Data processing agreement

This agreement is part of the terms of service of NDT Intact, run by ［運営者名］, ［住所］ ("we"). It applies to the personal data a customer's organisation puts into NDT Intact, for which the organisation decides what happens (the controller) and we process it on its behalf (the processor).

1. What we process, and why

• Subject and purpose: providing NDT Intact as the organisation uses it: writing, signing and issuing inspection reports, keeping registers, storing files, delivering them to its clients, and the features it switches on.
• Duration: as long as the organisation uses NDT Intact, and then as our terms and the closing of an organisation say.
• Kinds of personal data: names, work email addresses and phone numbers, roles and certifications of its people; names and addresses of its clients' people; signatures; what its reports, files, messages and timesheets hold; records of use (sign-ins, activity).
• Whose data: the organisation's staff and crew, its clients' people, and anyone named in what it uploads.

2. What we undertake

• We process the data only on the organisation's documented instructions, which are its use of NDT Intact and its settings, unless the law requires otherwise, in which case we tell it first where the law allows.
• Everyone who handles the data for us is bound to confidentiality.
• We keep the security measures described on our security page: organisations kept apart in the application and the database, encryption in transit and of backups, files reached only through short-lived links, an append-only activity log, and tested backups.
• We use the sub-processors on our sub-processors page, each bound to the same obligations; we tell customers before adding or replacing one, and a customer may object.
• We help the organisation answer requests from the people whose data it holds, and with its own obligations on security, breaches and impact assessments, as far as our part allows.
• We tell the organisation without undue delay of a personal data breach that affects its data.
• When the organisation closes, we return its data on request (the organisation's export) and then delete it, keeping only what the law or the verification of issued reports requires.
• We give the organisation the information it needs to show these obligations are met, and allow audits on reasonable notice.

3. Where the data is

In the hosting region the organisation chose. Where a sub-processor is outside the European Economic Area, the transfer is covered by the European Commission's standard contractual clauses or another lawful mechanism.