Purpose
This addendum applies where ConstructIQ processes personal data on behalf of a customer. It forms part of the Terms of Service. Where the two conflict on data protection, this addendum wins.
1. Roles
The customer is the controller. ConstructIQ is the processor. Sub-processors are listed in section 6.
ConstructIQ processes personal data only on the customer's documented instructions. Using the service as intended constitutes those instructions.
2. What is processed
| Subject matter | Provision of the ConstructIQ construction management platform |
|---|---|
| Duration | For as long as the customer holds an account, plus the retention period in section 8 |
| Nature | Storage, organisation, retrieval, transmission and deletion |
| Categories of data subject | Customer staff; contractor and sub-contractor personnel; the customer's own clients |
| Categories of personal data | Name, business email, phone number, role; site check-in location and time for crew; photographs taken on site; content of messages and site reports |
| Special category data | None is required by the service. Note that incident reports may contain health information if the customer records injuries in them — see section 3. |
3. Incident reports and health data
The service provides incident reporting for site accidents. If a customer records injury details, that is health data and attracts a higher standard of protection.
ConstructIQ does not require or request health data. Customers who record it are responsible for having a lawful basis to do so and for limiting who in their organisation can see it — the role permissions in the service allow that to be restricted.
4. Crew location data
Location is the most sensitive category the platform handles, and the controls are technical rather than promised:
- Recorded only for users with a crew role, and only where the customer has enabled it for that individual.
- Recorded only between 07:00 and 18:00 Nassau time. This is enforced by the server-side security rules, so a modified client cannot record outside the window.
- Visible only to project managers, administrators and site inspectors within the same organisation.
- Immutable once written — location records cannot be altered or deleted through the application.
Telling crew members that location is collected is the customer's responsibility as controller.
5. Security measures
- Encryption in transit (TLS) and at rest.
- Tenant isolation enforced in server-side database rules, not in application code alone. A user authenticated to one organisation cannot read another's data even by querying the database directly.
- Role-based access control, with roles set server-side only. A client cannot elevate its own permissions.
- Isolation and permission rules are tested automatically against the live ruleset whenever they change.
- Passwords stored hashed; not retrievable by ConstructIQ personnel.
- Administrative access to customer data restricted to a named operator allow-list, and logged.
6. Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Google Cloud / Firebase | Hosting, database, storage, authentication, push notifications | United States
(us-east1) |
| Anthropic | AI estimating and code-compliance assistance | United States |
| Twilio | SMS and WhatsApp notifications | United States |
| OpenWeatherMap | Weather and storm alerts (site coordinates only, no personal data) | Europe |
| Web Hosting Canada | Outbound email delivery | Canada |
ConstructIQ will give the customer prior notice of any new sub-processor handling personal data, and remains responsible for their performance.
7. International transfers
Personal data is stored in the United States. Customers and their personnel are typically in The Bahamas, so the service involves an international transfer.
8. Return and deletion
The customer can export its data at any time while the account is active.
9. Assisting the controller
ConstructIQ will provide reasonable assistance with:
- requests from individuals to access, correct or delete their data;
- data protection impact assessments;
- security incidents affecting the customer's data.
Most individual requests can be answered by the customer directly, since administrators can view, edit, export and deactivate the records in their own workspace.
10. Personal data breach
ConstructIQ will notify the customer without undue delay after becoming aware of a personal data breach affecting that customer's data, with the information needed for the customer to meet its own obligations.
11. Audit
ConstructIQ will make available the information reasonably necessary to demonstrate compliance with this addendum, and will contribute to audits carried out by the customer or an auditor it mandates, on reasonable notice and no more than once a year unless required by a regulator.
12. Acceptance
13. Contact
support@constructiq.dev
Nassau, Commonwealth of The Bahamas