DPA Annex A — Processing Details
Version: 2026-11-08
Executed between: SiteAxis and the business identified in the account or Order under DPA dated the date the Customer accepts the Terms or signs an Order. Processing-role approval: Internal record, available to customers on request.
1. Subject, nature, purpose and duration
| Item | Agreed processing detail |
|---|---|
| Subject matter | Hosted management of Company/Project workspaces, memberships, role settings, inspection and incident records, observations, corrective actions, permits, daily reports, risk, schedule/P6/XER, commercial, equipment/assets, documents, notifications, reports, APIs and authorized exports |
| Nature of processing | Collection, upload, organization, storage, retrieval, display to authorized Project users, searching/filtering, workflow processing, controlled sharing, secure attachment delivery, export, audit, backup, correction and authorized deletion; conditional analysis by approved AI providers only where separately activated |
| Purpose | Supply and secure subscribed SiteAxis workflows for Customer-selected construction or infrastructure Projects; support and incident investigation as permitted |
| Duration | Order Term plus approved controlled export/retention/backup/legal-hold periods in Annex E; specific values 30, 90, 30 |
| Frequency | Ongoing as Customer/users interact with the Services, and episodic for imports, exports, support and approved retention actions |
| Processing and hosting locations | United States (Vercel, Washington D.C. region) with a global edge network, Canada (Montréal, AWS ca-central-1), Canada and the United States; do not treat a serverless function region alone as complete data-residency evidence |
| Authority for joint Projects | the project roles configured in the account, governed by the Project Collaboration Schedule |
2. Categories of Data Subjects
- Customer and participating company employees, users, admins, project managers, schedulers, inspectors, site contacts, client representatives, contractors and subcontractor personnel.
- Incident reporters, injured workers, witnesses, supervisors, affected persons and other persons named in safety or environmental evidence; some may not have SiteAxis accounts.
- Persons appearing in photographs, attachments, witness statements, permits, drawings and imported records.
- Project supplier and consultant contacts, field operators, approvers and authorized external reviewers.
- Other identified individuals whose information Customer lawfully uploads into configurable record fields or files, subject to reasonable data minimization.
3. Categories of Personal Data
| Category | Examples and qualification | Handling requirement |
|---|---|---|
| Account and access | Names, work emails, company affiliations, job titles, project access, invited user status, role and MFA state | Distinguish Customer-controlled roles from SiteAxis's own account/security purposes |
| Project administration and contacts | Contractor/subcontractor business links, inspectors, superintendents, client and contractor representatives, location/sublocation assignment, authorized personnel lists | Project/tenant scope and legitimate multi-company visibility |
| Operational evidence | Reports, inspection answers, corrective actions, observations, comments, author/reviewer identities, activity history, photos, document versions and files | Restricted access, necessary collection, auditability |
| Safety / injury-related data | Injured worker name/company/trade/supervisor, medical attention category, affected body part, witness identity/statements, incident chronology, photos, injury summaries | Potentially sensitive; apply verified access/retention rules and work-related injury descriptions, affected body part, first-aid or medical-attention indicator and witness statements; no health-card numbers or medical records |
| Locations and timestamps | Project location and sublocation, site evidence location, inspection/request times, optional device-derived weather/geolocation when enabled | Collect only where relevant and lawful; inform users where geolocation access is requested |
| Schedule/commercial | Imported schedule assignments, planners/approvers, variations, contract contacts, invoices/references in uploaded files | Do not presume numeric/schedule data is non-personal |
| System/security metadata | Login, session/account, scoped audit and safe abuse event metadata, IP/device/network details if processed by hosting/provider | Service operational purposes may involve independent SiteAxis-controller processing |
| Billing/account management | Business contact, subscription and invoice metadata processed by SiteAxis as contracting party | Outside Customer-processor instructions to the extent SiteAxis decides own billing/tax purposes |
| Optional AI inputs/outputs | Uploaded text, document/image derivatives and generated project summaries only if authorized | No AI transfer of real customer data until AI record summaries, dashboard insights and photo analysis, enabled per company by its administrator and provider controls confirmed |
*Do not import the generic General Legal template's assumption that all sensitive data is excluded. SiteAxis safety/incident workflows are designed to accept some injury-related information. Allowed and restricted classes require a completed business, employment/privacy and legal assessment. This does not* imply SiteAxis is HIPAA-eligible or permitted to process any category of medical records.
4. Prohibited or specially controlled data
Unless approved in writing under an Order Form and supported by controls, Customer must not deliberately submit full payment-card credentials, account passwords, authentication tokens, government identity scans/numbers, biometric templates used for identification, extensive medical histories unrelated to incident management, children’s records or data prohibited by law. The approved exception matrix is role-restricted Incident access and audit logging. Incident injury fields necessary for a lawful HSE workflow are not categorically excluded; they remain sensitive and subject to documented controls.
5. Role map by processing context
| Processing context | Proposed legal role | Evidence / decision |
|---|---|---|
| Customer-owned Project Records | Customer/authorized Project Sponsor generally controller or organization; SiteAxis processor/service provider | Proposed; requires project relationship analysis Internal record, available to customers on request |
| Participation by separately contracted GC/owner/subcontractor | Could be independent controllers or other arrangement depending on project contract and real control | Do not assume all parties are subprocessors; resolve the project roles configured in the account |
| SiteAxis public website inquiries, direct sales and CRM | SiteAxis may be independent controller/organization | Privacy Policy applies; provider facts pending |
| SiteAxis account/billing, fraud/abuse, legal and tax compliance | SiteAxis may be independent controller for specified purposes | Identify disclosure and data retention separately |
| Authorized AI subcontracted processing | Depends on approved service, provider contract and actual purpose | AI record summaries, dashboard insights and photo analysis, enabled per company by its administrator is mandatory before real personal data |
| Customer-specific hosted processing with cross-border access | Processor/service provider subject to applicable transfer obligations | Annex C/D verification required |
6. Customer obligations and instructions
Customer must furnish valid collection notices/grounds, role assignments and retention instructions; assess employment-related and health-sensitive data where applicable; identify legitimate recipient organizations; approve project/location access; maintain legal holds; and promptly update revoked roles. SiteAxis must follow lawful documented processing instructions within capabilities and approved schedules, preserve tenant/project authorization boundaries and provide agreed assistance.
7. Review record
Business owner: the SiteAxis Privacy Officer (privacy@siteaxis.app) · Data map revision: 2026-11-08 · Last verified: November 8, 2026 · Counsel sign-off: Internal record, available to customers on request.
Questions about these documents?
Contact the SiteAxis team for help with a policy or agreement.