Data processing
This page sets out how 180 Degrees IT Solutions handles personal information inside 180D Compliance on behalf of a client. It is written for the person at a client organisation who has to sign off on it. A countersigned data processing agreement is available on request.
The roles
The client is the entity that decides what personal information goes into the system and why. 180 Degrees IT Solutions processes it only on the client's documented instructions, which for practical purposes means the actions the client takes in the product plus anything agreed in writing.
Scope
- Subject matter
- Providing compliance training, inspection and evidence software.
- Duration
- For as long as the client's agreement is in force, plus a short wind-down period.
- Categories of people
- The client's employees, contractors and site visitors, plus anyone the client chooses to collect information from using its own forms.
- Categories of information
- Identity and workplace details; Training and competency records; Inspection and audit records; Form submissions; Activity and audit trail.
Our commitments
- Process personal information only on the client's instructions, and not for our own purposes.
- Keep each client's records separated from every other client's, and encrypt sensitive fields with a key unique to that client.
- Restrict access to staff who need it to run or support the service, under confidentiality obligations.
- Not add a new sub-processor without updating the list below first, so a client can object before it takes effect.
- Assist the client in responding to a request from an individual to access, correct or delete their information.
- Notify the client without undue delay on becoming aware of a breach affecting their information, with what we know and what we are doing.
- Return or delete the client's information at the end of the agreement, at the client's choice.
- Allow a client to audit these commitments on reasonable notice.
Sub-processors
Every entry below is genuinely in the path today, or is marked as conditional where it applies only to an optional feature. This list is maintained alongside the code, not separately from it.
| Provider | Purpose | Location |
|---|---|---|
| Microsoft | Sign-in (Entra ID). Also holds the encryption keys and application secrets in Azure Key Vault. | Australia and global Microsoft regions |
| Cloudflare | Puts the service on the internet, filters abusive traffic, and controls access to internal areas. | Global edge network |
| The hosting provider | Runs the application servers and the database. | Australia |
| Backblaze | Stores uploaded files such as inspection photographs and images. | United States |
| Resend | Sends notification and reminder emails.Only once email sending is switched on. As at the date above, the product sends no email. | United States |
| Anthropic, OpenAI and Google | Generate draft training content and draft inspection templates when a client asks for it.Only when a client uses the AI drafting features. Text a client submits for drafting is sent to the chosen provider. No training or inspection records are sent for this purpose. | United States |
Overseas disclosure
The database and application servers are in Australia. Some of the providers above operate outside Australia, as noted. A client should treat that table as the disclosure required under Australian Privacy Principle 8.
Retention and deletion
Training, inspection and submission records
Kept for as long as the client's account is open, because they are the evidence the client is required to hold. Deleted within 30 days of the account closing, unless the client asks in writing for a copy first.
A person who leaves the client's organisation
Their account can be deactivated immediately, which stops all access. Their completed training records are kept, because removing them would destroy the client's own compliance evidence. Their record can be permanently deleted on request.
Sign-in and change history
Kept for as long as the account is open. This is the audit trail and it is deliberately not editable.
Backups
Held for 14 days and then overwritten. A deletion may therefore persist in a backup for up to 14 days after it is made.
Security measures
- Sign-in through the client's own Microsoft Entra ID. We never hold passwords, and the client's own multi-factor policy applies.
- Encryption in transit, and encryption at rest for sensitive fields.
- Role-based access control inside each client's workspace.
- An audit trail of changes that users cannot edit.
- Nightly backups, verified by restoring them and comparing record counts.
- Automated dependency scanning, with a documented process for triaging what it reports.
To request a signed data processing agreement, or to ask about anything above, contact [email protected].