1. Roles of the parties
This Data Processing Addendum ("DPA") forms part of the agreement between the customer ("Customer", the "Controller") and Vantisco S.R.L.S. ("QoreSafe", the "Processor"). For personal data within a tenant workspace, the Customer is the controller and QoreSafe processes that data only on the Customer's documented instructions, including as set out in the agreement and this DPA.
2. Scope and nature of processing
- Subject matter: provision of the QoreSafe QHSE platform.
- Duration: for the term of the agreement plus any deletion/return period.
- Nature and purpose: hosting and processing QHSE data to deliver the Service.
- Categories of data subjects: the Customer's employees, contractors, and other individuals referenced in QHSE records.
- Types of personal data: account and profile data and QHSE records, which may include health-related injury or illness information (a special category of data).
3. Processor obligations
- process personal data only on documented instructions;
- ensure personnel authorised to process data are bound by confidentiality;
- implement the security measures described in Section 5;
- assist the Controller, taking into account the nature of processing, with its data-protection obligations.
4. Sub-processors
The Controller authorises QoreSafe to engage sub-processors in the following categories: application hosting and managed database; object storage; transactional email; and error monitoring, which receives server-side and browser-side diagnostic data on fault. Each provider is named at /subprocessors. The Controller further authorises the category of artificial-intelligence and large language model processing for the Service's AI features — incident triage, the Safety Copilot, and the optional narration of Safety Insights. Those features are not enabled and no Personal Data has been transferred to a provider under them; the provider named for them is OpenAI, disclosed in advance of enablement as required by this Section, and the Service will not transmit to any other provider. QoreSafe imposes data-protection terms on each sub-processor that are no less protective than this DPA and remains responsible for their performance. QoreSafe will give notice of intended changes to sub-processors and an opportunity to object.
5. Security measures
QoreSafe maintains appropriate technical and organisational measures, including: encryption of data in transit; hashed credentials; role-based access control and tenant isolation; audit logging; access restriction on a need-to-know basis; and regular review of controls. The measures in this section are the security measures that apply.
6. Personal data breach notification
QoreSafe will notify the Controller without undue delay after becoming aware of a personal data breach affecting Customer Data, and will provide information reasonably available to assist the Controller in meeting its notification obligations. Notice will be sent to the contact nominated by the Customer.
7. Assistance with data-subject requests
Taking into account the nature of the processing, QoreSafe will assist the Controller by appropriate technical and organisational measures, insofar as possible, to respond to requests to exercise data-subject rights (access, rectification, erasure, restriction, portability, and objection). Where a data subject contacts QoreSafe directly, QoreSafe will refer them to the relevant Controller.
8. Return or deletion on termination
On termination or expiry of the agreement, QoreSafe will, at the Controller's choice, return or delete Customer Data and delete existing copies, unless retention is required by applicable law. Backups are purged on their normal rotation cycle.
9. International transfers
Where processing involves an international transfer of personal data, QoreSafe will ensure an appropriate transfer mechanism is in place (for example, Standard Contractual Clauses or an adequacy decision) as required by applicable law.
10. Audits
QoreSafe will make available information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller, subject to reasonable confidentiality and scheduling conditions.
11. Contact
DPA and data-protection enquiries may be sent to Vantisco S.R.L.S., Milan, Italy (VAT IT10026760966). Further details are available at vantisco.it.