Parties, roles, and precedence

This DPA is intended to form part of the agreement between the identified InspectRenew operator (Provider) and the subscribing shop (Customer). It governs personal data processed on Customer’s behalf and controls conflicting processing terms. A privacy notice does not amend Customer’s instructions.

Customer is the controller or business, or an authorized processor for its own customer. Provider is the processor or subprocessor and, where applicable, a service provider or contractor. Actual conduct determines each role. Provider separately determines purposes for its own account, billing, tax, and security records; that does not permit unrelated reuse of inspection data.

Instructions and processing details — Schedule A

Customer instructs Provider to collect, host, organize, retrieve, protect, generate, and deliver inspection records, operate authorized verification and booking pages, and send expressly authorized communications through subscribed features. Instructions include lawful settings and authorized requests. Provider must flag an instruction it believes unlawful and suspend affected processing while the parties resolve it.

  • Purpose: inspection recordkeeping, reporting, verification, booking, and permitted renewal administration.
  • Duration: the subscription and agreed return/deletion period, subject to documented legal holds.
  • Individuals: shop personnel, customers, building owners, managers, representatives, signers, and people incidentally included in authorized evidence.
  • Data: business contacts, site identifiers and addresses, equipment, findings, photos, names and signatures, bookings, permitted messages, consent and audit metadata, and notification tokens.
  • Frequency: continuous storage, event-driven access and uploads, report generation, notifications, and scheduled reminders.
  • Sensitive information: not requested; minimize incidental sensitive material. Biometric identification and general-purpose model training are not authorized.
  • Customer privacy contact and Provider incident contact must be identified in the accepted order.

Purpose limits and confidentiality

Provider processes data only for the specified purposes and lawful instructions unless law requires otherwise, notifying Customer before legally required processing unless prohibited. Authorized personnel must be bound by confidentiality and receive appropriate training.

Provider must not sell or share Customer Personal Data, use it for cross-context behavioral advertising, retain, use, or disclose it outside the direct business relationship and specified purposes, or combine it with other customer or independently collected data except as expressly permitted by applicable law and the agreed DPA. Inspection records and messaging consent are not authorized for general analytics, model training, or lead generation.

Provider must meet applicable processor/service-provider duties and the legally required level of protection, notify Customer if it can no longer comply, and permit reasonable steps to stop and remediate unauthorized processing. By executing the DPA, Provider certifies that it understands and will follow these restrictions.

Customer responsibilities

Customer must provide required notices, a valid basis for its instructions, authority over records, necessary upstream-controller permissions, data minimization, lawful retention instructions, and evidence of messaging permission. An inspection acknowledgment is not SMS marketing permission. Public disclosure of a full private report requires authority.

Customer responsibilities do not transfer away Provider’s own statutory or contractual duties.

Security requirements — Schedule B

The following controls are requirements to document and verify before production processing, not a completed security attestation:

  • Organization-scoped access, least privilege, administrator MFA, and timely access removal.
  • Tenant separation, private media, controlled temporary links, encryption in transit, and provider-supported encryption at rest.
  • Secure development, vulnerability handling, secrets management, patching, and minimized logs.
  • Backup and recovery procedures, tested restoration, and reapplication of deletion and suppression instructions.
  • Data export, a deletion register, incident response, trained personnel, and monitored incident contacts.
  • Restricted signature and permission evidence, versioned records, traceable corrections, and integrity checks without representing a hash as identity verification.
  • Reviewed public-field projections and redacted files, including free text, and no advertising tags on token-bearing verification or booking routes.

Security evidence and changes

Controls may improve without materially reducing protection. No certification, penetration-test result, recovery time, or geographic restriction is promised unless the accepted order identifies it with supporting evidence.

Subprocessors and changes

Customer authorizes the providers in the dated register attached to the accepted order for the stated purposes. Provider must bind subprocessors to relevant protective obligations and remains responsible for their performance. Independent controllers must be identified separately.

The proposed change procedure provides at least 30 days’ prior notice before a new or replacement subprocessor receives Customer Personal Data. Customer may object on reasonable data-protection grounds during that period. If no reasonable alternative is available, Customer may terminate the affected service before the change with a prorated refund of unused prepaid fees. A website update alone is insufficient notice. This period requires approval and operational implementation.

Requests, assessments, and audits

Provider must forward relevant requests without undue delay and not disclose data independently unless instructed or legally required. The proposed forwarding target is five business days, always early enough for Customer’s applicable deadline; a shorter legal deadline takes precedence.

Provider must assist with applicable access, correction, deletion, portability, opt-out, security, risk-assessment, and regulatory duties, considering the processing and information available. Provider must supply compliance information and allow reasonable audits, including independent assessments and targeted inspection when documentation is insufficient. Safeguards must not obstruct a legally required audit or incident investigation.

Personal-data incidents

Provider must notify Customer without undue delay after awareness of a breach affecting Customer Personal Data. The proposed contractual maximum is 24 hours after awareness, including an initial notice while investigation continues. This proposed service commitment is not a universal statutory deadline or a verified operating capability.

Notices should include known scope, likely consequences, response steps, and contact details, with updates on affected individuals, data, and remediation. Provider must contain and investigate, preserve evidence, and cooperate. Customer ordinarily decides notices for data it controls; Provider retains its own legal notification duties. Notification is not an admission of liability.

Return, deletion, and retention — Schedule C

At termination or lawful instruction, Customer chooses return/export or deletion unless retention is legally required. The proposed schedule allows up to 30 days after termination for export, deletion of active copies within 30 days after that return period or an approved deletion instruction, and isolated backup expiry within 90 additional days. These periods require engineering and legal approval against actual storage products.

During that period, processing is limited to return, security, deletion, and required retention. Public verification and outbound reminders must stop when their authorization ends. Provider must confirm active deletion and the latest backup-expiry date and reapply erasure after a restoration.

Legal holds must identify scope, purpose, and review date. Accounting and minimal consent/suppression evidence may be kept separately when justified; they do not justify indefinite retention of full inspection files. Customer must receive a usable original-record export and supply its approved retention matrix, including applicable code and AHJ requirements.

International transfers — Schedule D

Hosting locations, access countries, and onward transfers remain to be confirmed in the accepted schedule, including Brazil if support accesses data there. There is no US-only processing commitment.

Before a restricted transfer, document the data flow, legal basis, exporter/importer roles, and valid transfer mechanism. Where required, official ANPD standard clauses must be attached in full with only permitted completion. This page does not incorporate those clauses, and EU clauses or a vendor’s US certification do not automatically establish a Brazilian transfer mechanism. Affected transfers must wait for an effective schedule.

Acceptance and amendments

Authorized representatives must accept the DPA with the order, retaining identities, version, date, and acceptance evidence. Material changes require notice and must not reduce statutory protection. The approved agreement controls liability, subject to nonwaivable law and independent rights of individuals and regulators.

Contact

Current website support contact: support@inspectrenew.com.

The operator’s designated legal contact is pending confirmation.