Data Processing Addendum
1. Subject matter and scope
This Data Processing Addendum (“DPA”) supplements the BOQ Manager Terms of Service (“Agreement”) and applies to the processing of Personal Data carried out by SEQUENCE SMARTECH LIMITED, operating the BOQ Manager service (“Processor”), on behalf of the Customer (“Controller”) when the Customer uses the Service.
2. Roles
- The Customer is the Controller of Customer Personal Data.
- BOQ Manager is the Processor and acts only on the Customer’s documented instructions.
- BOQ Manager may engage Sub-processors as listed in our Privacy Policy; we will notify the Customer of material changes to that list.
3. Categories of data and data subjects
Personal Data processed under this DPA includes account contact details, hashed credentials, user activity records, and any personal data the Customer chooses to upload to the Service (e.g. names of project team members within drawings, BOQs, or comments).
Data subjects include the Customer’s authorised users and any individuals identifiable within Customer Data.
4. Processor obligations
- Process Personal Data only on the Customer’s documented instructions, including those set out in the Agreement.
- Ensure persons authorised to process Personal Data are bound by confidentiality.
- Implement appropriate technical and organisational measures (see Section 7).
- Assist the Customer in responding to data-subject rights requests where reasonably possible.
- Notify the Customer without undue delay (and in any event within 72 hours) on becoming aware of a Personal Data breach affecting Customer Personal Data.
5. Sub-processors
The Customer authorises BOQ Manager to engage the Sub-processors listed in the Privacy Policy. BOQ Manager will impose data-protection terms on each Sub-processor that are no less protective than this DPA, and remains liable for the acts and omissions of its Sub-processors.
6. International transfers
Where Personal Data is transferred outside the UK / EEA, the parties rely on the European Commission’s Standard Contractual Clauses (or, for UK transfers, the IDTA / UK Addendum to the EU SCCs), which are deemed incorporated into this DPA by reference.
7. Security measures
- Encryption in transit (TLS 1.2+) and at rest (AWS KMS).
- Per-tenant logical isolation in object storage and database.
- Role-based access control inside customer accounts; mandatory TOTP for admin accounts.
- Vulnerability scanning and dependency monitoring on every deployment.
- Audit logging of write operations; logs available to admins via the application.
8. Data-subject rights
BOQ Manager will, on request, provide self-service tools or reasonable assistance to enable the Customer to fulfil access, rectification, erasure, restriction, portability and objection requests.
9. Audit
On reasonable prior written notice, the Customer may audit BOQ Manager’s compliance with this DPA, no more than once per year unless required by a competent supervisory authority. The Customer accepts third-party assurance reports (e.g. SOC 2) where available.
10. Termination and return / deletion
On termination of the Agreement, BOQ Manager will delete all Customer Personal Data within 30 days, save where applicable law requires retention. The Customer may export Customer Data at any time prior to deletion via the in-product export function.
11. Liability
Each party’s liability under this DPA is subject to the limitations of liability set out in the Agreement.
12. Order of precedence
In the event of conflict between this DPA and the Agreement, this DPA prevails to the extent of the conflict.