Data Processing Agreement

Last updated: 9 October 2026 · Schedule 1 to the FitOut Insider Terms of Use · Version 2026-10-09-launch-17, effective from the date you accept the Terms of Use

This Schedule sets out the terms on which FitOut Insider processes personal data on your behalf, as required by Article 28(3) of the UK GDPR and the EU GDPR. 1.1 This Schedule applies where you enter into the Service personal data relating to individuals other than yourself. In practice this includes your employees, your subcontractors' personnel, site operatives, site visitors, emergency contacts and first aiders and people you invite into a project room (guests). 1.2 In respect of that data you are the Controller and we are the Processor. 1.3 In respect of your own account data, billing data and usage records, we are the Controller, and our Privacy Policy applies rather than this Schedule. 1.4 "We", "us" and "our" mean Dariusz Kubies Services (JDG), al. Solidarności 68 lok. 121, 00-240 Warszawa, Poland, NIP 7532202127, REGON 544086256, trading as FitOut Insider. 1.5 This Schedule forms part of the Terms of Use and applies to every customer on every plan. No separate signature is required. 1.6 We and you acknowledge that, in respect of (a) billing and payment records and (b) records we create to evidence the place of supply of the Services for tax purposes, we act as an independent controller and not as a processor on your behalf. Records of those two kinds are called "Our Own Records" in this Agreement. The obligations in this Agreement that apply to us acting as a processor, including without limitation any obligations in respect of deletion, return, audit and sub-processing, do not apply to Our Own Records, which we hold in order to comply with our own obligations under tax law. We keep billing and payment records for seven years, and place-of-supply records until 31 December of the sixth year after the year of your last billing period, and then delete them. If a free trial never becomes paid, we keep its place-of-supply records only for the period set out in section 9 of our Privacy Policy.

Subject matter. Provision of the FitOut Insider platform, a set of tools that generate, store and allow you to reopen and edit construction project documentation. Duration. For as long as your subscription is active, plus the retention period in clause 8. Nature and purpose. Storing, organising, retrieving, generating and making available documentation you create, so that you can meet your own obligations under health and safety, construction and employment law. Where you use a project room, this includes sharing the information you select with guests you invite, and recording their sign-ins, views, downloads, comments, requests and the files they send or receive, as a record of your project. We do not process the data for any purpose of our own.

Categories of data subject: your employees; personnel of your subcontractors and suppliers; site operatives; site visitors; emergency contacts; first aiders; people you invite into a project room (guests); and any other individual you choose to record. Types of personal data: • name, job title, employer and role on site • contact details, including telephone numbers for emergency contacts and first aiders • training, competency and certification records, including expiry dates and uploaded certificate documents • card and scheme numbers, including CSCS card details, scheme type and expiry • attendance, induction, access and visitor records • performance review commentary and competency ratings • health and incident information, including descriptions of injuries and RIDDOR classifications recorded through the Near Miss and Incident Reporting tool • for project room guests: name, email address, company, role, sign-in, viewing and download records, comments, information requests and files they send or receive • any personal details left in templates you upload (templates should be blank; if a template contains names, signatures or contact details, we process them for you) Special category and criminal offence data What we do not hold. The Platform does not provide any facility for recording an individual's security clearance, vetting status, criminal record check, or the outcome of any such check. Fields of that kind have been removed from the Platform. Health information. Some Platform features exist to record workplace incidents, including whether an incident was reportable under the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013. These features record the classification of an incident - what happened, how serious it was, and what was done about it. They do not ask who was involved, and the Platform does not provide fields for the name, address, date of birth or contact details of an injured person. Where a document generated by the Platform contains a section for those details, that section is deliberately left blank for you to complete and retain on your own systems. Free text fields. Some features include free text fields so that you can describe events in your own words. You control what you enter. You should not enter special category data as defined in Article 9 of the UK GDPR, or personal data relating to criminal convictions and offences as defined in Article 10, into any field of the Platform. Where you do so, you remain the controller of that data and you are responsible for having a lawful basis and an appropriate policy document for it. Processing by our sub-processor. Content you submit to a feature that generates output is transmitted to Anthropic PBC in order to produce that output, as described elsewhere in this Agreement. This applies to free text you enter as well as to structured selections. Your statutory records are yours. Nothing in the Platform is a substitute for the records you are required to keep yourself, including an accident book, and nothing in the Platform submits a report to the Health and Safety Executive on your behalf.

4.1 We process personal data only on your documented instructions, including in relation to international transfers, unless required to do otherwise by law. Where we are required by law, we will inform you before processing unless the law prohibits it. 4.2 Your instructions are: this Schedule, the Terms of Use, and your use of the Service through its ordinary functionality. 4.3 We will inform you if, in our opinion, an instruction infringes data protection law.

5.1 Any person authorised by us to process personal data is bound by a duty of confidentiality, whether by contract or by statute. 5.2 As at the version date of this Schedule, the Service is operated by a single individual. We will update this Schedule if that changes.

