Data Processing Agreement – baseplan.ai
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between the Customer and Etrog, a sole proprietorship registered in Israel, 139 Keren Kayemet LeIsrael St., Be'er Sheva, Israel (“Etrog”). It applies when Etrog processes personal data on the Customer's behalf in providing baseplan.ai. It is accepted together with the Terms of Service and needs no separate signature. A countersigned copy is available on request at privacy@baseplan.ai.
1. Definitions. “GDPR” means Regulation (EU) 2016/679 and, where it applies, the UK GDPR. “Personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meanings given to them in the GDPR. “Sub-processor” means a third party that Etrog engages to process Customer personal data.
2. Roles. The Customer is the controller of the personal data in the content it and its users upload or create in the Service (“Customer Personal Data”). Etrog is its processor. For account, security and billing data that Etrog uses for its own purposes, Etrog is a controller, as described in its Privacy Policy.
3. Instructions. Etrog processes Customer Personal Data only on the Customer's documented instructions. These instructions are the Terms of Service, this DPA and the Customer's use of the Service's features. The exception is processing required by law, which Etrog will tell the Customer about unless the law forbids it. Etrog will tell the Customer if it believes an instruction infringes data protection law.
4. Confidentiality. Everyone Etrog authorises to process Customer Personal Data is bound by confidentiality. Access is given only to the extent needed to provide, support or secure the Service.
5. Security. Etrog keeps appropriate technical and organisational measures in place to protect Customer Personal Data. They are listed in Annex 2. Etrog may improve them, but will not reduce their overall level.
6. Sub-processors. The Customer gives a general authorisation for Etrog to use sub-processors. The current list is on the sub-processors page. Etrog will:
- bind each sub-processor by a written contract to data protection obligations no less protective than this DPA;
- remain responsible for its sub-processors;
- announce a new or replacing sub-processor at least 30 days in advance, on that page and by e-mail to the Customer's administrators.
The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected service and receive a refund of any prepaid, unused fees for it.
7. Data subject requests. Taking into account the nature of the processing, Etrog helps the Customer answer requests from data subjects. It does this mainly through the Service's own functions, such as editing, deleting and exporting projects and users. If Etrog receives a request directly, it passes it to the Customer and does not answer it itself unless the Customer instructs it to.
8. Personal data breaches. Etrog notifies the Customer without undue delay, and in any case within 72 hours of becoming aware of a personal data breach affecting Customer Personal Data. The notice includes the information then available that the Customer needs for its own obligations. Etrog takes reasonable steps to contain the breach and reduce its effects.
9. Assistance. Etrog gives the Customer reasonable assistance, using the information available to it, with data protection impact assessments and prior consultations with authorities.
10. International transfers. Etrog is established in Israel. The European Commission and the United Kingdom recognise Israel as giving adequate protection. Where a sub-processor processes Customer Personal Data in a country without such recognition, Etrog ensures a valid transfer mechanism. This is either the Standard Contractual Clauses (Commission Decision 2021/914) with the UK Addendum where relevant, or the provider's certification under the EU–US Data Privacy Framework.
11. Deletion and return. When the Service ends, the Customer can export its Outputs and projects for 30 days. Etrog then deletes Customer Personal Data. Copies in backups expire within the backup cycle: database backups within 7 days, and recoverable deleted files within 30 days. The exception is data the law requires Etrog to keep.
12. Audits. On written request, Etrog makes available the information needed to show that it complies with this DPA, including answers to reasonable security questionnaires. If that information is not enough, the Customer may carry out an audit, by itself or through an independent auditor bound by confidentiality, under these conditions: at most once a year, with 30 days' notice, during business hours, at the Customer's cost, and without access to other customers' data. Sub-processors are audited through their own certifications and reports.
13. Liability and precedence. Liability under this DPA is subject to the limitations in the Terms of Service, as far as the law allows. If this DPA and the Terms of Service conflict on the protection of personal data, this DPA prevails. This DPA lasts as long as Etrog processes Customer Personal Data.
Annex 1 – Details of the processing
- Subject and purpose: providing baseplan.ai to the Customer. This means hosting, reading and converting plans and models, planning formwork and shoring, producing drawings, reports, quantities and models, sending service e-mails, and supporting users.
- Nature: storage, conversion, automated analysis (including by AI), generation of outputs, transmission and deletion.
- Duration: the term of the Terms of Service, plus the deletion periods in section 11.
- Data subjects: the Customer's users, and people whose details appear in the Customer's content, such as designers, engineers, clients and contacts named in drawings or title blocks.
- Categories of data: names, e-mail addresses, roles and titles, licence numbers, signatures or stamps that appear in drawings, activity records, and other contact details the Customer chooses to upload. No special categories of data are needed or expected.
Annex 2 – Technical and organisational measures
- Hosting on Google Cloud in the European Union (Belgium; file storage in the EU multi-region), in data centres certified to ISO 27001 and SOC 2.
- Encryption in transit (TLS) for all traffic, and encryption at rest for the database, files and backups.
- Two-step verification required for every user. Passwords stored only as Argon2 hashes. Sign-in sessions limited to one working day.
- Each company's data is separated from every other company's. Access is checked by company and by role on every request.
- Secrets are kept in a managed secret store. Service accounts follow least privilege. Production changes are made only through an automated deployment pipeline.
- Daily database backups with point-in-time recovery, and deletion protection on the production database.
- Request rate limits, security logging and an audit trail of user and staff actions.
- Defined retention periods with automated daily deletion (see the Privacy Policy).
- Staff access limited to what is needed for support, operation and security, under confidentiality.
- Incident response with the breach notification described in section 8.
Annex 3 – Sub-processors
See the sub-processors page, which forms part of this DPA.