SiteviroData Processing Agreement
Last updated 14 October 2026
This Data Processing Agreement (DPA) forms part of the Terms of Service between Siteviro (the Processor) and the Customer (the Controller). It sets out the terms required by Article 28 of the UK GDPR for personal data Siteviro processes on the Customer's behalf.
Siteviro is operated by its founder as a business that is not yet incorporated and is not yet registered with the Information Commissioner's Office (ICO). This notice will be updated with the registered company details and ICO registration number once available.
1. Scope of processing
| Subject matter | Providing the Siteviro site inspection platform under the Terms of Service |
|---|---|
| Duration | The term of the Customer's account, plus up to 90 days for deletion afterwards |
| Nature and purpose | Hosting, storing, displaying, exporting and sending notifications about the Customer's register records |
| Data subjects | The Customer's staff, operatives, subcontractors, visitors and delivery drivers recorded in registers |
| Personal data | Names, email addresses, signatures, photos, roles, site assignments, inspection records, toolbox talk attendance and incident details |
| Special category / health data | HAVS vibration exposure records and any health or injury details the Customer chooses to record |
2. Siteviro's obligations
- Process personal data only on the Customer's documented instructions (these terms and the Customer's use of the service), unless required by law.
- Ensure everyone authorised to process the data is bound by confidentiality.
- Apply appropriate technical and organisational security measures, including access control by company, site and role, hashed passwords and encrypted connections (HTTPS).
- Assist the Customer in responding to data subject requests and with data protection impact assessments where reasonably required.
- Notify the Customer without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting its data.
- At the end of the service, delete the Customer's data within 90 days unless the law requires it to be kept. The Customer can export PDFs before closing its account.
- Make available information needed to show compliance with this DPA and allow reasonable audits on at least 30 days' notice.
3. Sub-processors
The Customer gives general authorisation for Siteviro to use sub-processors for hosting, database and file storage, email delivery and payment processing. Siteviro will impose data protection terms on each sub-processor equivalent to this DPA and remains responsible for them. An up-to-date list is available on request from privacy@siteviro.co.uk. We will give at least 14 days' notice of new sub-processors, during which the Customer may object.
4. International transfers
Personal data will only be transferred outside the UK where protected by UK adequacy regulations or appropriate safeguards such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
5. Customer's obligations
- Have a lawful basis for the personal data it records, including a condition for any health data such as HAVS records.
- Give its workers appropriate privacy information about the use of Siteviro.
- Only invite people and share links with people who should have access.
6. General
If this DPA conflicts with the Terms of Service on data protection matters, this DPA takes priority. It is governed by the law of England and Wales.