Data Processing Agreement.

Controller

The Customer, who determines the purposes and means of processing personal data by using the Service.

Processor

Tagsight, which processes personal data on behalf of the Controller to provide the Service.

Sub-processor

A third party engaged by the Processor to assist in processing personal data.

Personal Data

Any information relating to an identified or identifiable natural person.

Data Subject

The individual to whom the personal data relates.

Processing

Any operation performed on personal data, including collection, storage, use, and deletion.

This DPA applies when Tagsight processes personal data on behalf of the Customer in connection with the Service. The Customer is the Controller; Tagsight is the Processor. Processing is limited to what is necessary to provide the instrument extraction Service described in our Terms of Service.

Subject matter

Automated extraction of structured engineering data from documents the Customer uploads. These include P&IDs, single-line diagrams, SAMA logic sheets, loop diagrams, cause and effect matrices, instrument datasheets, instrument indexes, cable schedules, junction box schedules, equipment and MCC schedules, and other tabular engineering documents, together with any further material the Customer submits to the Service.

Duration

For the term of the service agreement between the Customer and Tagsight.

Nature and purpose

Reading uploaded engineering documents to identify instruments, equipment, lines, valves and their relationships; proposing classifications for review; comparing revisions; generating structured registers and exports such as I/O lists, instrument indexes, equipment lists, line lists and valve lists; and answering the Customer’s questions about their own uploaded documents through the Service’s assistant.

Types of personal data

Account information (name, email, authentication identifiers); uploaded documents, which may contain title-block and revision metadata naming individuals such as drafters, checkers and approvers; extraction results and the Customer’s review edits; and the text of questions the Customer puts to the assistant.

Categories of data subjects

The Customer’s authorized users of the Service, and any individuals named in the documents the Customer uploads, such as the drafter, checker or approver recorded in a drawing title block.

Tagsight shall:

1. Process personal data only on documented instructions from the Controller, unless required by applicable law.
2. Not train any artificial intelligence model on Customer Content.
3. Ensure that persons authorized to process personal data have committed to confidentiality or are under an appropriate statutory obligation of confidentiality.
4. Implement appropriate technical and organizational security measures as described on the Security page.
5. Engage sub-processors only with prior authorization and in accordance with Article 5 of this DPA.
6. Assist the Controller with data subject access requests, taking into account the nature of processing.
7. Assist the Controller with obligations related to data protection impact assessments and prior consultation with supervisory authorities, where applicable.
8. At the Controller’s choice, delete or return all personal data upon termination of the Service, and delete existing copies unless storage is required by applicable law.
9. Make available all information necessary to demonstrate compliance with these obligations.

Tagsight uses the following categories of sub-processors to provide the Service. All current sub-processors are established in the United States and process in United States regions; the CDN and security provider also operates a global edge network. The named entities, with locations, are provided in the signed DPA.

Notification of changes. Tagsight will notify the Controller via email at least 30 days before engaging a new sub-processor. The Controller may object to a new sub-processor within 15 days of notification. If the objection cannot be resolved, either party may terminate the affected Service.

In the event of a personal data breach, Tagsight will notify the Controller without undue delay and in any event within 72 hours of becoming aware of the breach. The notification will include:

1. The nature of the breach, including categories and approximate number of data subjects and records affected.
2. The likely consequences of the breach.
3. The measures taken or proposed to address the breach and mitigate its effects.
4. Contact details for further information.

Where sub-processors are located outside the European Economic Area or the United Kingdom, Tagsight ensures appropriate safeguards are in place, including Standard Contractual Clauses where applicable, in accordance with GDPR Chapter V and PIPEDA requirements for cross-border data transfers.

The Controller may audit, or appoint a qualified third-party auditor subject to confidentiality obligations, to verify Tagsight’s compliance with this DPA, subject to the following conditions:

1. At least 30 days advance written notice.
2. During normal business hours.
3. No more than once per twelve-month period, unless a data breach has occurred or a supervisory authority requires an audit.
4. The Controller bears the costs of the audit.

This DPA is effective for the duration of the service agreement between the Controller and Tagsight. Upon termination, Tagsight will, at the Controller’s choice, delete or return all personal data within 30 days, except where retention is required by applicable law. Obligations regarding confidentiality and data security survive termination.

Liability under this DPA is subject to the limitations set forth in the Terms of Service.

Formal notices under this DPA may be sent by email to support@tagsight.io.