Data Processing Agreement

1. Parties and roles

For workforce personal data that the Customer uploads to or generates in the Service (names, work email addresses, department and station, documents assigned, notifications sent and acknowledgement records), the Customer is the controller and AeroSign is the processor. Each party will comply with the data protection law that applies to it, including the UK GDPR and Data Protection Act 2018 and, where applicable, the EU GDPR (“Data Protection Law”).

For account-holder, billing and website-visitor data AeroSign acts as an independent controller, as described in the Privacy Policy; that processing is outside this DPA.

2. Scope and details of processing

The subject matter, duration, nature and purpose of processing, the types of personal data and the categories of data subject are set out in the Annex.

3. Processing on instructions

• AeroSign will process Customer personal data only on the Customer’s documented instructions, which are: to provide the Service as described in the agreement and as configured by the Customer’s administrators in the application; and any further written instructions agreed between the parties.
• AeroSign will inform the Customer if, in its opinion, an instruction infringes Data Protection Law, unless prohibited from doing so.
• AeroSign will not use Customer personal data for its own purposes, sell it, or use it for advertising or for training machine-learning models.

4. Confidentiality

AeroSign will ensure that persons authorised to process Customer personal data are bound by confidentiality obligations, and that access is limited to those who need it to provide, support and secure the Service.

5. Security measures

AeroSign will implement and maintain appropriate technical and organisational measures, which at the date of this DPA include those described on the Security & Trust page:

• encryption of data in transit (TLS) and at rest;
• per-organisation access control enforced in the database (Row Level Security) and in the application;
• private document storage with time-limited signed access links;
• role-based permissions, a minimum password length of 12 characters and database-level protection against role escalation;
• acknowledgement records that cannot be edited once made, and an audit log of key administrative actions;
• automated backups managed by the database provider.

AeroSign may update these measures from time to time provided the overall level of protection is not reduced.

6. Subprocessors

• The Customer gives general authorisation for AeroSign to engage the subprocessors listed at useaerosign.com/subprocessors as at the date of this DPA.
• AeroSign will give the Customer at least [notice period, e.g. 30 days — to be confirmed] notice before engaging a new subprocessor that will process Customer personal data, by updating that page and emailing the Customer’s administrators. The Customer may object on reasonable data-protection grounds within that period; if the objection cannot be resolved, the Customer may terminate the affected part of the Service without penalty.
• AeroSign will impose data-protection obligations on each subprocessor that are no less protective than those in this DPA, and remains responsible for their performance.

7. International transfers

AeroSign’s primary database and file storage are located in [Supabase project region — to be confirmed]. Where Customer personal data is transferred to a subprocessor outside the UK or EEA, AeroSign will ensure an appropriate transfer mechanism is in place, such as the provider’s standard contractual clauses with the UK International Data Transfer Addendum where required. [Confirm the mechanism for each subprocessor — to be confirmed].

8. Data subject requests

Taking into account the nature of the processing, AeroSign will assist the Customer with appropriate technical and organisational measures to respond to requests from data subjects exercising their rights. The application lets administrators view, export, correct and delete workforce data directly. If AeroSign receives a request directly from a data subject it will, where lawful, refer the request to the Customer within [number of days — to be confirmed] and not respond further except on the Customer’s instructions.

9. Personal data breach notification

AeroSign will notify the Customer without undue delay, and in any event within [hours, e.g. 48 — to be confirmed] hours of becoming aware, of a personal data breach affecting Customer personal data. The notification will describe, so far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. AeroSign will provide further information as it becomes available and will cooperate with the Customer’s own notification obligations.

10. Assistance and records

• AeroSign will assist the Customer, taking into account the nature of the processing and the information available to it, with data protection impact assessments and prior consultation with a supervisory authority where required.
• AeroSign will maintain records of its processing activities as required by Data Protection Law and make them available to the Customer on reasonable request.

11. Return and deletion of data

• During the term, the Customer can export acknowledgement records as CSV at any time.
• On termination or expiry, the Customer may delete its organisation from the application, which removes documents, acknowledgement records and workforce accounts immediately. Otherwise AeroSign will delete Customer personal data within [number of days — to be confirmed] of termination, unless retention is required by law.
• Residual copies in provider backups are overwritten in line with the provider’s backup retention cycle and are not restored except for disaster recovery.

12. Audit rights

AeroSign will make available the information necessary to demonstrate compliance with this DPA, including the Security & Trust page, the subprocessor list and responses to reasonable security questionnaires. Where that information is insufficient, the Customer (or an independent auditor bound by confidentiality) may audit AeroSign’s compliance no more than once per year on [notice period — to be confirmed] written notice, during business hours, in a manner that does not unreasonably disrupt AeroSign’s operations or compromise other customers’ data. AeroSign does not currently hold ISO 27001 or SOC 2 certification; subprocessor reports may be relied on for infrastructure controls.

13. Liability and term

This DPA applies for as long as AeroSign processes Customer personal data. Each party’s liability under this DPA is subject to the limitations and exclusions in the main agreement, [confirm with counsel whether a separate cap applies to data-protection liability — to be confirmed]. This DPA is governed by the same law as the main agreement.

14. Annex: processing details