Data Processing Addendum

This addendum is part of our Terms of Service. It applies automatically whenever SafetyCulture Plus Pty Ltd ("we") handles personal information for the organisation using SafetyDocs ("you"). You don't need to sign anything. If you need a signed copy, email privacy@safetydocs.app.

1. Who does what

You decide what personal information goes into SafetyDocs and why. For that information ("Customer Personal Data"), you're the controller, and we're your processor or service provider. Annex 1 describes it. Different laws use different words for these roles, and this addendum applies whichever word your law uses.

We're responsible in our own right for our own records, such as accounts, billing, support and marketing. Our Privacy Policy covers those.

You're responsible for having the right to give us Customer Personal Data, and for giving people any notice the law requires. For New Zealand, we hold it as your agent.

2. What we'll do with it

We only handle Customer Personal Data on your instructions, unless the law requires otherwise, in which case we'll tell you if we're allowed to. Your instructions are these terms, what your people do in SafetyDocs, including what you ask AI features or integrations to do, and anything else we agree in writing.

We use it to run SafetyDocs for you, including keeping it secure and fixing problems, and we keep AI requests and responses to check and improve the quality of those features. We can also make combined, de-identified statistics from it. We don't sell it, we don't use it for our own marketing, and we don't use it to train AI models. If you think an instruction breaks the law, or we do, we'll tell each other.

3. Our people

Everyone we allow to handle Customer Personal Data must keep it confidential. Staff only have access where their role needs it. Staff with the right role can sign in as a customer to fix a problem you've raised or to deal with a security issue. Each sign-in goes in your audit log, and your Admins are told.

4. Security

We keep up the technical and organisational measures in Annex 2. We can improve them over time, as long as protection doesn't drop overall.

5. Sub-processors

You agree to us using the companies on our sub-processors list. We'll have written contracts with them that give protections at least as strong as this addendum, in substance, and we stay responsible for what they do.

AI hosts are the exception: OpenRouter chooses them from those that keep no data, as that list explains, so we can't give notice of each one. If you need a fixed list, tell us, and don't use AI features until we've agreed one.

For everything else, we'll update that list, and email your Admins at least 14 days before a new sub-processor starts handling Customer Personal Data, unless it's urgent, in which case we'll tell you as soon as we can. If you have reasonable data protection grounds to object, tell us within that time. We'll try to find a way forward. If we can't, you can cancel the affected service and we'll refund the unused part of any period you've paid for.

6. Security incidents

If we become aware of unauthorised access to, or loss or disclosure of, Customer Personal Data, we'll tell your Admins without undue delay, and within 72 hours where we can. We'll say what we know, what we're doing, and what you may need to do, and we'll update you as we learn more. We'll help you meet your own notification duties, such as under Australia's Notifiable Data Breaches scheme. Unless the law requires otherwise, we'll talk with you before we notify your workers or a regulator about your information. Telling you about an incident doesn't mean we were at fault.

7. Helping you

If someone asks us about their information in Customer Personal Data, we'll refer them to you or tell you, and we won't answer them ourselves unless you ask us to or the law requires it. We'll give you reasonable help with those requests, and with privacy assessments and regulators, taking into account what we can reasonably know.

If we get a legal request from a government or court for Customer Personal Data, we'll check that it's valid, tell you unless the law stops us, and only give what's required.

8. Audits

We'll give you the information you reasonably need to show we're meeting this addendum. That usually means written answers, and our providers' audit reports where we're allowed to share them. If that's not enough, or a regulator requires it, you can audit us once in any 12 months, with at least 30 days' notice, in a way that's confidential and doesn't disrupt the service. An audit a regulator requires, or one after a security incident, doesn't count towards that limit. You pay your own costs.

9. Sending information overseas

We're based in Australia, and we and our sub-processors handle Customer Personal Data in the countries on our sub-processors list, and where those companies' own suppliers work. You agree to this.

Need it held in a particular country? We don't offer a choice of hosting region today. If your organisation needs its information held in a particular country, email support@safetydocs.app and tell us where. It helps us decide what to build next.

