Data Processing Agreement

• Data Protection Law means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003, and any law that amends or replaces them (including the Data (Use and Access) Act 2025 as it comes into force); and the EU GDPR where it applies to the Customer.
• Customer Personal Data means personal data that Sitestack processes for the Customer in providing the Service, as described in Annex 1.
• Service means the Sitestack web and phone apps and related services under the Main Agreement.
• Sub-processor means a third party Sitestack engages to process Customer Personal Data.
• Personal Data Breach, controller, processor, data subject, processing and supervisory authority have the meanings in Data Protection Law.

2.1 The Customer is the controller and Sitestack is the processor of Customer Personal Data.

2.2 Sitestack is a separate controller for its own account, billing, security, website and marketing data, as described in its Privacy Policy. This DPA does not cover that data.

2.3 The Customer is responsible for having a lawful basis (and, for health or criminal offence data, a condition and any appropriate policy document) for the Customer Personal Data it puts into the Service, and for giving people the information the law requires. That includes site workers, visitors, emergency contacts, client and occupier staff, and members of the public and occupiers of a building recorded in the Service.

2.4 Other people the Customer works with (for example a subcontractor that registers its own workers, or a client that decides who may enter its building) may be controllers in their own right. The Customer is responsible for agreeing with them who does what, including when it shares data with them.

3.1 Sitestack processes Customer Personal Data only to provide the Service under the Main Agreement and the Customer's documented instructions, for as long as the Main Agreement lasts and afterwards until the data is deleted or returned under clause 12.

3.2 The processing is hosting, storing, organising, retrieving, displaying, sending by email and notification, producing reports, PDFs and exports, producing AI search answers, captions and descriptions, backing up and deleting. Annex 1 lists the people and data involved.

Sitestack will:

• process Customer Personal Data only on the Customer's documented instructions, including on transfers outside the UK, unless the law requires otherwise (in which case Sitestack will tell the Customer first, unless the law forbids it). The Main Agreement, this DPA and the Customer's use and settings of the Service are the Customer's instructions;
• tell the Customer promptly if it believes an instruction breaks Data Protection Law;
• not use Customer Personal Data for its own purposes, including its own analytics, marketing, product research or training of AI models, and not sell it;
• make sure everyone it authorises to process Customer Personal Data is bound by confidentiality;
• keep the security measures in Annex 2;
• follow clause 6 when engaging Sub-processors;
• help the Customer respond to requests from people about their data (clause 8), and with its security, breach, impact assessment and prior consultation duties (clauses 7 and 9);
• delete or return Customer Personal Data at the end of the Service (clause 12) and apply the retention periods in Annex 4;
• give the information needed to show it has met Article 28, and allow audits (clause 10).

The Customer will:

• comply with Data Protection Law as controller, including telling people how their data is used, choosing lawful bases and conditions, and doing any impact assessment it needs. Sitestack's own impact assessment work is available to help;
• set roles and permissions sensibly, remove access when people leave, and keep sign-in details secure;
• choose and apply retention periods that suit its own legal needs (Annex 4 sets the defaults, which the Customer may shorten but not lengthen for the data in Annex 4 without Sitestack's agreement);
• not put into the Service data it is told not to: DBS certificates or their numbers, full card numbers, medical records, or health or criminal detail in free text boxes;
• decide whether to use optional features (AI features, automatic site attendance, voice dictation), and tell its users, workers and others affected;
• make sure that anything it shares from the Service to anyone else (such as a roll call list or workforce summary sent to a client) is shared lawfully, on written terms where Sitestack's guidance asks for them, and only with the people who need it.

6.1 The Customer gives Sitestack general written authorisation to use Sub-processors. The current list is Annex 3, which Sitestack keeps up to date on this page.

6.2 Sitestack will give the Customer at least 30 days' notice of a new or replacement Sub-processor, by email to the Customer's account admins and by updating the list. In an emergency (for example to keep the Service secure or available) the notice may be shorter, and Sitestack will say why.

6.3 The Customer may object on reasonable data protection grounds within the notice period. The parties will talk in good faith. If they cannot resolve it, the Customer may end the affected part of the Service and receive a refund of prepaid fees for the period after it ends.

