Data Processing Addendum
1. Parties and roles
The customer accepting the agreement is the “Customer.” JobsitePilot is operated by Tmi J Juuso, Business ID 2721234-5, Keimolantie 88, 01750 Vantaa, Finland (“JobsitePilot”). For Customer Content, Customer is the controller or processor, as applicable, and JobsitePilot is the processor or subprocessor. Each party will comply with the data-protection laws applicable to its role, including the GDPR where it applies.
2. Definitions
“Customer Content” means information submitted to or generated through the Service for the Customer. “Customer Personal Data” means personal data within Customer Content processed by JobsitePilot on the Customer's behalf. “Data Protection Law” includes the GDPR, UK GDPR, and other applicable privacy or data-protection law. “Subprocessor” means a processor engaged by JobsitePilot to process Customer Personal Data.
3. Subject matter, duration, nature and purpose
JobsitePilot processes Customer Personal Data to provide, secure, maintain and support the Service, including account-linked project records, storage, authentication, AI-assisted report generation, PDF and email delivery, support, usage-limit administration, and related instructions documented in the agreement or provided through normal use. Processing lasts for the agreement term and any limited period required for return, deletion, backups, security, legal compliance or dispute resolution.
4. Processing details
| Category | Details |
|---|---|
| Data subjects | Customer users; employees and workers; subcontractor, supplier, client and project personnel; site visitors; contacts; and other people identified in Customer Content. |
| Personal data | Names, contact details, account identifiers, job roles, project and location information, work descriptions, notes, temporary voice recordings submitted for transcription, voice transcripts, photographs, report contents, communications, device/log data, and other information selected by Customer. |
| Special-category or sensitive data | Not intentionally required. Customer must avoid submitting it unless necessary, lawful, and subject to appropriate safeguards and instructions. |
| Operations | Collection, recording, organization, storage, retrieval, consultation, transmission, AI-assisted transformation, report generation, restriction, deletion and other operations necessary to provide the Service. |
5. Customer instructions and responsibilities
JobsitePilot will process Customer Personal Data only on documented instructions from Customer, including the agreement and Customer's use of Service features, unless law requires otherwise. If legally permitted, JobsitePilot will inform Customer before processing required by law. Customer is responsible for lawful instructions, notices, permissions, data accuracy, account administration, and determining whether the Service is appropriate for the intended data. If JobsitePilot reasonably believes an instruction violates Data Protection Law, it may suspend that processing and inform Customer.
6. Confidentiality and personnel
JobsitePilot will ensure that persons authorized to process Customer Personal Data are subject to confidentiality obligations and receive access only as necessary for their functions.
7. Security
JobsitePilot will maintain appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. Current measures are described in Annex II below. Customer acknowledges that security measures evolve and may be updated without materially reducing overall protection.
8. Subprocessors
Customer gives general written authorization for JobsitePilot to use the Subprocessors listed at getjobsitepilot.com/subprocessors.html. JobsitePilot will impose data-protection obligations appropriate to the relevant processing and remains responsible for each Subprocessor's performance of those obligations to the extent required by Data Protection Law. JobsitePilot will publish or otherwise provide notice of a material new Subprocessor before it begins processing Customer Personal Data where reasonably practicable. Customer may object on reasonable data-protection grounds within 15 days of notice. The parties will work in good faith on a practical resolution; if none is available, either party may terminate the affected Service.
9. Data-subject requests
Taking into account the nature of processing, JobsitePilot will provide reasonable assistance through Service functionality or other appropriate measures so Customer can respond to requests to exercise data-subject rights. If JobsitePilot receives a request relating to Customer Personal Data for which Customer is responsible, JobsitePilot will refer the requester to Customer where feasible and will not respond substantively except on Customer's instruction or as required by law.
10. Security incidents
JobsitePilot will notify Customer without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data. Notice will include information reasonably available to JobsitePilot about the nature of the breach, likely consequences, affected data and subjects, and mitigation steps. Notification is not an admission of fault or liability. Customer is responsible for regulatory or data-subject notifications required of Customer.
11. Assessments, consultations and compliance information
Taking into account the nature of processing and information available, JobsitePilot will provide reasonable assistance with Customer's data-protection impact assessments and prior consultations. On reasonable request, JobsitePilot will provide information necessary to demonstrate compliance with applicable processor obligations. Customer will first use current documentation, third-party reports or certifications made available by JobsitePilot or its providers.
12. Audits
If documentation is insufficient, Customer may conduct or appoint an independent auditor to conduct an audit no more than once in any 12-month period, unless a breach, regulator or Data Protection Law reasonably requires more. Audits require at least 30 days' notice where practicable, must occur during normal business hours, remain within the relevant processing scope, protect other customers and confidential information, and avoid unreasonable disruption. Customer bears its audit costs. The parties may agree reasonable charges for substantial JobsitePilot assistance.
13. International transfers
JobsitePilot is established in Finland. When Customer Personal Data is transferred from the EEA, United Kingdom or Switzerland to a country without an applicable adequacy decision, JobsitePilot will use a lawful transfer mechanism appropriate to the transfer, such as the European Commission's Standard Contractual Clauses, the UK Addendum or other recognized safeguards. JobsitePilot will use appropriate contractual safeguards with relevant Subprocessors and provide reasonable information about those safeguards on request, subject to confidentiality and third-party restrictions.
14. Return and deletion
During an active account, Customer may access or export reports using available Service functions. After termination or a verified deletion request, JobsitePilot will delete or de-identify active Customer Personal Data within 30 days unless law requires retention. Backup copies may remain until overwritten under provider backup cycles and will remain protected and unavailable for ordinary use. Billing, security, dispute and legal records may be retained as permitted or required by law.
15. Priority and liability
If this DPA conflicts with another part of the agreement about processing Customer Personal Data, this DPA controls for that conflict. The liability provisions and governing law in the Terms or other applicable agreement apply to this DPA, except where Data Protection Law requires otherwise.
Annex I — Processing description
The parties, roles, processing subject, duration, nature, purposes, data subjects, personal-data categories and operations are specified in Sections 1–4. Customer's account configuration, submissions and use of features are additional documented instructions.
Annex II — Technical and organizational measures
- HTTPS/TLS for network transmission supported by the Service and providers.
- Managed authentication, password hashing and session controls through Supabase Auth.
- Logical access controls and customer-account separation within the application and managed database/storage services.
- Administrative access limited according to role and operational need; production credentials stored as protected environment secrets.
- Provider-managed physical security, infrastructure protection, encryption at rest where offered, backup and recovery controls.
- Logging, error handling, abuse prevention and incident-response procedures appropriate to the Service's size and risk.
- Data minimization, retention controls, verified deletion processes and confidentiality obligations.
- Subprocessor review and contractual data-protection terms appropriate to the services used.
Annex III — Subprocessors
The current authorized Subprocessors and their functions are listed on the Subprocessors page, incorporated into this DPA.