Terms of Service & Privacy Policy

Jurisdiction: United Kingdom

Privacy Policy

Effective Date: 3 October 2026

Company: Insight OS Limited

Jurisdiction: United Kingdom

1. Introduction

We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, and safeguard your information when you use our platform.

2. Information We Collect

• Personal Data: Information you provide during registration or use, such as name, email address, company name, and contact details.
• Usage Data: Data about how you use the platform, including login times, pages viewed, and features used.
• Cookies and Tracking: We use cookies and similar technologies to improve your experience and analyze platform usage.

3. How We Use Your Information

• To provide and maintain our services
• To process billing and payments securely via Stripe
• To communicate important updates and support
• To improve and personalize your experience
• To comply with legal obligations

4. Legal Basis for Processing

We process your data based on your consent (e.g., when you accept the Terms), contractual necessity (providing the service), and legitimate interests (improving the platform, security).

5. Data Sharing and Disclosure

• We do not sell or rent your personal data.
• We share data only with trusted service providers (e.g., Stripe for payments, hosting providers) under strict confidentiality.
• We may disclose information to comply with legal obligations or protect our rights.

5.1 Google API Data Usage and Disclosure

• Data Access: InsightOS requests permission to access your Google Calendar account solely to create, schedule, and generate Google Meet video conferencing links for meetings initiated within our platform.
• Data Storage & Retention: InsightOS does not read, download, store, or track your existing Google emails, files, or personal calendar entries. We only write data to your account when you explicitly create a meeting inside InsightOS.
• Limited Use Clause: InsightOS's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• Compliance: We are committed to protecting your Google data in accordance with Google's API Services User Data Policy and all applicable privacy regulations. For any questions regarding our use of Google APIs, please contact our Data Protection Officer.

6. Data Security

• We implement appropriate technical and organizational measures to protect your data, including encryption in transit and at rest.
• Access to personal data is limited to authorized personnel only.

7. Data Retention

We retain your data for as long as necessary to provide our services and comply with legal obligations. Upon account deletion or termination, your data will be securely deleted unless retention is required by law.

8. Your Rights

Under GDPR, you have the right to:

• Access your personal data
• Request correction or deletion
• Object to or restrict processing
• Data portability
• Withdraw consent at any time

To exercise these rights, contact us at: support@insightos.co.uk

9. Cookies and Tracking Technologies

We use cookies to enhance your experience. You can manage cookie preferences through your browser settings. For detailed information, see our Cookie Policy.

10. International Transfers

Your data is stored and processed within the UK. If we transfer data outside the UK, appropriate safeguards will be in place.

11. Changes to This Privacy Policy

We may update this policy occasionally. Changes will be posted here with an updated effective date. Continued use of the platform means acceptance of the updated policy.

12. Contact Us

For any questions or concerns regarding your privacy, please contact:
Data Protection Officer: Ashley Cook
Email: support@insightos.co.uk

ICO Registration: Insight OS Limited is registered with the Information Commissioner's Office, registration reference ZC197993 (registered 31 July 2026, renewable 30 July 2027). ICO: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF · 0303 123 1113 · ico.org.uk.

Data Processing Addendum (DPA)

Last updated: 3 October 2026

Version: 1.0

This Data Processing Addendum (“DPA”) forms part of the agreement between InsightOS (“InsightOS”, “we”, “us” or “Processor”) and the customer identified in the applicable order, subscription, service agreement or other agreement governing the customer's use of the InsightOS platform (“Customer”, “you” or “Controller”).

This DPA governs the processing of Personal Data by InsightOS on behalf of the Customer in connection with the InsightOS platform and related services.

This DPA is intended to satisfy the requirements applicable to processor contracts under Article 28 of the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, as amended from time to time. The ICO states that an Article 28 processor contract must address, among other matters, documented instructions, confidentiality, security, sub-processors, data-subject rights, assistance, end-of-contract deletion/return and audits.

If there is a conflict between this DPA and another agreement between the parties concerning the processing of Personal Data, this DPA will prevail to the extent of that conflict.

