AssetWRX Data Processing Agreement

Last updated: 28 September 2026 Effective: 28 September 2026 Version: 1.1.0

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between you or your organisation (“Customer”, the “Controller”) and Cogniforma H Ltd, operator of AssetWRX (“Cogniforma”, the “Processor”). It governs Cogniforma’s processing of personal data contained in Customer Content on the Customer’s behalf. It is drafted to satisfy Article 28 of the EU GDPR and the UK GDPR. In the event of conflict with the Terms of Service, this DPA controls for the processing it covers.

1. Roles

For personal data in Customer Content, the Customer is the controller (or a processor acting on behalf of a third-party controller) and Cogniforma is the processor. Cogniforma processes Customer Content only on the Customer’s documented instructions, which comprise the Terms of Service, this DPA, and the Customer’s use of the Service’s features. For account, billing and diagnostic data, Cogniforma is an independent controller as described in the Privacy Policy. Section 12 describes the one case in which Cogniforma uses Customer Content for its own purpose, which the Customer can turn off.

2. Subject-matter, duration, nature and purpose

• Subject-matter and duration: processing for the term of the Customer’s agreement and until deletion in accordance with the Data Deletion Policy.
• Nature and purpose: hosting, storage, transmission, indexing, backup, sharing, report and summary generation, and optional AI processing (including WRX Vision photo analysis), in each case to provide the Service.
• Types of personal data: identifiers and contact details, asset and inspection records, photographs and media, location data, and any other personal data the Customer chooses to submit.
• Categories of data subject: the Customer’s personnel, contractors, contacts, requesters, and the subjects of inspections.

3. Processor obligations

Cogniforma will:

1. process Customer Content only on the Customer’s documented instructions, including as to international transfers, unless required otherwise by law (in which case it will inform the Customer unless legally prohibited);
2. ensure persons authorised to process Customer Content are bound by confidentiality;
3. implement appropriate technical and organisational measures under Article 32 (see section 7 and Privacy Policy section 12);
4. respect the conditions in section 4 for engaging sub-processors;
5. taking into account the nature of the processing, assist the Customer by appropriate technical and organisational measures, insofar as possible, to respond to data-subject requests;
6. assist the Customer in ensuring compliance with Articles 32–36 (security, breach notification, and data protection impact assessments), taking into account the information available to it;
7. at the Customer’s choice, delete or return Customer Content at the end of the provision of the Service, as described in the Data Deletion Policy; and
8. make available information necessary to demonstrate compliance with Article 28 and allow for and contribute to audits, as described in section 8.

4. Sub-processors

The Customer provides general authorisation for Cogniforma to engage the sub-processors listed at assetwrx.com/legal/subprocessors. Cogniforma imposes data-protection obligations on each sub-processor no less protective than those in this DPA and remains liable for their performance. Cogniforma will give notice of any intended addition or replacement of a sub-processor via the sub-processors page, and the Customer may object on reasonable data-protection grounds within 30 days.

5. Data-subject requests

Where Cogniforma receives a request from a data subject relating to Customer Content, it will not respond directly (except to confirm the request should be directed to the Customer) and will promptly forward it to the Customer and provide reasonable assistance in responding.

6. Personal data breach

Cogniforma will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Content, and will provide information reasonably required for the Customer to meet its own notification obligations under Articles 33 and 34.

7. Security

Cogniforma maintains the technical and organisational measures described in section 12 of the Privacy Policy, including encryption in transit and at rest, access controls and row-level security, audit logging, and least-privilege access.

8. Audit

Cogniforma will make available to the Customer information reasonably necessary to demonstrate compliance with this DPA. Where the Customer reasonably requires further audit, the parties will agree scope and timing in advance; audits are limited to once per twelve months absent a regulator requirement or a suspected breach, conducted on reasonable notice and without disrupting the Service.

9. International transfers

Cogniforma processes Customer Content in the regions described in the sub-processors list. Where processing occurs outside the UK or EEA, the transfer mechanisms in section 7 of the Privacy Policy apply, and the Standard Contractual Clauses (2021/914) together with the UK International Data Transfer Addendum are incorporated by reference where required.

10. Return and deletion

On termination, Cogniforma will delete or, at the Customer’s election, return Customer Content in accordance with the Data Deletion Policy, subject to the retention of records required by law.

11. Liability

The liability of each party under or in connection with this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service.

12. Vision improvement data

Vision improvement data is on by default for workspaces that use WRX Vision. The owner of the Customer’s workspace can turn it off at any time. While it is on:

1. the Customer authorises Cogniforma to use, as an independent controller, the evidence photos kept for reviewed WRX Vision suggestions and their review records to train and evaluate the WRX Vision model used to provide the Service to all customers;
2. the Customer is responsible for being entitled to share that content for this purpose, including giving any notice its data subjects require, and turns the setting off if it is not;
3. Cogniforma removes embedded photo metadata before use, copies the photos only to Google Cloud in the EU, and deletes those copies within 30 days;
4. turning the setting off, or deleting a photo or inspection, excludes that content from all future training. Decisions recorded while it is off are never used. A model already trained cannot be un-trained.

Cogniforma does not use Customer Content to train AI models in any other way.

Section 5.2 of the Privacy Policy describes this processing in full.

Contact

privacy@assetwrx.com | Cogniforma H Ltd, 17 Quaves Road, Slough, SL3 7NX, UK