UK and EEA. If UK GDPR or EU GDPR applies to Customer Personal Data, and it goes to a country without an adequacy decision, the European Commission's standard contractual clauses (Decision 2021/914), Module Two (controller to processor), apply between us, and form part of this addendum, with these choices: clause 7 applies, clause 9(a) option 2 with the notice in section 5, the clause 11 option doesn't apply, the law and courts in clauses 17 and 18 are Ireland's, Annex I.A's parties are you (exporter, controller) and SafetyCulture Plus Pty Ltd (importer, processor), with the contacts in your account and at the end of this addendum, and accepting these terms counts as signing. Annex I.C's authority is the one that supervises you. Annexes 1 and 2 below complete the rest. For the UK, the UK's International Data Transfer Addendum also applies, and neither of us can end it under its section 19. If these clauses conflict with this addendum, the clauses win.

Australia and New Zealand. We take reasonable steps so that overseas recipients handle the information consistently with the Australian Privacy Principles, and the comparable safeguards under New Zealand's Privacy Act 2020.

Canada. We act as your service provider. If Québec's Law 25 applies, we'll give you what you reasonably need for your assessment before a transfer, use the information only for your mandate, delete it at the end, report incidents to you, and let you verify this as section 8 describes.

United States. Where a US state privacy law applies, we act as your service provider. We won't sell or share Customer Personal Data, or use it outside our direct relationship with you, except as this addendum and that law allow.

10. When this ends

Before your organisation closes, you can take copies of your information, as the Terms of Service describe. When the service ends, ask us and we'll delete Customer Personal Data within 30 days, unless the law requires us to keep it. Signed records, and the job's audit entries for them, are the exception: the Terms of Service keep them for at least seven years, for you and for the people who signed them. You instruct us to do this, by using signing. It can stay in our providers' backups for a short time afterwards, protected under this addendum.

11. General

Liability under this addendum is covered by the limits in the Terms of Service, as far as the law allows. Those limits don't reduce anyone's rights under the standard contractual clauses. If this addendum conflicts with the terms about personal information, this addendum wins. It lasts as long as we hold Customer Personal Data.

Annex 1: The processing

Subject matter and duration. Providing SafetyDocs to you, for as long as you use it and until the information is deleted.

Nature and purpose. Storing, organising, sending, showing, converting, translating and deleting, to run SafetyDocs. Keeping AI requests and responses, to check and improve AI features.

People it's about. Your staff, crew and subcontractors, visitors to your sites, your contacts at principal contractors and clients, and anyone else named in your documents.

Kinds of information.

• Names, emails, mobile numbers, companies, job titles and roles
• Sign-on and signature records, including drawn signatures, details given, times and technical details
• Reading records, job activity, messages, photos and comments
• Licences, tickets and insurance, with numbers and expiry dates, and pictures of them
• Permit roles and approvals
• Audit entries
• Whatever you put in documents and files

Sensitive information. We don't ask for it. If you put it in, such as health or injury details, you're responsible for having a basis to do so, and we protect it like everything else.

How often. Continuously, while you use SafetyDocs.

Annex 2: Security measures

• Encryption in transit using TLS, and at rest using AES-256 by our database and file storage providers
• Each organisation's information kept apart, with every request checked on our servers against the person's role
• Sign-in and sessions through WorkOS. One-time codes we send expire after 10 minutes, can be used once, and lock after five wrong attempts
• File links that expire within an hour, most after 15 minutes
• Limited staff access, by role
• Audit logs of changes to people, roles and contacts, and of each share of contact details
• Limits on repeated requests
• Every upload scanned with ClamAV for known malware, before it's processed or anyone can open it
• HTTPS-only and frame protection headers on every response
• Secrets kept out of source code, and signed webhooks
• Automatic code checks and dependency updates
• Use of infrastructure providers with independent security reports, as our Security page lists

Contact

Privacy Officer, SafetyCulture Plus Pty Ltd, PO Box 578, Townsville QLD 4810, Australia. privacy@safetydocs.app