Data processing agreement
Version 2. Last updated: 20 September 2026. Made under Article 28 of Regulation (EU) 2016/679 (GDPR).
1. The parties
| Party | Detail |
|---|---|
| The Controller ("the Customer") | Name ____________________ Registered address ____________________ Company registration number ____________ Contact for data protection ____________ |
| The Processor | Michael McCarthy, trading as DoorInspec+ Registered business name number 768230, registered 6 July 2025 Bantry, Co. Cork Contact for data protection support@doorinspect.ie |
This Agreement takes effect on ____________________
1.1 This Agreement governs the processing of personal data by DoorInspec+ ("the Processor"), on behalf of the Controller in connection with the DoorInspec+ service ("the Service"), and forms part of the agreement between the parties for the supply of that Service ("the Principal Agreement").
1.2 Where this Agreement conflicts with the Principal Agreement, this Agreement prevails in respect of the processing of personal data.
2. Roles of the parties
2.1 The Customer is the controller and DoorInspec+ is the processor in respect of the personal data described in Annex 1.
2.2 The Customer determines the purposes and means of the processing. It is responsible for the lawfulness of the personal data it and its personnel enter into the Service, for having a lawful basis for that processing, and for informing data subjects as required by Articles 13 and 14 of the GDPR.
2.3 DoorInspec+ acts as a controller in its own right in respect of the Customer's account and billing records, its own business correspondence with the Customer, and crash diagnostics collected with the consent of the individual user. That processing is outside the scope of this Agreement and is described in the DoorInspec+ privacy notice.
2.4 The Customer acknowledges that the Service records the location and working time of individuals who use it, and that this amounts to monitoring of those individuals. The Customer is responsible for informing them of that monitoring before it begins, for identifying a lawful basis for it, and for consulting employee representatives where required.
2.5 The Customer shall not use location or working time data recorded through the Service for any purpose it has not told those individuals about. In particular, data captured to record the start and end of a work session shall not be used to monitor an individual's movements during the working day.
3. Obligations of the Processor
DoorInspec+ shall:
3.1 Process personal data only on the Customer's documented instructions, including in relation to transfers to a third country, unless required to do otherwise by European Union or Member State law. Where such a legal requirement applies, it will inform the Customer of that requirement before processing, unless the law prohibits it from doing so on important grounds of public interest.
3.2 Treat this Agreement, the Principal Agreement and the ordinary operation of the Service as the Customer's documented instructions. Any further instruction must be given in writing.
3.3 Immediately inform the Customer if, in its opinion, an instruction infringes the GDPR or other data protection law.
3.4 Ensure that every person authorised to process the personal data is bound by an appropriate obligation of confidentiality, whether contractual or statutory, and that access is limited to those who need it to deliver the Service.
3.5 Implement and maintain the technical and organisational measures set out in Annex 2, as required by Article 32 of the GDPR.
3.6 Respect the conditions in clause 4 for engaging another processor.
3.7 Taking into account the nature of the processing, assist the Customer by appropriate technical and organisational measures, insofar as this is possible, in fulfilling its obligation to respond to requests to exercise data subject rights under Chapter III of the GDPR.
3.8 Assist the Customer in ensuring compliance with its obligations under Articles 32 to 36 of the GDPR, taking into account the nature of the processing and the information available to DoorInspec+.
3.9 At the Customer's choice, delete or return the personal data at the end of the provision of the Service, in accordance with clause 10.
3.10 Make available to the Customer all information necessary to demonstrate compliance with Article 28, and allow for and contribute to audits in accordance with clause 9.
3.11 Acknowledge that the recording of location and working time through the Service is likely to constitute the systematic monitoring, tracking or observing of individuals' location or behaviour, which appears on the list of processing operations adopted by the Data Protection Commission under Article 35(4) of the GDPR as requiring a data protection impact assessment. DoorInspec+ shall provide the Customer with the information about the Service reasonably required to carry out that assessment.
3.12 Not use location data recorded through the Service for any purpose other than recording the time and place at which a work session was started or ended, and not use any personal data processed under this Agreement to develop, train or improve any product or service.
