Data Processing Addendum.
This Data Processing Addendum ("DPA") applies where a ClickDraft Documentation Service Project Order states that ClickDraft Ltd will process personal data on behalf of the customer, or where the parties otherwise agree in writing that this DPA applies. It supplements the ClickDraft Terms of Service and the applicable Project Order.
1. Roles
For project personal data covered by this DPA, the customer is the controller (or a processor acting for another controller) and ClickDraft Ltd is the processor. Each party remains responsible for its own obligations under applicable data-protection law.
2. Customer instructions
ClickDraft will process covered personal data only on the customer's documented instructions, including the Project Order, agreed scope and written project communications, unless UK law requires otherwise. If we are legally required to process data contrary to an instruction, we will notify the customer before doing so unless the law prohibits notice.
3. Confidentiality
We will ensure persons authorised to process covered personal data are subject to an appropriate duty of confidentiality.
4. Security
Taking account of the nature of the processing, available technology, implementation cost and risk to individuals, ClickDraft will maintain appropriate technical and organisational measures. These include, as appropriate, access control, secure transfer methods, endpoint security, least-privilege access, encryption in transit, backup/recovery measures and procedures for responding to security incidents.
5. Sub-processors
The customer gives general written authorisation for ClickDraft to use sub-processors reasonably required to deliver the service. Where a sub-processor processes covered project personal data, ClickDraft will impose data-protection obligations that provide an equivalent level of protection required by applicable law. Current categories may include Google Workspace for business email/file communication and other project-specific providers identified in the Project Order. Cloudflare, Stripe and other providers may also process separate account, website, licensing or billing data for which ClickDraft acts as controller rather than processor.
We will provide reasonable notice of a material new sub-processor that will process covered project personal data, allowing the customer to raise a reasonable data-protection objection.
6. International transfers
ClickDraft will not make a restricted international transfer of covered personal data without an available lawful transfer mechanism. Where appropriate safeguards are required, the parties will cooperate to put in place the UK International Data Transfer Agreement, the UK Addendum to approved EU standard contractual clauses, or another lawful safeguard, together with any required transfer-risk assessment/data-protection test.
7. Assistance with individual rights
Taking account of the nature of processing, ClickDraft will provide reasonable assistance to enable the customer to respond to requests by individuals exercising applicable data-protection rights. If we receive a request directly relating to covered project data, we will normally refer it to the customer and will not respond substantively except on the customer's instructions or where legally required.
8. Security incidents
ClickDraft will notify the customer without undue delay after becoming aware of a personal-data breach affecting covered project data and will provide information reasonably available to help the customer meet its legal notification obligations. The customer remains responsible for deciding whether it must notify regulators or individuals unless the law places a separate duty directly on ClickDraft.
9. DPIAs and regulatory consultation
Taking account of the nature of processing and information available to us, we will provide reasonable assistance with data-protection impact assessments and prior consultation with the ICO where the customer's processing requires it.
10. Return and deletion
At the end of the relevant project, at the customer's choice and subject to the Project Order, ClickDraft will return or delete covered project personal data and delete existing copies unless UK law requires retention. Immediate deletion from backups may not always be technically possible; where so, the data will be put beyond ordinary use and removed on the normal backup deletion cycle. Unless a different period is agreed, active project working files are normally deleted within 90 days after final delivery.
11. Information and audits
ClickDraft will make available information reasonably necessary to demonstrate compliance with applicable processor obligations and will allow reasonable audits or inspections by the customer or its appointed independent auditor. Unless required by a regulator or triggered by a substantiated material breach, audits should normally occur no more than once in any 12-month period, during business hours, on reasonable notice, subject to confidentiality and security restrictions, and at the customer's cost.
12. Customer obligations
The customer is responsible for having a lawful basis for the personal data it provides, giving required privacy information, limiting project data to what is necessary, and giving lawful documented instructions. The customer must not provide special-category or criminal-offence data unless necessary for the project and expressly agreed in writing.
13. Processing details
Subject matter: architectural documentation and related project support. Duration: the Project Order plus agreed return/deletion period. Nature and purpose: receiving, reviewing, organising and producing architectural documentation from customer-provided project information. Data subjects: customer personnel, consultants, clients, project contacts, occupants or other persons whose information is included in the project. Personal data: names, business contact details, correspondence, project identifiers and other personal information contained in supplied model/drawing/project files. Sensitive information is not intended to be processed unless specifically agreed.
14. Priority and liability
If this DPA conflicts with the Terms or Project Order on a data-protection issue, this DPA controls for that issue. Liability under this DPA is subject to the liability provisions of the Terms and Project Order to the extent permitted by applicable law.
15. Contact
Data-protection enquiries relating to a Documentation Service project should be sent to support@clickdraft.co.uk.