DPA SERVICE SCHEDULE

Processor / Provider: Braincreators B.V., offering the Inspech Subscription Service under the Inspech brand
Affiliate IP owner: Inspech B.V. — IP owner; no personnel of its own and no access to Client Data (see Section 1.2)
Version: 2026.1 — 25 August 2026
Applies with: Braincreators Data Processing Agreement and the applicable Order

Privacy contact: privacy@inspech.com

1. Scope and role allocation

1.1 This Schedule describes the Service Processing for the Inspech Subscription Service. Braincreators B.V. is the contracting Provider and processor (or subprocessor where Client is a processor). Inspech B.V. is the product IP owner, not the customer contracting party.

1.2 Inspech B.V. has no personnel of its own; all work on the Service is performed by personnel and contractors of Braincreators B.V. Where Inspech B.V. or another Provider Affiliate is the contracting party with a vendor that processes Personal Data for the Service Processing, that vendor is a Subprocessor of Provider under the DPA and is listed in Section 7, and Provider remains responsible for it.

1.3 Client determines whether and how to capture road imagery, the lawful basis, capture notices, camera configuration, upload, authorised users, inspection workflow and use of outputs. Provider processes Client Data only for the purposes and instructions in the Agreement, DPA, Order and authorised Service use.

2. Processing description

Element	Service-specific description
Subject matter	Hosted AI-assisted processing and workflow support for visual road inspection, road-condition analysis and associated reporting.
Purposes	Account and access management; ingest and hosting; AI-assisted detection/classification; inspection review and validation; reporting/export; support; security; availability; backup; billing/usage administration; and removal of any Personal Data before Client Data is used for product improvement under the Terms.
Nature / operations	Collect/receive, transmit, record, organise, structure, store, retrieve, consult, analyse, infer, display, annotate, correct, combine as instructed, export, restrict, back up, anonymise where appropriate and delete.
Frequency	Episodic or continuous according to Client uploads, capture campaigns, authorised use, support and system operations.
Duration	Subscription Term plus the 30-day customer export period and the deletion/backup periods in Section 5.
AI training boundary	Client Data may be used prospectively for Inspech-specific model training, testing, validation and improvement only as permitted by the Terms. Road imagery and coordinates do not, in principle, contain Personal Data. Any Personal Data that is nevertheless present is removed or irreversibly obscured before Client Data is used for training. Client Data is excluded from training only where an Order expressly states so.

3. Data subjects and Personal Data

Category	Examples / limits
Client users and administrators	Name, business email, employer, role, user identifier, account status, authentication and access information. Passwords are stored only in protected credential form; authentication-secret handling must follow the production design.
Client personnel, contractors and contacts	Business contact details and information included in inspection records, comments, assignments, support requests or project metadata.
Road users and bystanders	Not expected: road imagery and coordinates processed through the Service do not, in principle, contain identifiable persons or number plates. If they nevertheless do, the DPA applies and such data is excluded from training (DPA 13.1).
Persons in support or uploaded materials	Names, contact details, message content, attachments, logs and other information Client chooses to provide.
Technical users and devices	IP address, device/browser information, session and event logs, timestamps, identifiers, approximate location derived from IP, security and diagnostic information.
Road-inspection content	Road imagery/video, geolocation and timestamps, routes, inspection annotations, classifications, corrections and validated results to the extent they relate to an identifiable person.
Sensitive Information	Not intended or permitted unless an Order expressly authorises it and documents purpose, categories, safeguards and retention. Incidental capture does not authorise deliberate collection of special-category or criminal data.

4. Processing locations and data flows

Stage / system	Entity / vendor	Location	Transfer mechanism	Verification status
Primary application and data hosting	Amazon Web Services (AWS)	EEA: Frankfurt, Germany (AWS region eu-central-1)	Not required (EEA only)	Confirmed
Backups / disaster recovery	AWS	EEA: Frankfurt, Germany (eu-central-1)	Not required (EEA only)	Confirmed
Authentication / identity	Keycloak (open source), self-hosted by Provider	EEA: Frankfurt, Germany (eu-central-1)	Not required (EEA only)	Confirmed
Monitoring / logging / error tracking	Prometheus, Loki and Grafana (open source), self-hosted by Provider; alerts are distributed internally via Slack	Self-hosted tools: EEA: Frankfurt, Germany (eu-central-1); Slack: [not verified]	Self-hosted tools: not required (EEA only); Slack: not verified
Support / ticketing / email	Freshdesk (first-line support and knowledge base); Atlassian Jira (second-line support); Gmail (email)	Freshdesk: EEA; Jira and Gmail: [not verified]	Freshdesk: not required (EEA); Jira and Gmail: not verified
Vendors contracted by Inspech B.V. or another Provider Affiliate	Inspech B.V.	The Netherlands / EEA unless approved otherwise	No restricted transfer for EEA access	Confirm which vendor contracts are held by an Affiliate

Operational requirement: data may not be routed to a location or vendor not recorded in the approved production inventory and subprocessor process.

