Legal

Data Processing Agreement

This agreement ("DPA") forms part of the Terms of Service between Evidence Pack ("Processor") and the subscribing organization ("Customer" or "Controller"). It applies automatically when you use the service.

Last updated October 30, 2026

1Definitions

Personal Data means information about an identified or identifiable person that we process on the Customer's behalf through the service. Data Subject means that person, such as a guard, supervisor, client contact, visitor or someone named in an incident report. Data Protection Laws means the privacy laws that apply to the processing, including US state privacy laws and, where applicable, the GDPR and UK GDPR.

Controller, Processor, Processing and Subprocessor have the meanings in those laws, and the terms "business" and "service provider" apply in their place where relevant.

2Scope and purpose

We process Personal Data only to provide the service for the Customer, which includes:

  • GPS-verified clock-ins, live location during shifts, and patrol tracking
  • Incident report creation, storage, photos and attachments
  • Scheduling, timekeeping, payroll support and invoicing
  • Workforce records, documents, licenses and certifications
  • Visitor logs and site activity
  • Client portal access and report sharing
  • AI-assisted transcription, report review and the Shield assistant
  • Messaging, notifications and support

Processing lasts for the term of the Customer's subscription and the deletion period in Section 11.

3Categories of Personal Data

  • Workforce: names, contact details, address, date of birth, last four digits of a Social Security number, photo, employment and pay details, licenses and certifications, precise location, clock-in and clock-out times, assigned sites, schedules, messages and voice recordings for spoken reports.
  • Incident reports: event descriptions, names and contact details of people involved, physical descriptions, injury details, photos and attachments.
  • Visitors and client contacts: names, company, contact details, photos, vehicle plates and visit times.
  • Account and technical data: administrator details, IP addresses, device information and usage logs.

4Our obligations

We will:

  • Process Personal Data only on the Customer's documented instructions, which include these terms and its use of the service, unless the law requires otherwise. We'll say so if we believe an instruction breaks the law.
  • Bind everyone authorized to process Personal Data to confidentiality.
  • Maintain the security measures in Section 8.
  • Assist with Data Subject requests, security, breach notification, and any required impact assessment or regulator consultation, taking into account the information available to us.
  • Not sell or share Personal Data, and not retain, use or disclose it outside our direct business relationship with the Customer or for any purpose other than the services, except as Data Protection Laws allow.
  • Not combine it with data from other sources, except as those laws allow.
  • Tell the Customer if we can no longer meet our obligations, and stop and fix unauthorized use when the Customer asks.

5The Customer's obligations

  • Have a lawful basis for the Personal Data it collects, and give Data Subjects the required notices. This includes telling guards and staff about location tracking and obtaining any required consent.
  • Give lawful instructions and keep the data accurate.
  • Manage users, roles and client portal links, and revoke access when it's no longer needed.
  • Respond to Data Subject requests it receives.
  • Decide whether AI features are appropriate for its use and review their output.

6Data Subject requests

We'll help the Customer respond to requests to access, correct, delete, restrict, object to or export Personal Data. If a Data Subject contacts us directly, we'll refer them to the Customer and won't respond ourselves unless the law requires it. The Customer is responsible for verifying identity. We'll act on the Customer's instructions within 30 days.

7Subprocessors

The Customer gives general authorization for the Subprocessors on our subprocessors page. We'll give at least 30 days' notice before adding or replacing one. The Customer may object on reasonable data protection grounds within 14 days. If we can't resolve the objection, the Customer may end the affected service and receive a refund of prepaid fees for the unused period. We bind each Subprocessor to data protection terms at least as protective as this DPA and remain responsible for its performance.

8Security measures

  • Encryption: TLS 1.2 or higher in transit and AES-256 at rest.
  • Access controls: role-based permissions so users see only what their role allows.
  • Authentication: signed session tokens, session expiry and rate limits on sign-in.
  • Data isolation: organization-level separation of records in a multi-tenant system.
  • Infrastructure: established cloud providers that maintain independent security attestations, with regular backups.
  • Monitoring: logging of access and activity for audit purposes.

9Personal Data breaches

We'll notify the Customer without undue delay, and within 72 hours, after becoming aware of a breach affecting its Personal Data. We'll provide the information we have and can reasonably obtain to help it meet its reporting duties, and we'll cooperate on investigation, mitigation and remediation. Notice isn't an admission of fault.

10International transfers

Personal Data is processed and stored in the United States. Where Data Protection Laws restrict a transfer, the parties rely on an adequacy decision or the European Commission's Standard Contractual Clauses (with the UK Addendum where needed), which we'll complete with the Customer on request, along with any additional measures required.

11Retention and deletion

Records stay available for the Customer's plan period: 6 months (Starter), 1 year (Professional), 3 years (Business) or as agreed (Enterprise). After termination, the Customer may request an export for 30 days. We then delete Personal Data from active systems, and from backups as they cycle out, unless the law requires us to keep it.

12Audits

We'll make available the information reasonably needed to show compliance with this DPA, and we'll answer reasonable written security questions. If that isn't enough, or a regulator requires it, the Customer may audit on at least 30 days' written notice, during business hours, once a year (or after a breach), under confidentiality and at its own expense unless the audit reveals material non-compliance.

13Liability and precedence

Each party's liability under this DPA is subject to the limits in the Terms of Service. If this DPA and those terms conflict on the handling of Personal Data, this DPA controls.

14Term and governing law

This DPA lasts as long as we process Personal Data for the Customer. Confidentiality, deletion and breach obligations survive termination. Michigan law governs, except where Data Protection Laws or the Standard Contractual Clauses require another law.

15Contact

Data protection inquiries: Evidence Pack, Detroit, Michigan. Email info@getevidencepack.com.