Data processing addendum
Version 1, 29 October 2026
Template: confirm with your advisor. This addendum is published as a starting point for business customers. It has not yet been reviewed by a lawyer, and the parts marked [to confirm] are still open.
This addendum forms part of the terms of use between Asset Arc Services, South Australia [ABN and postal address to confirm] (“Plotlay”, the processor) and a business or organisation that uses Plotlay to handle personal information about other people, such as its staff, clients, tenants or asset contacts (“the customer”, the controller). It applies where the EU or UK General Data Protection Regulation (GDPR) or the Swiss Federal Act on Data Protection applies to that processing. It applies automatically to Team plans; any other business customer can rely on it by emailing hello@plotlay.io [signature process to confirm].
1. What we process for you
| Subject matter | Hosting, syncing, sharing and processing the projects, files and registers the customer puts in Plotlay’s cloud |
|---|---|
| Duration | While the customer uses Plotlay’s cloud, and the deletion periods in section 7 |
| Nature and purpose | Storage, display, sharing, export, rendering and the other features the customer chooses to use |
| Personal information | Whatever the customer puts in projects: names, email addresses and phone numbers in registers and forms, photos, GPS positions from field capture and Plotlay Scan, comments, and the email addresses of people the customer invites |
| Data subjects | The customer’s staff, contractors, clients and other people named or pictured in its projects |
The customer should not put special categories of personal information (such as health information) in Plotlay unless it has its own lawful basis and safeguards for doing so.
2. Our duties as processor (GDPR Article 28)
- We process the personal information only on the customer’s documented instructions: these terms, this addendum and what the customer does in the app. We tell the customer if we think an instruction breaks data protection law. If a law makes us process it otherwise, we tell the customer first unless that law forbids it.
- Everyone at Plotlay who can reach the information is bound to keep it confidential.
- We take the security measures in section 4.
- We use subprocessors only as section 3 sets out.
- We help the customer, as far as we reasonably can, to answer requests from people using their rights (access, rectification, erasure, restriction, portability, objection). Most of these the customer can do itself in the app: edit or delete items and projects, and export them.
- We help the customer meet its duties on security, breach notice, data protection impact assessments and prior consultation, taking into account what we process and the information we have.
- At the end, we delete or return the information as section 7 sets out.
- We give the customer the information it needs to show that these duties are met, and allow and contribute to audits, as section 8 sets out.
3. Subprocessors
The customer gives general authorisation for the subprocessors listed in our privacy policy (Supabase for the database and storage in Sydney, Cloudflare for hosting, Resend for email, Stripe for payments, RunPod for Print quality renders and design ideas, Anthropic for reading design ideas, and Kie.ai, used only in staff testing). We bind each one to data protection terms that give the same protection as this addendum, and we remain responsible for them. We tell the customer by email at least 30 days before adding or replacing a subprocessor [notice period to confirm]; the customer can object on reasonable data protection grounds, and if we can’t resolve the objection, the customer can end the affected plan and get a refund of any prepaid period it has not used.
4. Security measures
- Encryption in transit (HTTPS with TLS) for the app, the website, the connector and every service call; encryption at rest by our database and storage provider.
- Access control in the database itself (row level security on every table): a project opens only for its owner, its team, its invited guests and holders of a share link the owner made.
- Sign-in by emailed code or passkey; connector keys and sign-in codes stored only as one-way hashes; Plotlay support views a customer’s project only when the customer allows it on a ticket, read only, until the ticket closes.
- Plan limits, abuse limits and rate limits enforced on the server; request counts keyed by salted hashes, not raw IP addresses.
- Automatic tests of the access rules against a fresh database for every change, and separated production credentials kept in our providers’ secret stores.
- A 7-day undo for changes made by AI agents, and restore points in the app.
5. Breach notice
If we become aware of a personal data breach affecting the customer’s information, we tell the customer without undue delay, and in any case within 48 hours [period to confirm], by email to the account owner. We give what we know: what happened, the information and people affected, the likely consequences and what we are doing about it, and we keep the customer updated. The customer decides whether to notify its supervisory authority and the people affected; we help.
6. Transfers
Plotlay’s database is in Australia, which has no adequacy decision. To the extent the customer’s use of Plotlay transfers personal information from the EU, EEA, UK or Switzerland to us, the parties agree to the European Commission’s Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module 2 (controller to processor), with the UK International Data Transfer Addendum and the Swiss amendments where they apply. They are incorporated by reference; the details they need are in section 1 and section 4, the supervisory authority is the one competent for the customer, and the clauses are governed by the law of Ireland [to confirm]. For onward transfers, our subprocessors’ terms include the same clauses or rely on an adequacy decision.
7. Deletion or return at the end
The customer can export every project at any time (Export, then Project file, plus CSV, GeoJSON, Shapefile, DXF and other formats). When the customer deletes a project, its files, links and shares are removed within about 15 minutes; when the account is deleted, everything in it goes straight away, except records the law makes us keep (payment and tax records). Copies in our providers’ backups expire on their normal cycle [backup retention to confirm]. If a plan ends without the account being deleted, nothing is deleted: the projects stay, and the Free plan’s limits apply to new ones.
8. Information and audits
On request we give the customer a written description of our measures and our subprocessors’ certifications (for example their SOC 2 or ISO 27001 reports, where they publish them). If that is not enough to show compliance, the customer can audit us once a year, at its own cost, with 30 days’ notice and under confidentiality, in a way that does not disturb the service or other customers’ data.
9. Order of precedence
If this addendum and the terms of use disagree on personal information, this addendum wins; if the Standard Contractual Clauses disagree with either, the clauses win.