What this agreement is
UK GDPR Article 28 requires a written contract whenever one organisation processes personal data on behalf of another. When your company uses SAMRISK, your company is the controller of the personal data in its records and Remiam Limited is its processor. This agreement forms part of our terms. This page summarises it; the full agreement is available on request at [email protected], and Enterprise customers can sign it with their order form.
The processing
| Item | Detail |
|---|---|
| Subject matter | Providing SAMRISK, its tools and support to your company |
| Duration | While your company has an account, and until its data is deleted afterwards |
| Nature and purpose | Storing, organising, showing, sending and deleting records as your company's people use SAMRISK; backups; support; security |
| Kinds of people | Your staff and members, clients' people, contractors and their staff, visitors, residents, and anyone named in a record, document or photo |
| Kinds of data | Names, work contact details, job titles and roles; visitor sign in details and answers; contractor contacts, insurance and accreditations; training certificates; incident details; documents, photos and discussions; the record of who did what |
| Special category data | Not required by SAMRISK. If your company records it, for example injury details in an incident, it must have a lawful condition to do so |
What we commit to
- Instructions: we process the data only on your documented instructions, which are these terms, the agreement and how your people use SAMRISK, unless the law requires otherwise, in which case we tell you if we may.
- Confidentiality: everyone at SAMRISK who can access the data is bound to keep it confidential.
- Security: encryption in transit and at rest; each company's records kept apart by the database on every request; private files opened through links that expire; limited, logged staff access, including a read only "view as" that needs a reason and ends after 30 minutes. The full list of technical and organisational measures comes with the full agreement.
- Subprocessors: only those listed below, each under a written contract with data protection terms at least as protective as these. We tell customers at least 30 days before adding or replacing one, and you may object on reasonable data protection grounds.
- People's requests: we help you answer requests to access, correct, delete or move personal data, and pass on any request that reaches us.
- Breaches: we tell you without undue delay, and within 48 hours of becoming aware of a breach affecting your data, with what we know.
- Assessments: we help with data protection impact assessments and consultation with the ICO where needed.
- End of service: you can export your data at any time. When the service ends we delete it, or return it if you ask, within 30 days, unless the law requires us to keep it, as it does for billing records, which we keep for six years. Deleted data leaves our rolling backups within a further 30 days. Deleted records are kept 90 days in Recently deleted before they are purged.
- Audits: we make available the information needed to show we keep to this agreement, and allow reasonable audits on notice.
Subprocessors
These suppliers process the personal data in your records on our behalf. This is the one page on our website that names them.
| Supplier | What it does for SAMRISK | Personal data | Where |
|---|---|---|---|
| Supabase | Database, sign in and live updates | Accounts and every record your company creates | London, UK |
| DigitalOcean | Application hosting, and file storage for documents, photos and certificates | Application traffic and logs; uploaded files | Files in London, UK; application servers in the UK or European Economic Area |
| Stripe | Payments, subscriptions and invoices | Billing contact, company billing details; card details go to Stripe only | The UK, Ireland and the United States, as set out in Stripe's terms |
| Resend | Sending email: sign in codes, invitations, resets, notifications and digests, with delivery events | Name, email address, the message, and whether it was delivered, opened or bounced | The United States and other locations, as set out in Resend's terms |
Supabase and DigitalOcean keep your records and files in the UK. Stripe and Resend may process data outside the UK; those transfers are protected as set out in their terms, by a UK adequacy decision (including the UK Extension to the EU-US Data Privacy Framework where the supplier is certified), or by the UK Addendum to the EU standard contractual clauses or the UK International Data Transfer Agreement.
SAMRISK does not currently send the data in your records to any AI provider. Before that changes we will add the provider here and give you 30 days' notice, as for any new subprocessor.
Services the app calls directly
When a map, imagery or address search shows in SAMRISK, the person's browser asks these services for the files it needs. They receive the person's IP address and the area shown or the words searched, but no account details or records. They are independent services rather than processors.
| Service | What for | Where |
|---|---|---|
| Esri World Imagery and Wayback | Aerial imagery, current and dated | United States |
| OpenFreeMap | Street and 3D building map tiles | As set out in its own terms |
| OpenTopoMap | Topographic map tiles | Germany, as set out in its own terms |
| OpenStreetMap Nominatim | Address search | As set out in the OpenStreetMap Foundation's terms |
| Open-Meteo and public elevation tiles | Ground heights for terrain and contours | The EU and the United States, as set out in their own terms |
| Google Fonts | The typefaces | United States |
On samrisk.co.uk
Our website, which does not hold your company's records, uses Google Tag Manager, Google Analytics and Google advertising measurement only if a visitor allows them in the cookie banner. For these we are the controller and the visitor's choice is the lawful basis.
Changes and contact
We update this page and tell customers before a change to the subprocessors. For a copy of the full agreement, the safeguards for each transfer, or any question, write to [email protected].