1.Definitions

In this DPA:

• “Customer” means the business that holds a BLD company account, or an individual using BLD for business, and has accepted the Agreement.
• “Service” means the BLD website and mobile apps.
• “Surveyor” means an independent survey professional who uses the Service to receive and perform projects.
• “Customer Personal Data” means personal data contained in the content Customer uploads or submits to the Service, such as names and contact details of site contacts, occupants or team members in briefs, notes, drawings, photos, scans and help desk attachments, which BLD processes on Customer’s behalf. Data about Customer’s own users that BLD needs to run the account is Account Data, not Customer Personal Data.
• “Account Data” means data about Customer’s users that BLD needs to manage the relationship, such as names, emails, mobile numbers and sign-in details.
• “Usage Data” means logs, device and activity data generated by using the Service.
• “Data Protection Laws” means all laws that apply to the processing of personal data under the Agreement, including U.S. state privacy laws such as the California Consumer Privacy Act (CCPA).
• “Sub-processor” means a third party engaged by BLD that processes Customer Personal Data.

Other capitalized terms have the meaning given in the Agreement.

2.Roles of the parties

3.Processing of Customer Personal Data

BLD will:

• process Customer Personal Data only to provide the Service under the Agreement and on Customer’s documented instructions, which include using the Service’s features such as sharing a project with matched Surveyors;
• not sell Customer Personal Data, not share it for cross-context behavioral advertising, not retain, use or disclose it outside the direct business relationship with Customer, and not combine it with personal data from other sources, except as the Data Protection Laws permit;
• not use Customer Personal Data to train or improve models, except that BLD may use project content after it has been de-identified as described in Section 8.5 of the Agreement; de-identified data is not Customer Personal Data;
• tell Customer if, in our opinion, an instruction breaks Data Protection Laws;
• tell Customer if BLD can no longer meet its obligations under the Data Protection Laws, and allow Customer to take reasonable steps to stop and remediate unauthorized use of Customer Personal Data;
• make sure staff authorized to process Customer Personal Data are bound by confidentiality obligations; and
• if the law requires us to process data in another way, tell Customer first unless the law forbids it.

Surveyors. Surveyors who receive a project are independent businesses, not BLD Sub-processors. They receive project information because Customer posts the project for matching. They are bound by the Surveyor Terms and the Non-Disclosure Agreement, which treats personal data as Confidential Information and requires them to return or delete it when the project ends.

4.Sub-processors

Customer gives general authorization for BLD to use the Sub-processors listed on our Sub-processors page. BLD will:

• bind each Sub-processor to written data protection terms at least as protective as this DPA, and remain responsible for its performance; and
• update the list at least 30 days before a new Sub-processor starts processing Customer Personal Data.

Customer may object in writing on reasonable data protection grounds within 30 days of the update, and the new Sub-processor will not process Customer Personal Data until that period ends. We will try to offer a reasonable alternative. If we cannot, Customer may stop using the affected part of the Service.

5.Security

BLD maintains technical and organizational measures appropriate to the risk of the processing, as described in Section 13 (Security measures), which is the controlling description. We may update these measures as long as the overall level of protection is not reduced.

6.Personal data breaches

If BLD becomes aware of a breach affecting Customer Personal Data, we will notify Customer without undue delay and within 48 hours. The notice will describe what happened, the data involved, and the steps we are taking. We will take reasonable steps to contain the breach and give the help Customer reasonably needs to meet its own notification duties. Notifying Customer is not an admission of fault.

7.Data subject requests and assistance

If BLD receives a request from an individual about Customer Personal Data, we will direct them to Customer where possible. Taking into account the nature of the processing, we will give Customer reasonable help to respond to requests to access, correct, delete, port or restrict data, and with data protection impact assessments or consultations with regulators where the law requires it.

8.Records and audits

BLD keeps records sufficient to show compliance with this DPA. Once a year, on reasonable written notice, Customer may request information about our security measures and compliance. If that information is not enough to meet Customer’s legal obligations, an independent auditor bound by confidentiality may carry out a reasonable review during business hours, at Customer’s expense and limited to data relevant to Customer.

9.Data location

Customer Personal Data is stored and processed primarily in the United States, with limited processing by Sub-processors in the locations listed on the Sub-processors page. BLD does not currently offer the Service to users in the European Economic Area or the United Kingdom. Before it does, BLD will update this Section with the transfer terms that apply.

10.Return and deletion

When Customer’s account ends, or on Customer’s written request, BLD will within 30 days delete Customer Personal Data, or return it in a commonly used format if requested, unless the law requires us to keep it. Data kept for legal reasons stays protected by this DPA. Data in backups is deleted as backups expire, within 35 days.

11.Term and precedence

This DPA forms part of the Agreement and lasts as long as BLD processes Customer Personal Data. If there is a conflict, this DPA takes priority over the Agreement. Liability under this DPA is subject to the limitations in the Agreement, except where the law does not permit them. Security and data protection commitments in this DPA are not reduced by any right in the Agreement to change or withdraw features.

12.Details of processing

13.Security measures