6.4 Sitestack will bind each Sub-processor by written contract to data protection obligations that give at least the same protection as this DPA, and remains responsible to the Customer for each Sub-processor's performance as Article 28(4) requires.

7.1 Sitestack will keep the measures in Annex 2 in place. It may improve them, but will not reduce the overall level of protection during the term.

7.2 Sitestack will tell the Customer without undue delay, and in any case within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. It will email the Customer's account admins.

7.3 The notice will say, as far as known then and updated in stages: what happened, the kinds and approximate numbers of people and records, the likely consequences, what has been done or is proposed, and a contact at Sitestack.

7.4 Sitestack will take reasonable steps to contain and fix the breach and help the Customer meet its duty to tell the ICO within 72 hours where required, and to tell the people affected where the risk to them is high. Whether and what to notify is the Customer's decision as controller.

7.5 Telling the Customer about a breach is not an admission of fault or liability.

8.1 If a person asks Sitestack about Customer Personal Data, Sitestack will tell them to contact the Customer and will pass the request to the Customer within 5 working days. It will not answer it itself unless the law requires.

8.2 The Service gives the Customer tools to find, export, correct and remove personal data, including an export of a site person's data, 'Remove personal details', and a search by name, email or phone number that finds, exports and removes the records of anyone else named, such as visitors and members of the public in incidents. Where those tools do not reach some data (for example earlier copies in the audit trail, backups, or the contents of stored files and photos), Sitestack will give reasonable help on request.

Sitestack will give reasonable help with the Customer's data protection impact assessments and any prior consultation with the ICO, including by sharing its own assessment of the Service.

10.1 Sitestack will give on request the information reasonably needed to show it complies with this DPA, including its Sub-processor list and a summary of its security measures.

10.2 If that is not enough, the Customer (or an independent auditor bound by confidentiality who is not a competitor of Sitestack) may audit Sitestack's compliance once in any 12 months, or after a Personal Data Breach, on at least 30 days' written notice, in business hours, in a way that does not disrupt the Service or breach other customers' confidentiality. For Sub-processors, Sitestack will rely on their own reports and certifications.

10.3 The Customer bears its own audit costs and pays Sitestack's reasonable time beyond one working day.

11.1 Sitestack holds Customer Personal Data in the United Kingdom (London) or the European Union. The UK treats the EU as adequate.

11.2 Sitestack may transfer Customer Personal Data outside the UK and EEA, including to the United States, only to Sub-processors on the list and only with a safeguard Data Protection Law recognises: UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework for certified suppliers), the IDTA, or the EU Standard Contractual Clauses with the UK Addendum, with a transfer risk assessment where needed.

12.1 During the term the Customer can export its data from the Service.

12.2 When the Main Agreement ends, the account is read only for 30 days so the Customer can export its data.

12.3 Sitestack will then delete Customer Personal Data from the live Service within 90 days of the end, and from backups as they expire under its normal backup cycle, unless the law requires it to keep it. Until backups expire, the data stays protected by this DPA and is not restored except to recover the Service.

12.4 Sitestack will confirm deletion in writing on request.

13.1 The Customer is responsible, as controller, for what it chooses to put into the Service and what it does with it: the lawfulness of the data, telling people about it, its permissions settings, how long it keeps data, and anything it or its users share with anyone else (including roll call lists, workforce summaries, exports and downloads).

13.2 The Customer will pay Sitestack for (and keep Sitestack safe from) losses, costs, claims and fines that arise from: the Customer or its users breaking Data Protection Law or clause 5; an instruction from the Customer that breaks Data Protection Law, where Sitestack has said so; or data the Customer or its users share with others, or keep, against Sitestack's guidance. Sitestack will tell the Customer promptly of any claim, let the Customer help defend it, and not settle it without the Customer's agreement (not to be unreasonably withheld).

13.3 Sitestack is responsible for its own breaches of this DPA and of the processor duties in Data Protection Law. Its total liability under this DPA is limited as set out in the Main Agreement (the fees paid in the 12 months before the claim), except for liability that the law does not allow to be limited.

