Data processing agreement

Words defined in the UK GDPR and the Data Protection Act 2018 ("Data Protection Law") have the same meaning here. Customer Personal Data means personal data in the Customer Data (as defined in the Terms) that AECAI processes for the Customer.

2.1 The Customer is the controller of Customer Personal Data and AECAI is its processor.

2.2 AECAI is a separate controller for: the account and sign-in data of the Customer's Users, billing data, security logs, and de-identified training data where the Customer has opted in (clause 4.2). Our Privacy Notice covers that processing.

The Customer is responsible for having a lawful basis for the processing it instructs, for giving the notices people need (including the owners of sites inspected and people who appear in photographs), and for the accuracy of Customer Personal Data.

4.1 AECAI processes Customer Personal Data only on the Customer's documented instructions, unless the law requires otherwise, in which case AECAI tells the Customer before processing, unless the law forbids it. The Terms, this agreement and the Customer's use of the Service's features are those instructions. AECAI will tell the Customer if it believes an instruction breaks Data Protection Law.

4.2 Model training. If, and only while, the Customer opts in through its Workspace settings, the Customer instructs AECAI to create de-identified copies of reviewed photographs and review decisions to train AECAI's computer-vision models. AECAI removes embedded metadata, blurs faces and vehicle number plates by automatic detection (which can miss some), and removes workspace, inspection, site and person names before the copies are used. The opt-in is off by default, can be withdrawn at any time, and every change is logged. Withdrawal stops future use; models already trained are not affected. The download links for a training export, which go to AECAI staff and not to Users, last 7 days.

AECAI ensures everyone authorised to process Customer Personal Data is bound by confidentiality.

AECAI implements the measures in Annex 2, appropriate to the risk, and keeps them under review.

7.1 The Customer gives general authorisation for AECAI to use the sub-processors in Annex 3, Part A.

7.2 AECAI will give at least 30 days' notice of a new or replacement sub-processor (by email to the Customer's account owner). The Customer may object on reasonable data protection grounds; if we cannot resolve the objection, the Customer may end the subscription without penalty.

7.3 AECAI imposes data protection obligations on each sub-processor equivalent to this agreement and remains liable for their performance.

7.4 AI providers. The Customer's choice of AI key decides who the provider is.

• Included key. Where the Customer has no key of its own, the Service uses AECAI's account with Google (Gemini). Google is then AECAI's sub-processor, and the Customer's photographs and text go to Google under AECAI's account and AECAI's agreement with Google.
• The Customer's own key. Where the Customer connects its own key, the Service sends the data to that provider on the Customer's instruction, under the Customer's own agreement with the provider. AECAI does not select that provider and does not authorise or vet it. Annex 3, Part C lists the providers the Service offers, with where each is based.

Taking into account the nature of the processing, AECAI will help the Customer to:

• respond to requests from people exercising their rights (the Service lets the Customer view, correct and export records; AECAI deletes records on request as in clause 11; AECAI passes on any request it receives directly, as in clause 8.1);
• meet its security, breach notification, data protection impact assessment and prior consultation obligations.

8.1 If AECAI receives a request from a person about Customer Personal Data, it will pass the request to the Customer promptly and will not respond to the person itself, except to say that it has passed the request on.

AECAI may charge reasonable costs for help beyond what the Service provides, agreed in advance.

AECAI will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data, with the information the Customer needs to meet its own obligations, and will keep the Customer updated.

AECAI stores Customer Personal Data in the EU (Ireland). Some sub-processors in Annex 3 process it in the USA, and AECAI's computer-vision models may run in data centres outside the UK and the EU (Annex 3). AECAI transfers personal data outside the UK only under a lawful transfer mechanism: UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, for certified recipients) or the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses, with a transfer risk assessment. Annex 3 shows, for each sub-processor, the basis AECAI relies on, taken from the provider's own published terms.

11.1 During the subscription: Customer Personal Data is kept for the retention period set in the Workspace (default 7 years, which the Customer can shorten). Nothing deletes records automatically when that period ends: they are kept until the Customer asks for deletion (clause 11.3). Text extracted from documents uploaded as report examples is purged after 90 days.

11.2 Return: the Customer's owner or administrator can export records as JSON and CSV from Settings at any time. AECAI sends a ZIP of the original photographs on request, aiming to do so within 24 hours.

11.3 Deletion: the Customer's owner can ask for deletion with "Close company account" in Settings, or in writing. Either way AECAI deletes the Customer Personal Data from the live Service within 30 days of the request and confirms in writing when done. Copies held in any sub-processor's backups are not deleted early; they expire when that sub-processor's backup cycle ends. AECAI keeps data it is required by law to keep, or that is under a legal hold.

AECAI will make available the information needed to show compliance with this agreement and allow audits by the Customer or its auditor, on at least 30 days' notice, during business hours, no more than once a year (unless a regulator requires or a breach has occurred), at the Customer's cost, and subject to confidentiality.

Liability under this agreement is subject to the limits in the Terms. If this agreement and the Terms conflict on data protection, this agreement wins.

• Separation: every customer's data is isolated from every other's by database row-level security on each table, checked against Workspace membership.
• Access control: accounts by invitation only; sign-in with a password and a one-time code sent by email; trusted devices expire after 30 days and can be revoked; AECAI can suspend a whole firm's access at once, which keeps its data but shows its Users nothing.
• Files: all storage is private; files are shown to Users only through links that expire within an hour (report downloads, 5 minutes). Training-export links, which go to AECAI staff, last 7 days.
• Encryption: in transit (TLS) and at rest (by the hosting provider). Customers' own AI keys are encrypted at rest.
• Minimisation: embedded metadata is removed from photographs used for training; text extracted from example documents is purged after 90 days.
• Accountability: an audit log of actions in each Workspace; an append-only log of training-consent changes.
• Resilience: managed database hosting. This paper makes no promise about backups or recovery times.
• People: access to production data limited to named AECAI staff, with confidentiality obligations.
• Error reports: stripped of cookies and authorisation headers before they are sent; no session recording.

The last column gives the basis AECAI relies on for each transfer outside the UK, taken from the provider's own published data processing terms (read 4 November 2026). Where a provider's terms name a mechanism AECAI has not been able to check against the official Data Privacy Framework list, the provider's own statement is given as such.

Part A: providers that may process Customer Personal Data

Part B: providers for the website and company mail, and services your browser contacts

These do not receive Customer Personal Data from the Service, except what a Customer sends to AECAI by email, by the contact form or through the OpenStreetMap map described below.

Part C: AI providers on the Customer's own key

Used only where the Customer connects its own key (clause 7.4). They are the Customer's choice. The Service shows the jurisdiction beside each one.

AECAI has made no arrangement with these providers. The basis for any transfer is the provider's standard data processing terms under the Customer's own agreement with it.