This Data Processing Addendum (“DPA”) forms part of the agreement between the Customer and Digicon LLC, trading as IntegrityIQ360 (“Processor”), for the HSE, Quality and QHSE Command Centers (our Terms of Service or a signed agreement). It applies where the Processor processes personal data on the Customer’s behalf (“Customer Personal Data”) and is effective from the date the Customer accepts the Terms. A countersigned copy is available on request at [email protected].
1. Roles and instructions
The Customer is the controller and the Processor is a processor of Customer Personal Data (or, where the Customer is itself a processor, a sub-processor). The Processor processes Customer Personal Data only on the Customer’s documented instructions — the agreement, this DPA and the Customer’s configuration and use of the Service — unless the law requires otherwise, in which case the Processor will inform the Customer first where the law allows. The Processor will tell the Customer if, in its opinion, an instruction breaks data-protection law.
2. Confidentiality
People authorized to process Customer Personal Data are bound by confidentiality obligations and access it only as needed to provide, support and secure the Service.
3. Security
The Processor implements and maintains the technical and organizational measures in Annex II, appropriate to the risk, and may update them provided the overall level of protection is not reduced.
4. Sub-processors
The Customer authorizes the sub-processors in our Sub-processor List. The Processor will give at least 30 days’ notice of any new sub-processor. The Customer may object on reasonable data-protection grounds within that period; if the parties cannot resolve the objection, the Customer may terminate the affected Service and receive a refund of any prepaid fees for the remaining period. The Processor imposes data-protection obligations on each sub-processor that are no less protective than this DPA and remains responsible for their performance.
5. Assistance
Taking into account the nature of the processing, the Processor helps the Customer respond to requests from data subjects, carry out data-protection impact assessments and prior consultations with regulators, and meet its security obligations.
6. Personal data breaches
The Processor will notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data, and will provide the information reasonably available to help the Customer meet its own obligations. The Processor will take reasonable steps to contain the breach and reduce its effects.
7. Deletion and return
During the subscription, the Customer can export its data at any time. After the subscription ends, the Customer can export its data for at least 30 days; the Processor then deletes Customer Personal Data within 90 days, except where the law requires retention. Backup copies are overwritten within 30 days.
8. Audits
The Processor makes available the information reasonably necessary to demonstrate compliance with this DPA, including its Security Overview and written answers to reasonable security questionnaires, no more than once a year unless a regulator requires it or a personal data breach has occurred. Any on-site audit requires reasonable advance notice, must be scoped to minimize disruption and is at the Customer’s cost.
9. International transfers
Where Customer Personal Data subject to the GDPR is transferred to a country without an adequacy decision, the parties agree that the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module 2, controller to processor, or Module 3 where the Customer is a processor) are incorporated by reference, with Annexes I and II of this DPA completing their appendices; Clause 7 (docking) applies; the option in Clause 9(a) is “general written authorization” with the notice period in Section 4; the option in Clause 11 does not apply; Clauses 17 and 18 refer to the law and courts of Ireland. For data subject to the UK GDPR, the UK International Data Transfer Addendum is incorporated in the same way. For Swiss data, the Clauses apply with the Swiss Federal Data Protection Act as the applicable law where required.
10. Precedence and liability
If this DPA conflicts with the agreement on data protection, this DPA prevails. Each party’s liability under this DPA is subject to the limitations in the agreement, to the extent the law allows.
Annex I — Details of processing
| Item | Description |
|---|---|
| Subject matter and duration | Provision of the HSE, Quality and QHSE Command Centers for the term of the agreement and the deletion period that follows |
| Nature and purpose | Hosting, storage, display, reporting, export, backup and support of the Customer’s HSE records and user accounts |
| Data subjects | The Customer’s users; employees, contractors, visitors and other people named in HSE records; people who submit QR-code observation reports |
| Categories of data | Names, usernames, contact details, job roles, sites and departments, training, induction, permit and PPE records, incident and observation details, uploaded documents and images, sign-in and audit events |
| Special categories | Only where the Customer chooses to record them, for example injury details in an incident record |
| Frequency | Continuous, for the term of the agreement |
| Controller | The Customer; contact: its account owner |
| Processor | Digicon LLC, trading as IntegrityIQ360 — [email protected] |
Annex II — Technical and organizational measures
- Encryption in transit (TLS, with HTTP Strict Transport Security) for the website and application; data stored with Cloudflare, which encrypts stored data at rest.
- Passwords stored only as salted PBKDF2-HMAC-SHA-256 hashes (600,000 iterations); users choose their own passwords; activation and invitation links are single-use, time-limited and stored only as hashes.
- Multi-factor authentication (authenticator app) mandatory for administrator roles; temporary lockout after repeated failed sign-ins.
- Session cookies that are HttpOnly, Secure and SameSite=Strict, with CSRF protection; a strict Content-Security-Policy.
- Logical separation of every organization’s data, enforced on every request and tested across all API routes.
- Role-based permissions inside each Workspace, with protection against removing the last administrator.
- Uploaded files kept in private storage with no public link, limited to documents and images.
- Audit trail of security, administrative and governance events.
- Point-in-time database recovery for up to 30 days, verified by restore drills.
- Internal operator tools protected by access control and multi-factor authentication.
- Changes tested and rehearsed before release, with a documented rollback.