Data Processing Agreement

1. Parties and roles

You, the business using Mustr, are the controller. BAM Digital Solutions, owned by Benjamin Maddison and trading as Mustr, is the processor. Words such as “personal data”, “processing” and “personal data breach” have the meaning given in the UK GDPR.

2. Details of the processing

• Subject matter: providing Mustr under the Terms of Service.
• Duration: while your account is open, and until data is deleted or returned under section 9.
• Nature and purpose: receiving reports and records on WhatsApp, storing them, classifying them with AI, drafting RIDDOR, CDM and other records, sending reminders and sign-off requests, and showing everything in your dashboard and evidence packs.
• People the data is about: your staff, subcontractors and crew members, people injured or involved in incidents, witnesses, and your dashboard users.
• Types of data: names, roles, WhatsApp numbers, email addresses, incident descriptions, dates, times and locations, photos, sign-off records and accreditation details.
• Special category data: health data, such as injury details in incident reports.

3. Our obligations

We will:

• process personal data only on your documented instructions, which are these terms and your use of Mustr, and tell you if we think an instruction breaks data protection law;
• make sure anyone who can access the data is bound by confidentiality;
• keep the security measures in section 5 in place;
• only use sub-processors as set out in section 6;
• help you respond to requests from people using their data protection rights;
• help you with security, breach notification, data protection impact assessments and ICO consultation, as far as our role allows;
• delete or return data at the end of the service as set out in section 9;
• give you the information you reasonably need to show compliance with Article 28, and allow audits as set out in section 8.

We do not use your data for our own purposes, sell it, or use it to train AI models.

4. Your obligations

You confirm you have a lawful basis, and where needed an Article 9 condition, for the data you put into Mustr, and that you have told the people concerned how their data is used, including that AI helps classify reports.

5. Security

• Data is separated by customer, and the database enforces that each customer sees only its own records.
• Data is encrypted in transit (TLS) and at rest.
• Photos and documents are held in private storage and shared only through links that expire.
• An audit log records changes to records.
• Message text, photos and phone numbers are kept out of service logs.
• Production access is limited to the people who run Mustr.
• Database data is hosted in Ireland (EU).

6. Sub-processors

You give general authorisation for us to use the sub-processors below. Each is bound by written data protection terms that give the same level of protection as this agreement, and we remain responsible for them. We will email you before adding or replacing a sub-processor, giving you 30 days to object. If you object on reasonable data protection grounds and we cannot resolve it, you may end your subscription.

7. International transfers

Where a sub-processor processes data outside the UK, we make sure the transfer is covered by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework), the ICO’s International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.

8. Breaches and audits

We will tell you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your data, with the information you need to report it to the ICO and to the people affected.

You may audit our compliance with this agreement once a year, or after a breach, on reasonable notice. We will first answer written questions and share our providers’ security reports where we can.

9. End of the service

When your account closes, we keep your records for 90 days so you can ask for an export. After that, we delete your personal data, except where the law requires us to keep it. Our database provider takes automatic daily backups that are kept for 7 days, so deleted data can remain in those backups for up to 7 days after deletion, and then it is gone.

You remain responsible for keeping your own records for as long as the law requires, for example at least three years for records of reportable incidents under RIDDOR 2013, so export them before you leave.

10. Contact

For data protection questions or to report a concern, email ben@bam-digitalsolutions.com.