5. Retention, export and deletion

Data class	Active retention / event	Deletion target	Exception / control
Client Data in active Service	Subscription Term and supported use; videos uploaded through the application are deleted 14 days after upload	Available for export for 30 days after expiry/termination; target deletion from active systems within 90 days after that export period	Deletion covers the database, the customer storage buckets (including earlier object versions) and extracted images.
Backups containing Client Data	Automatic database snapshots, kept for 7 days on a rolling basis	Snapshots are overwritten within 7 days after active deletion. Manual backups and earlier object versions are deleted together with the active data.	No ordinary use; deletion reapplied after restore.
Account, security and audit logs	Risk-based period necessary for security, fraud prevention and compliance	Production logs: one year. Identity system: administrator events 30 days, user events one year. Logs are not backed up.	Minimise identifiers and access.
Support records	During case plus documented support-retention period	Deleted or anonymised two (2) years after the case is closed	Longer only for unresolved claim, legal hold or law.
Billing and contract records	Statutory and legitimate business retention	Seven (7) years (statutory tax retention period)	Provider may act as controller; not erased under processor instruction where law requires retention.
Anonymised / Derived Data	As permitted by Agreement	Not subject to Personal Data deletion only if anonymisation is effective and non-reconstructable	No re-identification; Client Data ownership and confidentiality preserved.

6. Technical and organisational measures

Control area	Measure
Security governance	Braincreators maintains an information-security management system with documented policies, risk assessment, control ownership, internal review and management oversight. ISO/IEC 27001:2022 certification is represented only within the certificate’s verified entity, services, sites and validity period.
Access control	Unique identities, least privilege, role-based access, approval, periodic access review, prompt revocation and privileged-access restrictions. Multi-factor authentication is required for privileged and remote administrative access and applied to user access where supported by the production identity design.
Encryption and secrets	Encryption in transit using current secure protocols; encryption at rest for production data and backups where supported by the verified architecture; managed keys/secrets, restricted access and rotation appropriate to risk. Exact technologies and exceptions are recorded in confidential security documentation.
Network and infrastructure security	Environment separation, security groups/firewalls, hardened configurations, restricted administrative interfaces, protected production access and infrastructure change control.
Logging and monitoring	Security, administrative, authentication and service events logged as appropriate; access restricted; alerts and incident escalation configured; retention aligned to risk and Section 5.
Secure development	Source control, peer review, testing, dependency and vulnerability management, change approval, protected build/release process, environment separation and remediation according to risk.
Vulnerability and patch management	Risk-based scanning, triage, patching, penetration testing or equivalent assessment, and tracking of remediation. Critical issues receive accelerated handling according to the incident/vulnerability standard.
Availability and resilience	Capacity monitoring, backups, restoration procedures, recovery responsibilities, business-continuity and disaster-recovery plans, and periodic tests proportionate to the Service commitments.
Incident response	Documented detection, triage, containment, evidence preservation, eradication, recovery, communication and lessons-learned process, including privacy escalation and customer-notification support.
Data minimisation and lifecycle	Purpose-limited collection, supported export, retention controls, deletion/anonymisation workflows, protected backups and legal-hold controls. Model-training datasets require provenance, permissions and opt-out controls.
Supplier management	Security and privacy due diligence, written agreements, access limitation, subprocessor approval, ongoing review, termination/exit controls and international-transfer assessment.
Personnel security	Confidentiality obligations, role-appropriate screening where lawful, security/privacy training, acceptable-use rules, disciplinary process and joiner/mover/leaver controls.
Physical security	Physical controls are provided by approved hosting/facility providers and office controls as applicable. Production hosting is provided by AWS in the EEA (see Section 4).
Testing and evidence	Periodic control testing, risk review, audit evidence and corrective-action tracking. Summary evidence may be made available subject to confidentiality and protection of other customers and security.

7. Authorised Subprocessors

Subprocessor	Purpose / data	Location	Transfer mechanism	Status
Inspech B.V.	Group company; holds the contract with the vendors marked “via Inspech B.V.” below. No personnel of its own and no direct access to Client Data	The Netherlands / EEA	Not a restricted transfer for EEA-only access	Include only where it holds vendor contracts
Amazon Web Services EMEA SARL (AWS)	Application, database, storage, compute and network	EEA: Frankfurt, Germany (eu-central-1)	Not applicable (EEA)	Active
Amazon Web Services EMEA SARL (AWS)	Encrypted backup and recovery	EEA: Frankfurt, Germany (eu-central-1)	Not applicable (EEA)	Active
No separate subprocessor	Authentication and account identity (Keycloak, self-hosted within the AWS environment above)	EEA: Frankfurt, Germany (eu-central-1)	Not applicable (EEA)	Not applicable
Slack	Internal distribution of monitoring alerts (Prometheus, Loki and Grafana are self-hosted within the AWS environment above)	EEA: Frankfurt, Germany (eu-central-1)	Not applicable (EEA)	Active
Freshworks (Freshdesk): first-line support and knowledge base; Atlassian (Jira): second-line support; Google (Gmail): email	Support messages, contacts and attachments	Freshdesk: EEA; Jira and Gmail	Not applicable (EEA)	Active

8. Client responsibilities and recommended capture controls

Select a lawful basis and provide required public or employee notices for capture and upload.
Configure cameras and routes to minimise unnecessary capture of people, number plates, private property and unrelated content.
Use masking, cropping or other minimisation controls where available and appropriate; do not rely on the Service as the sole compliance control.
Restrict users, apply strong authentication, manage exports and promptly revoke leavers.
Do not upload Sensitive Information or use the Service for identification, surveillance, law enforcement or other incompatible purposes without a specific written agreement and assessment.
Review AI Outputs with qualified personnel and avoid publishing Personal Data in final reports unless necessary and lawful.

Source references

GDPR, including Articles 28 and 32: https://eur-lex.europa.eu/eli/reg/2016/679/oj
Braincreators ISO/IEC 27001:2022 certificate: ISO-IEC_27001-ENG-C860063-0-20260731.pdf

Inspech Processing and Security Schedule