This Data Processing Addendum ("DPA") forms part of the Terms of Service between Centangle Global LLC, a Wyoming limited liability company, 30 N Gould St, Ste R, Sheridan, WY 82801, United States ("Processor", "we") and the Customer that uses ForceVera ("Customer", "you"). It applies whenever we process personal data in Customer Data on your behalf and the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, PIPEDA or a US state privacy law applies ("Data Protection Laws"). It is accepted when you accept the Terms; no separate signature is needed. If this DPA conflicts with the Terms, this DPA prevails for personal data.
1. Roles and scope
You are the controller (or "business") of personal data in Customer Data and we are your processor (or "service provider" or "contractor"). You are responsible for having a lawful basis for the processing, for giving notices to and obtaining any consents from your guards, staff, clients and other people whose data you put into ForceVera, and for the lawfulness of your instructions.
2. Details of the processing
| Subject matter and purpose | Providing the ForceVera security workforce management service: scheduling, attendance and geofenced time clock, patrol tours, incident and daily reports, dispatch, client portal, timesheets, invoicing, notifications and support. |
|---|---|
| Nature of processing | Collection, storage, organisation, retrieval, display, transmission (including by SMS, email and push notification), analysis to produce reports and timesheets, and deletion. |
| Duration | The term of your subscription, plus the return and deletion period in section 10. |
| Categories of data subjects | Your employees and contractors (guards, supervisors, dispatchers, administrators); your clients' contacts and client users; people named in incident reports, visitor logs or other content you add. |
| Types of personal data | Names and contact details; job role, site assignments, schedules and shifts; licence and training records, including photos of licences and identity documents that you ask guards to upload; time and attendance records; location data while on duty; patrol checkpoint scans; incident and activity reports, including photos and notes; messages; device identifiers and push tokens; bill rates and invoice data. |
| Special category data | Not required by the service. You should not add special category data (such as health data) or criminal-offence data unless you have a lawful basis for it under Articles 9 and 10 GDPR; if you do, the security measures in section 5 apply to it. |
3. Instructions
We process personal data only on your documented instructions, which are the Terms, this DPA, and your use and configuration of ForceVera, including for transfers to third countries, unless the law requires otherwise; in that case we will tell you before processing unless the law forbids it. We will tell you immediately if we believe an instruction infringes Data Protection Laws.
4. Confidentiality
We ensure that everyone we authorise to process personal data is bound by confidentiality obligations and accesses it only as needed to provide, secure and support the service.
5. Security
We implement appropriate technical and organisational measures under Article 32 GDPR, including: encryption in transit (TLS/HTTPS); logical separation of each Customer's workspace; role-based access controls in the application; two-step sign-in; password hashing; audit logging of sensitive actions; private storage of uploaded photos and documents, which open only through signed, time-limited links for authorised users of your workspace; least-privilege administrative access with key-based server authentication; regular backups; and keeping software and dependencies patched. We review these measures regularly and may update them provided overall protection is not reduced.
6. Sub-processors
You give general authorisation for us to engage sub-processors. Our current sub-processors are:
| Sub-processor | Purpose | Location |
|---|---|---|
| InMotion Hosting, Inc. | Hosting of the application and database | United States |
| Stripe, Inc. | Subscription billing and payments | United States |
| Twilio Inc. | SMS notifications | United States |
| Cloudinary Ltd. and Cloudinary, Inc. | Private storage of uploaded photos and documents (report and profile photos, licence and identity documents, QR codes, site instruction files) | United States |
| 650 Industries, Inc. (Expo) | Delivery of push notifications to the mobile app | United States |
| Google LLC (Firebase) | Push notifications to Android devices and the live on-duty location feed | United States |
| Apple Inc. (Apple Push Notification service) | Push notifications to iPhones | United States |
| Pusher Ltd | Real-time updates in the web app | EU / United States |
| Geoapify GmbH | Maps (web and mobile app) and address lookup | Germany (EU) |
| Email delivery provider | Notification, report and sign-in emails (unless you use your own email account) | United States |
We impose data protection obligations on each sub-processor that are no less protective than this DPA, and we remain responsible for their performance. We will update this page and notify account owners at least 30 days before adding or replacing a sub-processor. You may object on reasonable data protection grounds within that period; if we cannot reasonably address the objection, you may terminate the affected service and receive a refund of prepaid fees for the remaining term.
