Data Processing Agreement
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between TM Takeoff LLC (“Processor”, “TM Takeoff”) and the Customer (“Controller”). It applies when TM Takeoff processes personal data on the Customer’s behalf while providing the Service, including under the EU and UK General Data Protection Regulation (“GDPR”) and applicable U.S. state privacy laws.
This DPA is incorporated into the Terms automatically. If your organization needs a countersigned copy, email support@tmtakeoff.com with your company’s legal name and we will send one for signature.
Roles and scope
The Customer is the controller (or a processor acting for its own controller) of personal data in Customer Content and user accounts. TM Takeoff is the processor and processes that data only to provide the Service.
| Subject matter | Provision of the TM Takeoff takeoff and estimating platform. |
|---|---|
| Duration | The term of the subscription, plus the deletion period described below. |
| Nature and purpose | Hosting, storage, AI-assisted analysis of documents, generation of outputs, support and security. |
| Data subjects | Customer’s authorized users; individuals named in uploaded documents (for example, architects, engineers, project contacts). |
| Categories of data | Names, business contact details, job titles, signatures and stamps appearing on drawings, account and usage data. No special-category data is required to use the Service, and Customer should not upload it. |
TM Takeoff’s obligations
- Instructions: process personal data only on the Customer’s documented instructions, which are these Terms, this DPA and the Customer’s use of the Service, unless required otherwise by law (in which case we will inform the Customer where legally permitted).
- Confidentiality: ensure everyone authorized to process personal data is bound by confidentiality.
- Security: implement appropriate technical and organizational measures, described on our Security page, including encryption in transit (TLS 1.3) and at rest (AES-256), separate storage for each customer and access controls.
- Assistance: help the Customer respond to data subject requests and meet its obligations for security, breach notification, impact assessments and consultations with authorities, taking into account the nature of processing.
- No training: not use Customer Content to train AI models.
Subprocessors
The Customer authorizes TM Takeoff to use subprocessors for cloud hosting and storage, AI model processing, email delivery, payment processing and customer support. TM Takeoff will:
- bind each subprocessor to data-protection terms at least as protective as this DPA;
- remain responsible for its subprocessors’ performance;
- provide the current subprocessor list on request at support@tmtakeoff.com;
- give at least 30 days’ notice before adding or replacing a subprocessor, during which the Customer may object on reasonable data-protection grounds. If we cannot reasonably accommodate the objection, the Customer may terminate the affected Service and receive a refund of prepaid fees for the remaining term.
Personal data breaches
TM Takeoff will notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer data. The notice will include the information reasonably available about its nature, likely consequences and the measures taken or proposed.
International transfers
TM Takeoff processes data in the United States. For transfers of personal data from the EEA, UK or Switzerland, the parties agree to the EU Standard Contractual Clauses (Module 2, controller to processor, or Module 3, processor to processor, as applicable), with the UK International Data Transfer Addendum and Swiss amendments where required. These are incorporated by reference into this DPA.
Return and deletion
At the end of the subscription, the Customer may export its data for 30 days. TM Takeoff will then delete Customer personal data from active systems within 90 days, unless storage is required by law. Backups are overwritten on their normal rotation schedule.
Audits
On written request, and no more than once a year, TM Takeoff will provide information reasonably necessary to demonstrate compliance with this DPA, including completed security questionnaires and available third-party attestations for our hosting infrastructure. Where this is not sufficient, or where required by a supervisory authority, the Customer may conduct an audit on 30 days’ notice, during business hours, at its own cost and subject to confidentiality.
Liability and order of precedence
Each party’s liability under this DPA is subject to the limitations in the Terms. If this DPA conflicts with the Terms, this DPA controls regarding personal data. If the Standard Contractual Clauses conflict with this DPA, the Clauses control.
Contact
Privacy and data-protection requests: support@tmtakeoff.com.