1. Definitions

• Applicable Data Protection Law means all applicable laws and regulations relating to privacy and the protection of Personal Data applicable to the processing under this DPA, including the UK GDPR, the Data Protection Act 2018 and any legislation implementing, replacing or supplementing them.
• Controller, Processor, Personal Data, Personal Data Breach, Processing, Process, Data Subject, Special Category Data and other relevant terms have the meanings given to them under Applicable Data Protection Law.
• Customer Data means Personal Data submitted to, stored in, transmitted through or otherwise processed by InsightOS on behalf of the Customer through the InsightOS platform.
• Services means the InsightOS software platform and associated services provided by InsightOS to the Customer.
• Sub-processor means any third party engaged by InsightOS to Process Personal Data on behalf of the Customer.

2. Roles of the Parties

• The Customer is the Controller of Customer Data that it submits to the InsightOS platform.
• InsightOS acts as Processor of Customer Data and will Process Customer Data only in accordance with the Customer's documented instructions and this DPA, except where Applicable Data Protection Law requires InsightOS to Process the Personal Data otherwise.
• The Customer is responsible for determining: (a) the purposes for which Customer Data is collected and processed; (b) the lawful basis for processing Customer Data; (c) providing appropriate privacy information to Data Subjects; (d) ensuring that its instructions to InsightOS comply with Applicable Data Protection Law; and (e) ensuring that it has all necessary rights, permissions and lawful authority to provide Customer Data to InsightOS.
• Nothing in this DPA prevents InsightOS from processing information for its own lawful purposes where InsightOS acts as an independent Controller, including account administration, billing, security, fraud prevention, service communications and compliance with legal obligations.

3. Subject Matter and Duration

• The subject matter of the processing is the provision of the InsightOS Services to the Customer.
• The duration of processing will be the duration of the Customer's subscription or other applicable agreement with InsightOS, together with any period reasonably required to complete data export, deletion, backup deletion or other post-termination obligations.
• InsightOS may retain Personal Data for longer where required by Applicable Data Protection Law or where technically necessary for secure backup and disaster-recovery purposes, subject to Section 17.

4. Nature and Purpose of Processing

InsightOS may Process Customer Data for the purposes of providing, maintaining, securing and supporting the InsightOS Services. Depending on the features enabled by the Customer, processing may include:

• creating and managing employee and user records; authentication and account management;
• attendance and time recording; holiday and absence management; shift scheduling and workforce management;
• standby and overtime management; task and project management; training and learning management;
• performance and appraisal management; internal communication; document and information management;
• workforce and operational reporting; management of staffing costs and budgets;
• recruitment-related functionality where enabled; meeting and transcription functionality where enabled;
• AI-assisted functionality where enabled; system monitoring, troubleshooting and technical support; and
• maintaining the security, availability and integrity of the Services.

InsightOS will not sell Customer Data.

5. Categories of Data Subjects

Depending on the Services used by the Customer, Data Subjects may include: employees; workers; contractors; temporary workers; agency workers; job applicants; managers and administrators; authorised users of the InsightOS platform; and other individuals whose Personal Data the Customer chooses to submit to the Services.

6. Categories of Personal Data

Depending on the Services enabled by the Customer, Customer Data may include: names and preferred names; work email addresses; telephone numbers; contact information; job titles and departments; employee or worker identification information; employment information; working hours and schedules; attendance and time-recording information; holiday and absence information; sickness or absence information where entered by the Customer; training and qualification information; performance and appraisal information; task and project information; internal communications; authentication and account information; audit and activity information; workforce and operational information; staffing cost information where entered by the Customer; location or geolocation information where a relevant feature is enabled; information contained in documents uploaded by the Customer; meeting or transcription content where relevant functionality is enabled; information submitted through forms and workflows; and other Personal Data that the Customer chooses to submit to the Services.

7. Special Category Data

• The Customer may choose to submit Special Category Data to InsightOS where a feature of the Services permits this.
• The Customer remains responsible for ensuring that it has an appropriate lawful basis and, where required, an appropriate condition under Article 9 of the UK GDPR for processing Special Category Data.
• InsightOS will Process Special Category Data only to the extent necessary to provide the Services in accordance with the Customer's documented instructions.
• InsightOS does not require the Customer to submit Special Category Data unless a particular feature requires or permits such processing.

8. Documented Instructions

• InsightOS will Process Customer Data only: to provide the Services; in accordance with this DPA; in accordance with the Customer's documented instructions; or where required by Applicable Data Protection Law.
• Customer instructions may be provided through the Services, account configuration, written communications, support requests, the applicable service agreement, or other documented instructions provided by the Customer.
• If InsightOS is required by law to Process Customer Data otherwise than in accordance with the Customer's instructions, InsightOS will, unless prohibited by law, inform the Customer of that legal requirement before carrying out the relevant processing.
• If InsightOS reasonably believes that an instruction infringes Applicable Data Protection Law, InsightOS may notify the Customer and may suspend implementation of the relevant instruction until the issue has been resolved.

