1. Roles
Our clients decide what data is stored in the Deskely platform and why. For that data, the client is the controller (under the GDPR) or the organisation (under the PDPA), and Compass Energy Pte. Ltd. acts as its processor, or data intermediary, processing the data only on the client’s documented instructions.
2. What we process
| Category | Examples |
|---|---|
| Project data | Tag registers, drawings, documents, test records, punch items, procedures and reports |
| User data | Names, work email addresses, roles and sign-in records of the client’s users |
| Field records | Readings, photographs, signatures and comments recorded in the web and field applications |
The platform is not designed to hold special categories of personal data, and clients agree not to store them in it.
3. Our commitments
As processor, we commit to:
- process client data only to provide the services and on the client’s documented instructions;
- make sure everyone with access to client data is bound by confidentiality;
- apply the security measures described below;
- assist the client in responding to requests from individuals exercising their rights;
- notify the client without undue delay after becoming aware of a personal data breach affecting its data, and support its response;
- make available the information needed to show compliance, and allow for audits as agreed in the contract;
- return or delete client data at the end of the contract, as described below.
4. Security measures
- Each deployment runs in one cloud region chosen by the client: AWS in Singapore or the United States, or Microsoft Azure on request.
- Project data is encrypted at rest.
- Daily backups with point-in-time recovery, kept for 30 days. Recovery point objective of one hour and recovery time objective of four hours.
- Role-based access in the platform, managed by the client’s administrators.
- Releases tested on a separate environment before deployment.
- Drawings sent for AI processing travel inside the processing request, under a zero data retention agreement, and are not used to train models. AI results are proposals that an engineer approves before they enter the register.
5. Subprocessors
We use the following subprocessors to provide the platform. Each is bound by written terms that give client data protection at least equivalent to our own commitments.
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting and storage | Singapore or United States |
| Microsoft Azure | Hosting, on request only | Region chosen by the client |
| Datadog | Monitoring and logs | United States |
| Twilio SendGrid | Email notifications | United States |
| OpenAI | AI processing, under zero data retention | United States |
We will notify clients before adding or replacing a subprocessor, so that they can object on reasonable grounds.
6. International transfers
Client data stays in the hosting region the client chooses. Where a subprocessor processes data in another country, for example for monitoring, email delivery or AI processing, the transfer is covered by safeguards that meet the PDPA’s transfer requirements and, where the GDPR applies, the European Commission’s standard contractual clauses.
7. Return and deletion
At the end of a contract, client data is exported to the client as CSV and PDF within 30 days and then deleted from the platform, unless the client asks otherwise or the law requires us to keep it. Backups expire within their 30-day retention period.
8. Requesting the agreement
The full Data Processing Agreement, including the standard contractual clauses where needed, is available to clients and prospective clients at privacy@deskely.com.