Data Processing Agreement

Inland Construction Ltd · Nassau, Commonwealth of The Bahamas · Effective 18 July 2026

This Data Processing Agreement ("DPA") describes how Inland Construction Ltd ("Inland Construction", "we") processes personal data when providing construction management services and platform access to business clients, developers, and partner organisations (each, a "Client"). It supplements, and is incorporated by reference into, the service contract between Inland Construction and the Client.

For most engagements Inland Construction acts as an independent data controller of the information it collects. Where a Client (for example, a property developer) provides us personal data about its own customers, staff, or stakeholders for us to process on the Client's behalf, we act as a data processor for that data, and this DPA governs that processing.

1. Scope of processing

Item	Description
Subject matter	Construction project management: planning, permits, milestone tracking, documents, invoicing, communications, and reporting.
Duration	The term of the underlying service contract, plus the retention period in Section 6.
Data subjects	Client personnel, property purchasers or occupants named by the Client, builder companies and crews, site visitors named in reports.
Data categories	Names, contact details, project roles, correspondence, project documents and photos, invoicing and payment status. No card numbers (held by Stripe). No special-category data is required and Clients should not submit it.
Purpose	Solely to deliver the contracted services. We do not use Client-provided personal data for advertising and never sell it.

2. Our obligations as processor

Process Client personal data only on the Client's documented instructions and for delivering the contracted services;
Ensure staff and builders with access are bound by confidentiality obligations;
Apply the security measures in Section 5;
Assist the Client, insofar as reasonably possible, in responding to data-subject requests (access, correction, deletion);
Notify the Client without undue delay after becoming aware of a personal data breach affecting the Client's data, with the information needed to meet the Client's own obligations;
Delete or return Client personal data at contract end, per Section 6.

3. Sub-processors

The Client authorises the following sub-processors, used to run our platform. We will inform active Clients before adding or replacing a sub-processor that materially changes how their data is handled.

Provider	Purpose	Location
Google LLC (Firebase / Google Cloud)	Application hosting, database, file storage, authentication	United States
Stripe, Inc.	Payment processing (card data is held by Stripe, not by us)	United States
Telecommunications providers (SMS/WhatsApp/email delivery)	Service notifications and messages	United States / Bahamas

4. International transfers

Platform data is stored on Google Cloud infrastructure in the United States. By engaging our services, the Client authorises this transfer. We select providers that maintain recognised security certifications and contractual data-protection commitments.

5. Security measures

Encryption in transit (TLS) for all platform traffic;
Role-based access enforced at the database level, clients see only their own projects, builders only their assigned projects;
Invitation-only account creation; no public self-registration;
Server-side enforcement of tenant isolation for all data queries;
Audit trail of key project actions (milestone verification, payments, signatures);
Provider-level protections from Google Cloud (SOC 2, ISO 27001 certified infrastructure).

6. Retention and deletion

On termination of the service contract, we return or delete Client personal data on request, except records we must retain for legal, tax, warranty, or dispute-resolution purposes under Bahamian law (retained for at least 7 years, then deleted). Backups are purged on their normal rotation cycle.

7. Audits and information

On reasonable written notice (no more than once per year, absent a breach), we will make available information reasonably necessary to demonstrate compliance with this DPA, including summaries of our security practices and relevant sub-processor certifications.

8. Governing law

This DPA is governed by the laws of the Commonwealth of The Bahamas. Where a Client is subject to a foreign data-protection regime (for example, the EU/UK GDPR for overseas purchasers), the parties will cooperate in good faith to put in place any additional required terms.

Contact

Inland Construction Ltd
Nassau, New Providence, The Bahamas
info@inlandconstruction.dev · +1 242 432 5106