13.4 Neither party limits any right a person has against it under Data Protection Law (including to compensation under Article 82). If both are responsible for the same harm, each bears its share according to its part in causing it, and a party that has paid more than its share may recover the rest from the other.

13.5 Neither party is responsible for a fine or penalty imposed on the other for the other's own breach.

14.1 If this DPA conflicts with the Main Agreement on data protection, this DPA wins. Clause 13 sits within, and does not widen, the limits in the Main Agreement.

14.2 Sitestack may update this DPA to reflect changes in law, ICO guidance or the Service, with at least 30 days' notice and a new version number, provided the update does not reduce the protection for Customer Personal Data. A company that has not accepted the new version within that notice can end the Main Agreement and receive a refund of prepaid fees for the rest of the period.

14.3 This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

People whose data is processed

• The Customer's staff and other users of the Service (including subcontractors, consultants, clients and partners with logins).
• Site workers recorded by the Customer or its subcontractors, with or without logins.
• Visitors to sites, and their emergency contacts.
• People in the Customer's directory and on its jobs: clients, consultants, suppliers, subcontractors, and client and occupier staff.
• People who receive documents or reply links by email.
• Sole traders and partners whose CIS details the Customer records.
• Members of the public and occupiers of a building (for example people who live, work or are cared for there) who appear in incident reports, complaints, photos or video.

Kinds of personal data

• Identity and contact: names, job titles, companies, work emails and phone numbers.
• Account: role, permissions, sign-in records, device and notification tokens.
• Job content: photos and videos (which may show people, faces and number plates), photo date, time and location, documents, drawings, registers, diaries, meeting notes, AI captions.
• Signatures: typed name, drawn signature, IP address, device details, location and time.
• Site safety: site people register, card type with the last four characters and expiry, inductions, briefings, work restriction, sign-ins with areas, roll calls, automatic site attendance (opt in), lone working check-ins (position only when shared), emergency contacts.
• Contracts and money: parties, payment applications, notices and payments.
• CIS reference data: name as verified, business type, UTR, company registration number, verification number and date, deduction rate.

Health and criminal offence data

• Health: injuries in incident reports, and any health detail that appears in free text, photos or sound.
• Criminal offence data: the client's vetting decision and the level and date of a check. Sitestack never stores a DBS certificate, its number or its content.

The Customer is responsible for having a condition for this data. Sitestack keeps it in restricted storage with logged reads and keeps it out of emails, notifications and AI features by design. Frequency: continuous while the Customer uses the Service.

• Hosting with established suppliers in the EU or UK, listed in Annex 3.
• Encryption in transit (TLS) and at rest for the database, files and backups.
• Separation of every company's data by row level security in the database, checked on every query, not only in the app.
• Access by role and by named permissions. Partner logins have a ceiling they cannot be raised above. Sensitive permissions are off for non-admins by default.
• Restricted data (emergency contacts, vetting decisions, card images, injury details) held in tables no ordinary role can read; reads go through checked functions and each read is logged with a reason.
• Signed records and evidence cannot be edited or deleted except through a logged removal of personal details.
• An audit trail of changes; personal columns are recorded as 'changed' without their values.
• Reply and certification links are single use, for one named person, stored only as hashes and time limited; file links are signed and short lived.
• Passwords hashed by the sign-in service; optional two-step sign-in; bot checks on public forms.
• Link tokens removed before error reports are sent to the error tracking service.
• Automated checks on every release that prove each role reads only what it should.
• Production access is limited to Sitestack's own staff, and routine production checks return counts, not personal data.
• Notice of a breach in the way and within the time set out in clause 7.

Changes are notified under clause 6.2.

Sitestack removes the personal details below automatically once the period ends, unless the Customer has already removed them sooner. 'The job's end' means the date the job is marked complete or archived. Removing personal details means deleting the data, or replacing a name with 'Removed person' while keeping the record, the counts and the fact that the check or sign-in happened.

If the law requires the Customer to keep a record longer, or the Customer needs it for a claim, the Customer should export it before the period ends. Reply links for payments, contracts and certificates are the Customer's contract records and are kept while the account is active. Backups hold removed data until they expire under Sitestack's normal backup cycle.