4. Sub-processors
4.1 The Customer gives general written authorisation for DoorInspec+ to engage the sub-processors listed in Annex 3, which is published and kept current at doorinspect.ie/sub-processors.
4.2 DoorInspec+ shall give the Customer at least thirty (30) days' written notice before engaging any new sub-processor, stating the name, location and processing activity of that sub-processor.
4.3 The Customer may object to a new sub-processor on reasonable data protection grounds within thirty (30) days of notice. If the parties cannot resolve the objection, the Customer may terminate the Principal Agreement in respect of the affected part of the Service, without penalty, on written notice.
4.4 DoorInspec+ shall impose on each sub-processor, by written contract, data protection obligations that are no less protective than those in this Agreement, and remains fully liable to the Customer for the performance of every sub-processor's obligations.
5. International transfers
5.1 Personal data entered into the Service is stored and processed in the European Union. The Service is hosted in Google Cloud regions within the EU.
5.2 DoorInspec+ shall not transfer personal data outside the European Economic Area unless a valid transfer mechanism under Chapter V of the GDPR is in place, and shall inform the Customer of the mechanism relied upon.
5.3 Where a sub-processor provides support, maintenance or engineering functions that may involve access to personal data from outside the EEA, that access is governed by the Standard Contractual Clauses adopted by the European Commission, or by an applicable adequacy decision, as incorporated in that sub-processor's own data processing terms. The current position for each sub-processor is stated in Annex 3.
5.4 Crash diagnostics, described in Annex 3, are processed outside the EEA. They contain no record entered into the Service, no user identifier and no organisation identifier, they are collected only with the individual user's consent, and they are outside the scope of this Agreement under clause 2.3. They are stated here so that the Customer is not surprised by them.
6. Security
6.1 DoorInspec+ shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, having regard to the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing, as required by Article 32 of the GDPR.
6.2 The measures in place at the date of this Agreement are described in Annex 2. DoorInspec+ may update those measures provided the level of protection is not reduced.
7. Data subject rights
7.1 DoorInspec+ shall notify the Customer without undue delay if it receives a request from a data subject relating to personal data processed under this Agreement, and shall not respond to that request itself except on the Customer's documented instruction or where required by law.
7.2 The Service provides the Customer with access to the personal data it holds, so that the Customer may respond to requests for access, rectification, erasure, restriction and portability directly. Where the Customer cannot fulfil a request through the Service, DoorInspec+ shall provide reasonable assistance.
8. Personal data breach
8.1 DoorInspec+ shall notify the Customer without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a personal data breach affecting personal data processed under this Agreement.
8.2 The notification shall describe, so far as known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Where the information is not all available at once, it shall be provided in phases without further undue delay.
8.3 DoorInspec+ shall not notify a supervisory authority or any data subject of a breach on the Customer's behalf unless the Customer instructs it in writing to do so.
9. Audit
9.1 DoorInspec+ shall make available to the Customer, on reasonable written request and no more than once in any twelve month period, the information reasonably necessary to demonstrate compliance with Article 28 of the GDPR.
9.2 The Customer may audit the processing, or appoint an independent auditor to do so, on thirty (30) days' written notice, during normal business hours, and subject to reasonable confidentiality undertakings. The Customer bears its own costs. This limitation does not apply where an audit follows a personal data breach or is required by a supervisory authority.
10. Return and deletion of personal data
10.1 On termination or expiry of the Principal Agreement, DoorInspec+ shall, at the Customer's written choice, return the personal data to the Customer or delete it.
10.2 Where return is chosen, the personal data shall be provided in a structured, commonly used, machine-readable format, together with the compliance records generated through the Service in a durable document form, within thirty (30) days.
10.3 Deletion shall be completed within ninety (90) days of the Customer's instruction, save where storage of the personal data is required by European Union or Member State law, in which case DoorInspec+ shall inform the Customer of the requirement.