9. Confidentiality

• InsightOS will ensure that persons authorised to Process Customer Data are subject to an appropriate duty of confidentiality.
• Access to Customer Data will be limited to personnel who require access for the performance, security, support, maintenance or administration of the Services.
• InsightOS will take reasonable measures to ensure that personnel with access to Customer Data understand their confidentiality and information-security obligations.
• Confidentiality obligations will continue after an individual's employment or engagement with InsightOS ends.

10. Security of Processing

• InsightOS will implement appropriate technical and organisational measures designed to protect Customer Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
• These measures are described in Schedule 2 — Technical and Organisational Security Measures.
• InsightOS will regularly review the effectiveness of its security measures and may update them as reasonably necessary to address changes in technology, threats and the Services.

11. Personal Data Breaches

• InsightOS will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Data.
• Where reasonably available, the notification will include: the nature of the Personal Data Breach; the categories of Personal Data affected; the categories and approximate number of Data Subjects affected; the approximate number of records affected; likely consequences; measures taken or proposed to address the breach; and contact details for the person or team handling the incident.
• Where all information is not available initially, InsightOS may provide information progressively as it becomes available.
• InsightOS will take reasonable steps to contain, investigate and remediate the breach.
• The Customer remains responsible for determining whether it must notify the ICO or affected Data Subjects.
• InsightOS will reasonably assist the Customer with such notification where required.

12. Data Subject Rights

• Taking into account the nature of the processing, InsightOS will provide reasonable assistance to the Customer in responding to requests from Data Subjects exercising their rights under Applicable Data Protection Law, including access, rectification, erasure, restriction of processing, data portability, objection, and other applicable Data Subject rights.
• Where InsightOS receives a Data Subject request relating to Customer Data, InsightOS will, where legally permitted, direct the individual to the Customer.
• InsightOS will not respond substantively to a Data Subject request concerning Customer Data unless authorised or required to do so by the Customer or Applicable Data Protection Law.

13. Assistance with Controller Obligations

• Taking into account the nature of processing and information available to InsightOS, InsightOS will reasonably assist the Customer with its obligations under Applicable Data Protection Law relating to security of processing, Personal Data Breaches, Data Protection Impact Assessments, consultations with the ICO where required, Data Subject rights, and other reasonable compliance obligations directly related to InsightOS's processing of Customer Data.
• The Customer remains responsible for determining whether its processing activities require a DPIA, regulatory notification or other assessment.
• Where InsightOS's assistance requires substantial additional work outside normal operation of the Services, InsightOS may charge reasonable costs where agreed with the Customer in advance.

14. Sub-processors

• The Customer provides InsightOS with general authorisation to engage Sub-processors where reasonably necessary to provide the Services.
• InsightOS will maintain a list of Sub-processors used to Process Customer Data. The current Sub-processor list is set out in Schedule 3.
• InsightOS will impose contractual data protection obligations on each Sub-processor that provide an appropriate level of protection for Customer Data.
• InsightOS will remain responsible to the Customer for the performance of its Sub-processors' data protection obligations to the extent required by Applicable Data Protection Law.
• Where InsightOS intends to appoint a new Sub-processor or replace an existing Sub-processor, InsightOS will provide reasonable notice to the Customer where required by Applicable Data Protection Law.
• The Customer may object to a proposed Sub-processor on reasonable data protection grounds by providing written notice within 30 days of receiving the relevant notice.
• If the parties cannot reasonably resolve the objection, InsightOS may: refrain from using the proposed Sub-processor for the affected Customer; provide an alternative commercially reasonable solution where available; or permit the Customer to terminate the affected Services in accordance with the applicable commercial agreement.

15. International Data Transfers

• InsightOS will not make a restricted transfer of Customer Data except in accordance with Applicable Data Protection Law.
• Where Customer Data is transferred to a separate organisation outside the UK and the transfer constitutes a restricted transfer, InsightOS will ensure that an appropriate transfer mechanism is in place, including where applicable: UK adequacy regulations; the UK International Data Transfer Agreement; the UK Addendum to the EU Standard Contractual Clauses; or another lawful transfer mechanism recognised under Applicable Data Protection Law.
• Where appropriate safeguards are used, InsightOS will maintain appropriate documentation relating to the relevant transfer assessment.
• The ICO currently identifies the IDTA and UK Addendum as approved contractual safeguards for restricted transfers under the UK GDPR.