6.1 We implement appropriate technical and organisational measures under Article 32, including: • encryption in transit using TLS 1.3 • encryption at rest using AES-256 • row level security, so that account data is accessible only to the account it belongs to • Secure, SameSite session cookies, with the session check cookie also set HttpOnly • customer supplied AI API keys encrypted at rest using AES-256-GCM, decrypted server side only at the point of use, never exposed to the browser and never logged • access to production systems limited to the operator 6.2 We do not use your data to train artificial intelligence models, and our AI sub-processor does not use API inputs for training.

7.1 You give general written authorisation for us to engage sub-processors. 7.2 A current list of sub-processors, with their location and function, is published in our Privacy Policy at the address given in the Terms of Use. That list forms part of this Schedule. 7.3 We will give at least 30 days' notice before adding or replacing a sub-processor. If you object on reasonable data protection grounds within that period, you may terminate the affected part of the Service without penalty and receive a refund of any prepaid, unused subscription fees. 7.4 We impose data protection obligations on each sub-processor that are no less protective than those in this Schedule, and we remain liable to you for their performance, subject to clause 8 of the Terms of Use. 7.5 Where you supply your own credentials for a third party service, including your Anthropic API key, you hold the account with that provider on its own terms and our liability under clause 7.4 for that provider is limited accordingly. This does not affect our own obligations as Processor in respect of the data we transmit to it on your instruction. 7.6 Where you enable an optional third party integration, that provider becomes a sub-processor for the data you choose to send to it. Enabling the integration is your instruction to do so. 7.7 Where you use the voice input in your web browser, the provider of your browser converts your speech to text under its own terms. That provider is not our sub-processor. We never receive the audio; any resulting text we receive is processed in the same way as any other input you give us.

8.1 You may delete any document, entry or record at any time through the Service. Deletion is permanent. Deleted database records are removed from live systems immediately and may persist in disaster-recovery backups, from which they are not accessible, until the backup is overwritten on a seven-day cycle. Uploaded files are also copied daily to a separate backup; a deleted file remains in that backup for up to seven days and is then removed. 8.2 On termination or expiry of your subscription your access to the Service ends. Your data is retained for a further 90 days. If you resubscribe within that period your access is restored and your data is unchanged. If you do not, it is permanently deleted at the end of that period and cannot be recovered. 8.3 You are responsible for exporting any record you are required to retain. Construction and health and safety records frequently carry statutory retention periods far longer than a subscription, including RIDDOR records and health and safety files. We do not retain data on your behalf after the period in clause 8.2. If you need a copy after your subscription ends, we can still produce one on written request during the 90 days in clause 8.2 - see clause 8.5. 8.4 Clause 8.2 does not apply to billing, invoice and transaction records, which we retain for 7 years as Controller under tax and accounting law. 8.5 During the retention period in clause 8.2 we will, on written request, provide an export of Customer Personal Data held in your account, including the documents and project registers in which it is contained, within 30 days, in addition to the self-service export available while your subscription is active.

9.1 Data subject rights. Taking into account the nature of the processing, we will assist you by appropriate technical and organisational measures in responding to requests to exercise data subject rights. In practice, and save in respect of Our Own Records, the Service allows you to locate, export, correct and permanently delete records yourself. Where a request cannot be satisfied through the Service, contact us and we will assist. Locating records by person. Records in your project registers carry the account that created them and the account that last changed them. You can use this to identify the records associated with a particular member of your team, and to act on a request about that person. Two record types carry only the account that last changed them, and not the account that first created them: the saved programme, and your client portal display settings. For those, the Service can tell you who last worked on the record but not who originally made it. Where records are created by applying a project template, the account that ran the template is recorded as their creator. 9.2 Personal data breach. We will notify you without undue delay, and in any event within 48 hours, of becoming aware of a personal data breach affecting your data. That first notification will describe what we know at the time and is not conditional on our investigation being complete. It will cover, so far as it is known then, the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed to address it and to limit its effects. Where any of that cannot be given at the same time, we will provide it in phases as it becomes available, without further delay. We work to 48 hours so that you have time to meet your own obligation to notify your supervisory authority within 72 hours of becoming aware. 9.3 Impact assessments. We will provide reasonable assistance with data protection impact assessments and prior consultations, taking into account the information available to us.

10.1 We will make available the information necessary to demonstrate compliance with Article 28. 10.2 You may audit compliance once in any twelve month period, on 30 days' written notice, during business hours, without unreasonable disruption. Where a recognised third party report or completed security questionnaire would answer your questions, we may provide that instead. 10.3 You bear your own costs of any audit.

11.1 We are established in Poland. Data is stored in the European Union, in Ireland. 11.2 Some sub-processors are established in the United States. Those transfers are made under the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and under the EU Standard Contractual Clauses, as applicable. 11.3 The current list of sub-processors and their locations is in our Privacy Policy.

12.1 If there is a conflict between this Schedule and the Terms of Use, this Schedule prevails in respect of the processing of personal data. 12.2 We may update this Schedule where required by law or by a change to the Service. Where a change materially reduces your rights, we will give notice and, where required, seek your acceptance before it takes effect. 12.3 Nothing in this Schedule limits either party's obligations under data protection law.