Data Processing Agreement
This Data Processing Agreement ("DPA") forms part of the Terms of Service between [[LEGAL ENTITY NAME]] ("Processor", "we") and the company using MiQS ("Controller", "you"), and applies whenever we process personal data on your behalf as part of providing the service.
1. Roles
You are the Controller for the personal data of your own employees, subcontractors, and any third parties whose data you upload into MiQS (e.g., named individuals in cost journals, change event owners, risk owners). We are the Processor, acting only on your documented instructions.
2. Subject matter and duration
Processing takes place for the duration of your subscription and continues only as long as necessary to provide the service, plus any retention period set out in the Privacy Policy.
3. Nature and purpose of processing
Storage, retrieval, and display of project commercial data and any personal data it contains; generation of AI-authored CVR narrative and anomaly commentary from that data; user authentication and access control.
4. Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, file storage | [[SUPABASE PROJECT REGION]] |
| [[AI PROVIDER NAME]] | AI-generated CVR narrative and anomaly commentary | [[REGION]] |
We will notify you of any change to this list with at least [[30 DAYS]] notice, during which you may object on reasonable data protection grounds.
5. Our obligations
We will:
- Process personal data only on your instructions (including this DPA)
- Ensure our staff and sub-processors are bound by confidentiality
- Implement appropriate technical and organisational security measures (see Section 6)
- Assist you in responding to data subject requests relating to data you control in MiQS
- Notify you without undue delay on becoming aware of a personal data breach affecting your data
- Delete or return all personal data at the end of the service, at your choice, and delete existing copies unless we're required by law to retain it. Deletion is currently actioned by our team on request to [[CONTACT EMAIL]] rather than through a self-serve control in the product.
6. Security measures
- Row-level access control ensuring one company cannot access another company's data
- Encryption in transit (TLS) for all data
- Role-based access within your company account (owner/admin/QS)
- [[ADD ANY ADDITIONAL MEASURES YOU ACTUALLY HAVE — e.g. encryption at rest via Supabase, backup policy, access logging]]
7. Audits
On reasonable written notice, you may request information reasonably necessary to demonstrate our compliance with this DPA.
8. Liability
Liability under this DPA is subject to the limitations set out in the Terms of Service.
Contact for data protection matters: [[CONTACT EMAIL]]