Data Processing Terms

The Customer is the controller for personal data contained in its Organisation workspace and determines the purposes and means of that processing. the Groundmaster project is the processor and processes such data only on the Customer's documented instructions, which include the configuration choices made in the Platform and the use of its features.

• process personal data only on documented instructions and not for our own purposes;
• ensure personnel with access are bound by confidentiality and act on a need-to-know basis;
• implement and maintain appropriate technical and organisational measures;
• assist the Customer with data subject requests, impact assessments and consultations with supervisory authorities;
• notify the Customer without undue delay after becoming aware of a personal data breach affecting its data;
• make available information reasonably necessary to demonstrate compliance;
• delete or return personal data at the end of processing, subject to legal retention requirements.

• ensure a lawful basis exists for the data it places in the Platform and for the instructions it gives;
• provide the required transparency information to its own personnel and other data subjects;
• configure roles, permissions, page-level access, retention settings and sharing appropriately;
• keep access lists current, and suspend or remove access when no longer required;
• avoid submitting special categories of personal data unless a lawful basis and safeguards are in place.

We maintain measures including encryption in transit and at rest, row-level access enforcement, role-based and page-level authorisation, logical tenancy separation, least-privilege administrative access, secret management, audit logging, monitoring and alerting, secure development practices, dependency review, backup and restoration testing, and defined incident response. The Security Overview describes these controls; measures may be updated provided the level of protection is not reduced.

The Customer authorises the use of subprocessors for hosting, storage, authentication, email delivery, model inference, monitoring and similar functions, by category as described in the Subprocessors document. Each subprocessor is bound by written terms imposing protection obligations no less protective than these terms. We remain responsible for their performance and will give notice of intended changes so that the Customer may object on reasonable data protection grounds.

Transfers outside the European Economic Area rely on an adequacy decision or on appropriate safeguards such as standard contractual clauses, together with a transfer risk assessment and supplementary measures where required. Primary hosting and processing regions are the European Economic Area (EEA), where technically available; any processing by third-party subprocessors outside the EEA is subject to appropriate GDPR safeguards, including Standard Contractual Clauses where applicable.

Where a User invokes an AI-assisted feature, the prompt and the context required to answer it are transmitted to a model provider acting as subprocessor, solely to return a response. Providers are contractually prohibited from using that content to train their models. AI output is generated for the requesting Organisation only.

On reasonable written request and subject to confidentiality, we will provide information about our processing and security measures, and will cooperate with audits that are proportionate, scheduled in advance, and limited to what is necessary to verify compliance.

At the end of processing, personal data is deleted or returned in accordance with the Data Retention & Deletion Policy and the Data Export & Portability Policy, except where retention is required by law. Backup copies are removed on their normal expiry cycle.

Liability under these terms is subject to the limitations in the Terms of Use, except where applicable data protection law provides otherwise. In case of conflict, these terms prevail for personal data processing.