TODO — flagged for legal review before publication.
Definitions
“Customer Data” means personal data processed by PreconIntel on behalf of Customer. “Sub-processor” means any third party engaged by PreconIntel to process Customer Data.
Scope and Purpose
This DPA applies to the processing of Customer Data by PreconIntel in the course of providing the services under the Master Subscription Agreement. PreconIntel acts as a processor; Customer is the controller.
Data Processing Details
Categories of data: identifying information, contact details, employment role, bid content, and Procore project metadata. Categories of data subjects: Customer's employees, sub-contractor contacts referenced in bid documents, and project stakeholders.
Security Measures
PreconIntel maintains appropriate technical and organizational measures, including:
- Encryption of Customer Data at rest (AES-256) and in transit (TLS 1.3)
- Multi-tenant database isolation via Row-Level Security
- Role-based access control and least-privilege principles
- Regular security testing and an ongoing SOC 2 Type II audit
Sub-processors
Customer authorizes PreconIntel to engage the sub-processors listed at /legal/subprocessors. We provide at least 30 days' notice before adding new sub-processors; Customer may object in good faith during that period.
Data Subject Rights
PreconIntel will assist Customer in responding to data-subject access, correction, and deletion requests within the timeframes required by applicable law.
Data Breach Notification
PreconIntel will notify Customer without undue delay (and in any case within 72 hours) of becoming aware of a personal-data breach affecting Customer Data.
Data Transfers
Customer Data is stored in the United States. Transfers outside of primary-storage regions (e.g. for support) are governed by standard contractual clauses where applicable.
Term and Termination
This DPA remains in effect for the duration of the Master Subscription Agreement. On termination, PreconIntel will delete or return Customer Data within 30 days unless legally required to retain it.