7. Data subject requests and assistance
Taking into account the nature of the processing, we help you respond to requests from individuals exercising their rights (most can be handled directly in ForceVera, for example by editing, exporting or deleting records). If we receive a request directly, we will pass it to you without undue delay and will not respond except to confirm we have passed it on. We also give you reasonable assistance with security, breach notification, data protection impact assessments and prior consultation with supervisory authorities (Articles 32 to 36 GDPR), using the information available to us.
8. Personal data breaches
We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Data. The notice will describe, as far as known, the nature of the breach, the categories and approximate number of people and records concerned, the likely consequences and the measures taken or proposed, and will be updated as more information becomes available. We will take reasonable steps to contain the breach and reduce its effects.
9. International transfers
ForceVera is hosted in the United States. Where personal data subject to the GDPR is transferred to a country without an adequacy decision, the parties agree to the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 ("SCCs"), which are incorporated by reference: Module Two (controller to processor) where you are a controller, and Module Three (processor to processor) where you are a processor. For the SCCs: the optional docking clause (Clause 7) applies; under Clause 9 option 2 (general authorisation) applies with the notice period in section 6; the optional language in Clause 11 does not apply; Clauses 17 and 18 are governed by and subject to the courts of Ireland; and Annexes I and II are completed by section 2 and section 5 of this DPA. For data subject to the UK GDPR, the UK International Data Transfer Addendum to the SCCs (version B1.0) applies, with the tables completed by this DPA. For data subject to Swiss law, the SCCs apply with the Swiss Federal Data Protection and Information Commissioner as the competent authority. We assess the laws of destination countries and apply supplementary measures where needed.
10. Return and deletion
You can export Customer Data at any time during your subscription. When the subscription ends, the workspace becomes read-only; at your request we will return Customer Data in a common format, and we delete it from active systems within 90 days of a deletion request or of the end of the subscription, whichever is earlier, unless the law requires us to keep it. Backup copies are overwritten on their normal rotation and remain protected until then.
11. Information and audits
We will make available the information reasonably necessary to demonstrate compliance with Article 28 GDPR, including answers to reasonable security questionnaires. Where that is not enough, you may carry out an audit, or have an independent auditor bound by confidentiality do so, once a year with at least 30 days' written notice, during business hours and without unreasonable disruption, at your own cost, unless a supervisory authority requires otherwise or a breach has occurred.
12. US state laws
Where US state privacy laws (such as the California Consumer Privacy Act as amended) apply, we act as your service provider or contractor. We will not sell or share personal data; retain, use or disclose it for any purpose other than providing the service under the Terms, or outside our direct business relationship with you; or combine it with personal data from other sources except as those laws allow. We will comply with those laws, provide the same level of protection they require, and notify you if we can no longer meet our obligations. You may take reasonable steps to stop and remedy unauthorised use.
13. General
This DPA lasts as long as we process personal data on your behalf. Each party's liability under this DPA is subject to the limitations in the Terms, except where Data Protection Laws or the SCCs do not allow them. Except for the SCCs (governed as set out in section 9), this DPA is governed by the law and courts set out in the Terms (Wyoming). If you need a countersigned copy for your records, email us.
Contact us
Centangle Global LLC, a Wyoming limited liability company that owns and operates ForceVera
30 N Gould St, Ste R, Sheridan, WY 82801, United States
Privacy and legal: [email protected]
Product support: [email protected]