10.4 The Customer acknowledges that records created through the Service may be records the Customer is required by law to retain, and that deletion by DoorInspec+ does not discharge those obligations. In particular: compliance records relating to fire doors, firestopping and fire-resisting construction, which the Customer may be required to retain under fire safety and building control legislation, including the Fire Services Acts 1981 and 2003; and records of hours worked, where the Customer is an employer in the State, which must be retained for at least three years under section 25 of the Organisation of Working Time Act 1997 and the Organisation of Working Time (Records) (Prescribed Form and Exemptions) Regulations 2001.
10.5 The Customer is responsible for taking return of any such records before instructing deletion, and for satisfying itself that deletion will not put it in breach of a retention obligation.
11. Liability
11.1 Each party is liable for its own compliance with the GDPR. Liability under this Agreement is subject to the limitations and exclusions in the Principal Agreement.
11.2 Nothing in this Agreement limits the rights of a data subject under the GDPR, or either party's liability under Article 82 of the GDPR.
12. Term, governing law and jurisdiction
12.1 This Agreement takes effect on the date stated in clause 1 and continues for as long as DoorInspec+ processes personal data on the Customer's behalf.
12.2 This Agreement is governed by the laws of Ireland, and the parties submit to the exclusive jurisdiction of the courts of Ireland.
13. Acceptance
13.1 This Agreement may be accepted electronically. Acceptance takes place when a person acting for the Customer signs it, or confirms acceptance of it within the Service or through a link provided by DoorInspec+.
13.2 An electronic acceptance has the same effect as a signature on paper. Neither party shall dispute the validity of this Agreement solely because it was accepted electronically.
13.3 The person accepting warrants that they are authorised to bind the Customer. A user account created for an individual worker does not carry that authority.
13.4 On acceptance, DoorInspec+ records the name and email address of the person accepting, the organisation they accepted for, the date and time, and the version of this Agreement accepted. That record is retained for as long as the Principal Agreement continues, and is available to the Customer on request.
13.5 Acceptance is to the version stated below. Where this Agreement is materially changed, DoorInspec+ shall give the Customer notice and the new version requires fresh acceptance. Continued use of the Service is not by itself acceptance of a materially changed version.
Version ____________ Accepted electronically on ____________________
by ____________________________ for ____________________________
Where a signature is preferred:
| For the Customer | For DoorInspec+ |
|---|---|
| Signature ____________________ | Signature ____________________ |
| Name ____________________ | Name Michael McCarthy |
| Position ____________________ | Position Proprietor |
| Date ____________________ | Date ____________________ |
Annex 1. Details of the processing
Required by Article 28(3) GDPR.
Subject matter. The provision of the DoorInspec+ passive fire records platform, through which the Customer records inspections, installations, defects and remedial work on fire doors, firestopping, fire-resisting construction and intumescent coatings to structural steel.
Duration. For the term of the Principal Agreement, and thereafter only as set out in clause 10.
Nature and purpose. Hosting, storage, transmission, structuring and retrieval of records entered by the Customer's personnel, and the generation of compliance reports from those records, for the purpose of enabling the Customer to create and maintain records of passive fire protection work and to meet its own obligations under fire safety legislation.
Categories of data subject
- The Customer's employees, operatives, foremen and managers who use the Service
- Employees and representatives of organisations the Customer gives access to a project, which may include a main or principal contractor, the Customer's own client, a building owner, a managing agent or an occupier
- Fire officers and other statutory readers given access to a project
- Individuals who appear incidentally in photographs taken on site
Categories of personal data
| Category | Detail |
|---|---|
| Identity and contact | Name, email address, role within the organisation |
| Authentication | Account identifier and authentication data held by the sub-processor; no password is created or held by DoorInspec+ |
| Activity and attribution | Records of which individual created, submitted, approved or amended each record, with date and time. These records are immutable by design |
| Competence | Where the Customer chooses to record it: certification scheme, scope, certificate number and expiry date for an individual, and its validity at the date of a recorded act |
| Location | GPS coordinates and accuracy captured when an individual clocks in or out of a work session |
| Working time | Clock-in and clock-out times, session duration, and hours worked by individual |
| Images | Photographs taken on site, which may incidentally include individuals |
| Free text | Notes, comments and voice-dictated text entered by users, which may contain personal data at the user's discretion |
Retention. Personal data is retained for the term of the Principal Agreement and thereafter in accordance with clause 10. The Customer determines retention within the Service. Records of hours worked must be retained by an employer in the State for at least three years under section 25 of the Organisation of Working Time Act 1997.
