Data Processing Agreement (Template)

Version: 1 · Effective date: 2026-06-23

This is the standard Data Processing Agreement (DPA) SimpleStruct offers to business customers of ConstructiVision. It governs SimpleStruct’s processing of personal data on the customer’s behalf — principally the content of blueprints a customer uploads for processing, where the customer is the controller and SimpleStruct is the processor. To execute it for your organization, contact privacy@simplestruct.com. Defined terms (controller, processor, personal data, processing, data subject) have the meanings given in the GDPR.

1. Parties and roles

  • Controller: the Customer identified in the order form.

  • Processor: SimpleStruct (“we”).

  • For account, billing, identity, and telemetry data, SimpleStruct is the controller and this DPA does not apply (the Privacy Policy governs). For customer-uploaded blueprint content and data derived from it, SimpleStruct is the processor and this DPA applies.

2. Subject-matter, duration, nature and purpose

  • Subject-matter: processing blueprint content the Customer uploads, to extract panel geometry and produce derived drawing data.

  • Duration: the term of the Customer’s subscription, plus the retention/deletion windows in §7.

  • Nature and purpose: automated extraction, transformation, and storage of uploaded content to deliver the ConstructiVision service.

3. Types of personal data and categories of data subjects

  • Personal data: names, addresses, signatures/stamps, and similar identifiers that may appear within uploaded blueprints.

  • Data subjects: third parties named on the Customer’s blueprints (e.g. architects, owners, engineers, contractors).

4. Processor obligations

We will:

  1. Process personal data only on the Customer’s documented instructions (including for international transfers), unless required by law (and then we will inform the Customer unless legally prohibited).

  2. Ensure persons authorized to process the data are bound by confidentiality.

  3. Implement appropriate technical and organizational security measures (§6).

  4. Respect the conditions in §5 for engaging sub-processors.

  5. Assist the Customer — by appropriate measures — in responding to data-subject requests (access, rectification, erasure, restriction, portability, objection).

  6. Assist the Customer with security, breach notification, DPIAs, and prior consultation (GDPR Arts. 32–36).

  7. Notify the Customer without undue delay after becoming aware of a personal-data breach affecting the Customer’s data.

  8. At the Customer’s choice, delete or return all personal data at the end of the service (§7), and delete existing copies unless retention is legally required.

  9. Make available information necessary to demonstrate compliance and allow for and contribute to audits, including inspections, subject to reasonable notice and confidentiality.

5. Sub-processors

  • The Customer provides general authorization for SimpleStruct to engage the sub-processors listed at Sub-processors.

  • We will inform the Customer of intended changes (addition/replacement), giving the Customer the opportunity to object on reasonable data-protection grounds.

  • We impose data-protection obligations on each sub-processor no less protective than those in this DPA, and remain liable for their performance.

6. Security measures

We maintain, at minimum: encryption of personal data in transit (TLS 1.2+) and at rest; access controls limiting data to authorized personnel; tenant isolation of stored content; audit logging; and a documented process for restoring availability after an incident. Current measures are summarized in our security documentation and updated as the service evolves.

7. Retention and deletion

Uploaded blueprint content is deleted after extraction unless the Customer configures retention. On termination, the Customer may export its content; thereafter we delete or return it per §4.8. Our retention bounds and deletion mechanisms are described in our retention policy; financial records SimpleStruct holds as controller are retained for the statutory period and are out of scope of this DPA.

8. International transfers

Where a sub-processor processes personal data outside the Customer’s region, transfers are made under the Standard Contractual Clauses or an equivalent valid transfer mechanism, as recorded per sub-processor at Sub-processors. The SCCs are incorporated into this DPA by reference and prevail over conflicting terms in respect of transfers.

9. Liability and order of precedence

This DPA forms part of the main services agreement. In case of conflict on data-protection matters, this DPA prevails. Liability is governed by the main agreement.

10. Signature

Controller (Customer)

Processor (SimpleStruct)

Name

Title

Date

Signature

This template is provided for convenience and is not legal advice. Customers should have it reviewed by their own counsel before signing.