16. Data Location

• InsightOS's primary production infrastructure is hosted using IONOS infrastructure located within the European Union.
• Customer Data is therefore primarily hosted within EU infrastructure.
• InsightOS may use third-party services located outside the UK or EU where reasonably necessary to provide specific functionality, including AI functionality and security services.
• Where such processing constitutes a restricted transfer under Applicable Data Protection Law, InsightOS will use an appropriate transfer mechanism.

17. Data Retention, Return and Deletion

• InsightOS will retain Customer Data for the duration of the Customer's subscription or applicable agreement, subject to this DPA.
• Following termination or expiry, the Customer may request export of its Customer Data during a 30-day export period.
• Following the applicable export period, InsightOS will delete or anonymise Customer Data from active production systems unless: retention is required by law; retention is required for the establishment, exercise or defence of legal claims; or the information remains temporarily within secure backups maintained for disaster-recovery purposes.
• Backup copies will remain protected by appropriate security controls and will be deleted or overwritten according to InsightOS's backup lifecycle. Backup frequency: at least every 24 hours. Backup provider: IONOS Cloud.
• At the Customer's choice, InsightOS will return or delete Customer Data at the end of the Services, subject to the above provisions.

18. Audit and Compliance Information

• InsightOS will make available to the Customer information reasonably necessary to demonstrate compliance with its processor obligations under Article 28 of the UK GDPR, including this DPA, security documentation, technical and organisational measures, Sub-processor information, relevant policies, applicable audit reports or certifications where available, and other information reasonably necessary to demonstrate compliance.
• Where reasonably necessary and where the information supplied is insufficient, the Customer may request an audit of InsightOS's processing activities relevant to Customer Data.
• Any audit must be requested with reasonable advance written notice, take place during normal business hours, not unreasonably disrupt InsightOS's operations, comply with reasonable InsightOS security and confidentiality requirements, not provide access to another customer's data, and not expose commercially sensitive information unrelated to the Customer.
• InsightOS may satisfy reasonable audit requirements by providing relevant independent audit reports, certifications, security questionnaires or equivalent documentation where available.

19. Customer Responsibilities

The Customer is responsible for: determining the purposes and lawful basis for processing Customer Data; ensuring its processing instructions are lawful; providing appropriate privacy information to Data Subjects; responding to Data Subject requests; maintaining appropriate internal access controls; ensuring its administrators are authorised to access Customer Data; ensuring Personal Data submitted to InsightOS is accurate where required; configuring the Services appropriately; ensuring users maintain appropriate credentials and authentication controls; and complying with Applicable Data Protection Law in relation to its use of the Services.

20. AI Processing

• InsightOS may provide AI-assisted functionality using third-party AI providers, including OpenAI.
• Where the Customer enables an InsightOS AI feature that requires Customer Data to be sent to an AI provider, InsightOS will Process and transmit the relevant information only for the purpose of providing that feature.
• OpenAI is listed as a Sub-processor in Schedule 3. OpenAI's current Data Processing Addendum provides that UK Data processed under its DPA is subject to the EU Standard Contractual Clauses as amended by the UK Addendum.
• InsightOS will not use Customer Data to train a publicly available general-purpose AI model unless the Customer has expressly agreed to such processing or such processing is otherwise permitted by the applicable agreement and Applicable Data Protection Law.
• Where an AI feature produces recommendations, summaries, classifications or other outputs, the Customer remains responsible for reviewing outputs where appropriate and determining how such outputs are used.
• Where AI functionality involves employee information or other Personal Data, the Customer remains responsible for ensuring that its use of the functionality complies with Applicable Data Protection Law and applicable employment law.

21. Google reCAPTCHA Enterprise

• InsightOS uses Google reCAPTCHA Enterprise as a security and abuse-prevention measure.
• Depending on the implementation, reCAPTCHA may process information associated with a user's device, browser, IP address and interaction with the InsightOS service.
• Google is therefore identified as a Sub-processor where the reCAPTCHA functionality processes Personal Data on behalf of the Customer.
• InsightOS uses reCAPTCHA for security, bot detection and abuse prevention and does not use reCAPTCHA as a general-purpose customer analytics service.
• Applicable Google contractual and data protection terms will govern Google's processing of information in connection with reCAPTCHA Enterprise.