Special categories of personal data. None is required by the Service. The Customer must not enter special category data as defined in Article 9 of the GDPR into free text fields or photographs.
Annex 2. Technical and organisational measures
Required by Article 32 GDPR. Every row below is true as at 22 August 2026.
| Measure | Implementation |
|---|---|
| Data location | Personal data entered into the Service is stored in Google Cloud regions within the European Union (europe-west1) |
| Encryption in transit | All traffic between the application and the platform is encrypted using TLS |
| Encryption at rest | Data at rest is encrypted by the hosting sub-processor as standard |
| Access control | Access to a project is granted per user by an administrator of the Customer's organisation. Role-based permissions restrict what each user may read and write, enforced at the platform level by server-side security rules and not only in the application |
| Organisation separation | Every record carries the identifier of the organisation that owns it. Access is scoped to that organisation and enforced server-side. A record that cannot resolve an organisation is refused at creation |
| Authentication | Individual named accounts. Passwords are set by the user and are never created, transmitted or held by DoorInspec+ |
| Attribution and audit | Every submitted record carries the identity of the person who created it and the time of creation. Submitted compliance records are append-only and cannot be altered or deleted through the application |
| Immutability enforced server-side | Append-only behaviour is enforced by security rules on the platform, not by application convention, and is covered by an automated test suite run before every rules deployment |
| Diagnostics are opt-in | Crash and error reporting is disabled by default, is enabled only with the individual user's consent, carries no user identifier, no organisation identifier and no record entered into the Service, and can be withdrawn at any time in Settings |
| Personnel | Administrative access to the platform is held by the proprietor alone. Where support is delegated in future, access will be limited to those who require it to deliver the Service and each will be bound by a written confidentiality obligation |
| Backup and restoration | Data is backed up by the hosting sub-processor with the ability to restore availability following an incident |
| Device security | Data held on a mobile device is protected by the operating system's application sandbox and by the device's own lock. The Customer is responsible for requiring device passcodes on devices used by its personnel |
Annex 3. Authorised sub-processors
As at 22 August 2026. This annex is published and kept current at doorinspect.ie/sub-processors.
| Sub-processor | Processing activity and location | Transfer basis |
|---|---|---|
| Google Ireland Limited (Google Cloud and Firebase) | Hosting, database, file storage, authentication and server-side functions. Data stored in European Union regions (europe-west1). | Data stored in the EU. Support and engineering access from outside the EEA is governed by the Standard Contractual Clauses incorporated in the Google Cloud Data Processing Addendum. |
| Google Ireland Limited (Firebase Crashlytics) | Crash and error diagnostics from the application. Disabled by default and collected only with the individual user's consent. Carries no record entered into the Service, no user identifier and no organisation identifier. Crashlytics offers no data location selection; reports may be processed and stored anywhere Google maintains facilities, including the United States. Retained by Google for 90 days. | Standard Contractual Clauses incorporated in the Google Cloud Data Processing Addendum. |
| Stadia Maps | Map tiles displayed when an individual clocks in or out. Receives the device's IP address and the tile coordinates requested. Does not receive any record entered into the Service, and does not receive the clock-in location as a location: it receives the map area being viewed. | Standard Contractual Clauses in Stadia Maps' own terms. |
| Apple Distribution International Ltd | Distribution of the iOS application. Does not process records entered into the Service. | Established in Ireland. No transfer of Customer records. |
| Stripe Payments Europe, Limited | Subscription billing and payment processing. Processes the billing contact and payment details of the Customer. Does not process the records entered into the Service. | Established in Ireland. Where Stripe transfers data outside the EEA, that transfer is governed by the Standard Contractual Clauses in Stripe's own data processing terms. |
To be added before it is switched on: Google Play distribution, when the Android application ships.