1. Parties and roles
This agreement forms part of the InishForce Terms & Conditions. The customer company is the data controller of the personal data in its workspace, and InishForce is the data processor, as defined in Article 28 of the General Data Protection Regulation (GDPR).
2. What is processed
- People: the customer's employees, subcontractors and other authorised users.
- Data: contact and identity details, roles, certificates, learning records, attendance, timesheets, time-off, single-point clock-in/out location, site forms, inspections, incident reports, photos, documents and signatures.
- Purpose: providing the InishForce service for as long as the customer's subscription lasts.
3. Our commitments as processor
- We process personal data only on the customer's documented instructions, which include using the service as intended.
- Everyone with access to the data is bound by confidentiality.
- We apply appropriate technical and organisational security measures, including encryption in transit, separation of each company's data enforced in the database, role-based permissions, private file storage and audit logging.
- We only use subprocessors under written terms that offer equivalent protection, and we inform customers of changes so they can object.
- We help the customer respond to data subject requests and, where needed, with impact assessments.
- We notify the customer without undue delay after becoming aware of a personal data breach affecting its workspace.
- At the end of the service, we return the data on request and then delete it, unless the law requires it to be kept.
- We provide the information reasonably needed to show that we meet these obligations.
4. Support access
InishForce staff may access a workspace to provide onboarding, document set-up or support. Each access is recorded with who accessed it, which company and when.
5. International transfers
Where a subprocessor handles data outside the European Economic Area, the transfer is protected by an EU adequacy decision or the European Commission's Standard Contractual Clauses.
6. Contact
Data protection: privacy@inishforce.com. Security issues: security@inishforce.com.