22. Bunny.net Media Services

• InsightOS uses Bunny.net for applicable media storage and delivery functionality.
• Depending on the feature and implementation, Bunny.net may process information associated with media requests, media delivery and related technical information.
• Bunny.net is therefore identified as a Sub-processor where it processes Personal Data on behalf of InsightOS's customers.
• InsightOS will maintain appropriate contractual arrangements with Bunny.net concerning applicable data protection obligations. Bunny.net states that where its platform is used to process Personal Data, a Data Processing Agreement is available through its service, and it maintains a Sub-processor list.

23. Security of Customer Accounts

• The Customer is responsible for maintaining the confidentiality of its account credentials.
• Customers should use available security features, including multi-factor authentication where available.
• The Customer must promptly notify InsightOS if it becomes aware of unauthorised access to its account or Customer Data.

24. Data Protection Impact Assessments

• The Customer is responsible for determining whether its processing activities require a DPIA.
• InsightOS will provide reasonable information and assistance where necessary to allow the Customer to assess processing carried out through the Services, including the nature of the Services, categories of Personal Data, security measures, Sub-processors, international transfers, and other relevant information reasonably available to InsightOS.

25. Regulatory Cooperation

• Where legally required, InsightOS will reasonably cooperate with the Customer in responding to enquiries from the ICO or another competent data protection authority concerning Customer Data.
• InsightOS will notify the Customer where it receives a legally binding request from a competent authority for disclosure of Customer Data, unless prohibited by law.
• Where legally permitted, InsightOS will provide the Customer with sufficient information to allow the Customer to respond to the request or seek an appropriate remedy.

26. Changes to This DPA

• InsightOS may update this DPA where reasonably necessary to reflect changes in Applicable Data Protection Law, regulatory guidance, changes to the Services, changes to security practices, or changes to Sub-processors or processing activities.
• Where a change materially reduces the protection provided to Customer Data, InsightOS will provide reasonable notice to affected Customers.

27. Liability

• The parties' liability arising from or relating to this DPA will be subject to the liability provisions contained in the applicable agreement between the parties.
• Nothing in this DPA limits or excludes liability to the extent such limitation or exclusion is prohibited by Applicable Data Protection Law.

28. Term and Termination

• This DPA remains in effect for as long as InsightOS Processes Customer Data on behalf of the Customer.
• Obligations concerning confidentiality, security, deletion, return of Personal Data and legally required retention will continue for as long as relevant following termination.

29. Governing Law

• This DPA and any dispute arising from it will be governed by the laws of England and Wales, unless otherwise required by the applicable agreement between the parties.
• The courts of England and Wales will have exclusive jurisdiction, subject to any mandatory rights or jurisdiction requirements under Applicable Data Protection Law.

Schedule 1 — Details of Processing

Subject matter: Provision of the InsightOS workforce and business management platform.

Duration: For the duration of the Customer's subscription or applicable agreement, plus any applicable post-termination period required for data export, deletion, backup expiry or legal retention.

Nature of processing: Collection, recording, organisation, storage, retrieval, consultation, use, transmission, analysis, modification, deletion and other processing necessary to provide the InsightOS Services.

Purposes: Workforce management; employee management; attendance management; scheduling; holiday and absence management; training; tasks and projects; communication; recruitment; performance management; reporting; workforce analytics; business operations; AI-assisted functionality; security; technical support; system administration; and service delivery.

Categories of Data Subjects: Employees; workers; contractors; temporary workers; agency workers; applicants; managers; administrators; authorised users; and other individuals whose information the Customer enters into InsightOS.

Categories of Personal Data: Identification information; contact information; employment information; attendance information; scheduling information; holiday and absence information; training information; performance information; task and project information; communication information; authentication information; system and audit information; location information where enabled; workforce cost information where entered; documents and uploaded content; meeting/transcription information where enabled; recruitment information where enabled; and other Personal Data submitted by the Customer.

Special categories: Potentially, depending on Customer configuration — health information relating to sickness or absence, and other Special Category Data submitted by the Customer. The Customer remains responsible for determining whether such processing is lawful and appropriate.

