Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Groundwork, Inc. ("Processor") and the customer identified in an order form ("Controller"), and applies where Groundwork processes personal data on Controller's behalf in the course of providing the Service.

1. Roles

Controller determines the purposes and means of processing personal data submitted into the Service ("Personal Data"). Groundwork acts as a processor, processing Personal Data solely on Controller's documented instructions, including as set out in the Terms and this DPA.

2. Subject Matter and Duration

Subject matter: provision of the Service. Duration: for the term of the underlying subscription, plus any post-termination retrieval period stated in the Terms.

3. Nature and Purpose of Processing

Hosting, storage, and processing of Personal Data as necessary to operate the construction-management functionality of the Service (e.g. project records, timekeeping, payroll-adjacent data where applicable, contact and user account records).

4. Categories of Data Subjects

Controller's employees, subcontractors, project stakeholders, and other individuals whose data Controller submits to the Service.

5. Sub-processors

Groundwork may engage sub-processors to provide the Service, listed at Subprocessors. Groundwork remains responsible for sub-processor performance and will notify Controller of material changes to this list with an opportunity to object on reasonable data-protection grounds.

6. Security Measures

Groundwork implements technical and organizational measures appropriate to the risk, as described on the Security page, including encryption in transit, access controls, and audit logging.

7. Assistance and Data Subject Requests

Groundwork will provide reasonable assistance to Controller in responding to data subject requests and in meeting Controller's obligations regarding security, breach notification, and data protection impact assessments, to the extent required by applicable law.

8. Data Breach Notification

Groundwork will notify Controller without undue delay after becoming aware of a personal data breach affecting Controller's data.

9. Return or Deletion

On termination, Groundwork will make Personal Data available for export and will delete or anonymize it after the retrieval period, except where retention is required by law.

10. International Transfers

Where processing involves a cross-border transfer, the parties will rely on an appropriate transfer mechanism recognized under applicable data protection law.