorized to process Personal Data will be subject to appropriate confidentiality obligations.

ConstructVerify will maintain appropriate technical and organizational measures designed to protect Personal Data against:

• unauthorized access
• accidental or unlawful destruction
• loss
• alteration
• unauthorized disclosure

ConstructVerify may engage vetted subprocessors to support:

• cloud infrastructure
• storage
• authentication
• communications
• payments
• analytics
• support

ConstructVerify remains responsible for requiring subprocessors to protect Personal Data consistent with applicable contractual and legal requirements.

A current subprocessor list should be made available as the platform matures.

Taking into account the nature of processing, ConstructVerify will provide reasonable assistance to Customers in responding to valid data-subject requests where required by applicable law.

ConstructVerify will notify affected Customers without undue delay after becoming aware of a confirmed Personal Data breach affecting Customer Personal Data where notification is required by applicable law.

Where Personal Data is transferred internationally and applicable law requires a transfer mechanism, the parties will use an appropriate lawful transfer mechanism, which may include approved Standard Contractual Clauses or another recognized mechanism.

Upon termination of Services, ConstructVerify will delete or return Customer Personal Data as required by the agreement, applicable retention requirements, and applicable law.

ConstructVerify will provide information reasonably necessary to demonstrate compliance with applicable processor obligations, subject to confidentiality, security, and proportionality requirements.

Subject Matter

Operation of ConstructVerify construction document review and associated platform services.

Duration

For the term of the customer's Services plus applicable retention periods.

Nature and Purpose

Hosting, transmitting, organizing, reviewing, communicating, supporting, securing, and administering project and account information.

Categories of Data Subjects may include

• Customer personnel
• Consultants
• Project contacts
• Reviewers
• Administrators
• Authorized users

Types of Personal Data may include

• Identity information
• Business contact information
• Account information
• Project-associated information
• Communications
• Professional credentials
• Transaction metadata

Sensitive information should only be uploaded where necessary and authorized.

If this DPA conflicts with the underlying agreement regarding Personal Data processing, this DPA controls to the extent of that conflict.

privacy@constructverify.com