GDPR & the platform

1. Roles: you are the data controller

Under the GDPR, the party that determines the purpose and means of processing is the data controller. For the data you enter into PrediqtSafe — employee profiles, project data, incident reports, observations — you set that purpose: safeguarding safety on your construction projects.

PrediqtSafe processes this data solely on your instruction. We are the processor, acting under the signed DPA. We do not use your data for our own purposes, not for product development outside your explicit instruction, and not for analyses benefiting other customers without anonymisation.

2. Lawful basis for processing

For most data within the platform, the basis is Article 6(1)(b) GDPR (performance of a contract — your employment contract with the worker) or 6(1)(f) (legitimate interest — safeguarding working conditions in line with the Arbowet).

For special-category data (e.g. health data in medical incidents, Article 9 GDPR) a stricter regime applies — we do not process such data without an explicit legal exception or worker consent. By default, no medical records are loaded into PrediqtSafe.

3. Sub-processors

PrediqtSafe uses a limited set of sub-processors needed to operate the platform. The full up-to-date list is in your DPA and is updated at least 30 days in advance of any change — so you have time to object.

Sub-processor categories: cloud hosting (EU regions), email delivery (EU-hosted), photo storage (EU bucket), AI inference (EU region or self-hosted). No sub-processor stores data outside the EU.

4. Data-subject rights

Your employees have the same rights as any data subject under GDPR: access, rectification, erasure, restriction, portability, objection and withdrawal of consent. You handle these requests yourself — via the platform's admin tools — because you are the data controller.

• Access (Art. 15): per-user export via admin-export, machine-readable.
• Rectification (Art. 16): directly editable in the admin panel; corrections appear in the audit trail.
• Erasure (Art. 17): soft-delete with 30-day grace, then hard-delete; audit shadow remains hash-only.
• Portability (Art. 20): export in JSON or CSV, including metadata.
• Objection (Art. 21): can be disabled per user for analytics; report data is retained under Arbowet retention obligations.

5. No transfers outside the EU

All personal data within the PrediqtSafe platform stays inside the EU. We do not rely on Standard Contractual Clauses (SCC) or the EU-US Data Privacy Framework, because we do not send data across the Atlantic.

Concretely: cloud hosting in EU regions, mail delivery via EU-hosted providers (e.g. Mailjet Paris), photos and attachments on EU buckets, and AI inference in EU regions or self-hosted.

6. Security measures

Security is built into the design (privacy by design, Art. 25 GDPR). Encryption in transit (TLS 1.3) and at rest (AES-256), strict role-based access control, mandatory 2FA for admins, audit logging on every privileged action.

Our security approach and breach procedure are documented in the DPA and in an internal SECURITY.md, which we share on request under NDA.

7. Data-breach procedure

In the event of a (suspected) breach affecting your data, we inform you without undue delay — within 24 hours of detection at the latest — so you can meet your notification obligation to the Dutch DPA (within 72 hours, Art. 33 GDPR) and, where relevant, to affected workers (Art. 34 GDPR).

Together with that notification we provide all relevant facts: nature of the breach, affected data categories, likely number of data subjects, technical and organisational measures taken.

For a draft of our DPA, or specific questions about processing within your organisation: [email protected].

8. Not legal advice

The information on this page is an overview of the platform design and standard DPA terms, not legal advice. For advice on your own situation, consult a privacy lawyer or your data-protection officer.