Schedule 2 — Technical and Organisational Security Measures

• Hosting infrastructure: InsightOS's primary production infrastructure is hosted through IONOS infrastructure located within the European Union.
• Encryption at rest: Customer Data stored within InsightOS production databases and applicable storage systems is protected using AES-256 encryption at rest.
• Encryption in transit: InsightOS uses HTTPS/TLS to protect communications between users and the InsightOS platform.
• Role-based access control: InsightOS uses role-based permissions to restrict access to functionality and Customer Data according to authorised roles and permissions.
• Database access controls: Production databases are protected using access controls designed to prevent unauthorised access, restricted to authorised systems and personnel.
• IP blocking and rate limiting: InsightOS uses IP blocking and rate-limiting controls to mitigate abusive, automated or suspicious traffic.
• CAPTCHA: InsightOS uses Google reCAPTCHA Enterprise to help detect automated or malicious activity.
• Authentication and authorisation: InsightOS maintains authentication and authorisation controls designed to restrict access to authorised users.
• Backups: InsightOS performs production backups at least every 24 hours, stored using IONOS Cloud infrastructure.
• Monitoring and logging: InsightOS maintains appropriate application and infrastructure monitoring and logging designed to identify operational and security events.
• Incident response: InsightOS maintains procedures for identifying, investigating, containing and responding to security incidents.
• Secure development: InsightOS uses reasonable secure software-development practices, including appropriate authentication, authorisation, input validation, access control, dependency management, security updates and vulnerability remediation.
• Personnel security: Personnel authorised to access Customer Data are subject to confidentiality obligations and access restrictions.
• Physical infrastructure security: Physical security of the underlying hosting infrastructure is managed by the applicable infrastructure provider, including IONOS.

Schedule 3 — Sub-processor Register

InsightOS will maintain appropriate contractual arrangements with each Sub-processor. The ICO requires processors to impose equivalent data-protection obligations on their own processors and makes the processor responsible for ensuring appropriate protection by its Sub-processors.

Schedule 4 — International Transfers

• IONOS: InsightOS's primary production infrastructure is hosted within the European Union through IONOS.
• OpenAI: Where InsightOS sends Customer Data to OpenAI for an enabled AI feature, the relevant processing may involve processing in the United States. OpenAI's current DPA states that UK Data processed under its DPA is subject to the EU Standard Contractual Clauses as amended by the UK Addendum. InsightOS relies on the applicable contractual transfer safeguards provided through its relationship with OpenAI and will maintain appropriate documentation concerning the transfer.
• Google: Where Google processes Personal Data through reCAPTCHA Enterprise, InsightOS will use Google's applicable data-processing terms and an appropriate lawful international-transfer mechanism where required.
• Bunny.net: Where Bunny.net processes Personal Data outside the UK, InsightOS will use an appropriate transfer mechanism where required. Bunny.net maintains its own GDPR documentation and Sub-processor information.
• Transfer assessments: Where InsightOS relies on contractual safeguards for a restricted transfer, InsightOS will consider the relevant transfer-risk requirements and maintain appropriate documentation.

Schedule 5 — Data Protection Contact

Ashley Cook — Data Protection Officer & Security Officer, InsightOS

Email: support@insightos.co.uk

Privacy Policy: insightos.co.uk/tos-privacy

Terms of Service: insightos.co.uk/tos-privacy

Schedule 6 — Customer Instructions

The Customer instructs InsightOS to Process Customer Data for the purposes of: providing the InsightOS Services; storing and retrieving Customer Data; providing workforce management functionality; providing reporting and analytics functionality; providing enabled communication and workflow functionality; providing enabled AI functionality; providing technical support; maintaining security and service reliability; preventing abuse, fraud and unauthorised access; and complying with applicable legal obligations.

The Customer may provide additional documented instructions where permitted by the applicable agreement.

Schedule 7 — Security Summary

InsightOS maintains the following principal security controls: EU-based primary production infrastructure through IONOS; AES-256 encryption at rest; HTTPS/TLS encryption in transit; role-based permissions; database access controls; IP blocking; rate limiting; Google reCAPTCHA Enterprise; authentication and authorisation controls; backups at least every 24 hours; IONOS Cloud backup infrastructure; controlled access to production systems; application and infrastructure monitoring; incident response procedures; and confidentiality obligations for authorised personnel.

InsightOS reviews its technical and organisational measures periodically and may update them as technology, threats, regulatory requirements and the Services evolve.

Acceptance

By entering into the applicable agreement for the InsightOS Services, the Customer agrees that this DPA forms part of that agreement and governs the processing of Customer Data by InsightOS on the Customer's behalf.