1. Parties and scope
This agreement forms part of the BuildPilot Terms of Service between the business customer (the controller) and Ryan Brown trading as BuildPilot AI (the processor) where Article 28 UK GDPR applies.
2. Processing details
The subject matter is provision of BuildPilot's hosted construction-management, CRM, quotation, tender, estimating, communication and AI-assisted workflows. Processing lasts for the customer's use of the service and any limited post-termination retention described in the Privacy Notice. Data may include business contact details, enquiry and correspondence data, user-generated records, tender documents and other personal data the customer chooses to upload. Data subjects may include the customer's staff, prospects, clients, suppliers, subcontractors and other business contacts.
3. Documented instructions
BuildPilot will process customer-controlled personal data only on documented instructions from the customer, including instructions inherent in the customer's use and configuration of the service, unless UK law requires otherwise. If law requires processing outside those instructions, we will inform the customer before processing unless legally prohibited.
4. Confidentiality
People authorised to process customer-controlled personal data must be subject to an appropriate duty of confidentiality and receive access only where reasonably required for their role.
5. Security
BuildPilot will maintain proportionate technical and organisational measures appropriate to the risk, including authenticated access, password hashing, encrypted transport, tenant-scoped authorisation, audit records, rate limiting and restricted access to production credentials.
6. Subprocessors
The customer gives general written authorisation for BuildPilot to use subprocessors needed to provide and secure the service. The current categories/providers are described on the Subprocessors page. BuildPilot will require relevant subprocessors to protect personal data consistently with applicable processor obligations. Material changes to subprocessors will be reflected on that page and, where reasonably practicable, notified through the service.
7. Data-subject requests
Taking into account the nature of the processing, BuildPilot will provide reasonable assistance to help the customer respond to data-subject rights requests where the relevant personal data is processed through BuildPilot and the customer cannot reasonably fulfil the request using available product controls.
8. Security incidents
BuildPilot will notify the customer without undue delay after becoming aware of a personal-data breach affecting customer-controlled data where notification is required, and will provide information reasonably available to support the customer's assessment and response.
9. Compliance assistance
Taking into account the nature of processing and information available to us, BuildPilot will provide reasonable assistance with security, breach assessment, data-protection impact assessments and regulator consultation obligations where applicable to the customer's use of the service.
10. Return and deletion
On termination, BuildPilot will delete or return customer-controlled personal data on request, subject to applicable law, security requirements, legitimate dispute preservation and normal backup rotation. Customers should export information they need before account closure.
11. Information and audits
BuildPilot will make information reasonably necessary to demonstrate compliance with these processor obligations available to the customer. Any audit request must be reasonable, proportionate, protect other customers' confidentiality and, where possible, rely first on available security documentation and written responses.
12. International transfers
Where use of a subprocessor involves a restricted transfer under UK data-protection law, BuildPilot will ensure an appropriate transfer mechanism or exception is available before making that transfer.
13. Contact
Data-protection questions may be sent to admin@buildpilotai.co.uk.