Skip to content
Legal & privacy
Go to CADdy-Hub

Data Processing Addendum

Version 1.0 · Effective date: November 11, 2026

This Data Processing Addendum ("DPA") is part of the External User Terms of Use ("Terms") between Brooks Building Solutions, Inc. ("Brooks") and the subcontractor company that accepts the Terms ("Company"). When a Company user accepts the Terms, the user and Company accept this DPA.

1. Scope and roles

This DPA covers personal information that Company or its users put in CADdy-Hub ("the Hub") about Company's customers, contacts and other people ("Company Personal Data"). Examples: customer contact names on Company's jobs, customer signatures, and names and details in files and photos Company uploads.

For Company Personal Data, Company decides why and how it is used, and Brooks processes it on Company's behalf (Brooks is Company's "processor" or "service provider"). This DPA does not cover information Brooks uses for its own purposes, such as Company users' account details and Brooks's own job data. The Privacy Notice covers those.

2. Brooks's duties

2.1 Instructions

Brooks will process Company Personal Data only to provide the Hub to Company, keep it secure, and as Company instructs. The Terms, this DPA and Company's use of the Hub's features are Company's instructions. Brooks will also process it when the law requires; if so, Brooks will tell Company first unless the law forbids it.

Brooks will not:

  • sell Company Personal Data, or share it for cross-context behavioral advertising;
  • use it for any purpose other than providing the Hub to Company;
  • combine it with other data, except as needed to provide the Hub; or
  • keep, use or disclose it outside its direct business relationship with Company.

2.2 Confidentiality of personnel

Brooks limits access to Company Personal Data to staff who need it for their work, such as Hub administrators. Those staff are bound by confidentiality duties and by Brooks's Acceptable Use & Monitoring Notice.

2.3 Security

Brooks uses reasonable technical and organizational measures to protect Company Personal Data. Today these include:

  • Sign-in. Brooks staff sign in with Microsoft Entra ID, with multi-factor authentication required by Conditional Access. Company users sign in with a password stored only as a salted scrypt hash, with a minimum length, sign-in rate limits and account lockout, and optional email-code multi-factor authentication that Company's admin or Brooks can make required.
  • Sessions. Session cookies are HTTP-only and Secure. Browser sessions sign out after 12 hours without use. A turned-off account loses access within about a minute. If the Hub cannot confirm that an account is still active (beyond a 5-minute grace period), it refuses that account's sign-ins and requests.
  • Access control. Company users see only Company's own jobs and only the Hub modules enabled for Company. Brooks staff access depends on role, department, office and job.
  • Encryption. Traffic to the Hub uses HTTPS, with HTTP Strict Transport Security. Data at rest in Azure SQL and Azure Storage is encrypted, and the database has automated backups. Database connections from the Hub are encrypted (TLS).
  • Web protections. In a browser, only the Hub's own pages and an allow-list of addresses can read Hub responses, other sites cannot embed Hub pages, and browsers are told to use HTTPS only.
  • Audit. Records keep who created or changed them. A super admin's "View as" previews are logged. API tokens are stored only as hashes, expire, and can be revoked. Acceptance of the Terms is recorded in a table where the database refuses any change to, or deletion of, a record.
  • Logging. Database error logs do not include the values being saved.
  • Retention. A retention schedule limits how long certain data is kept (see the Data Retention Schedule).
  • Incident response. Brooks keeps a written incident response plan.

Brooks may change these measures, but not in a way that materially lowers the overall protection.

2.4 Subprocessors

To facilitate Brooks' proper handling of Company Personal Data, Brooks utilizes third-party vendors ("subprocessors") for certain services, such as secure cloud storage. Company authorizes Brooks to use the subprocessors listed on the Subprocessors page (/legal/subprocessors). Brooks will:

  • bind each subprocessor to data protection duties at least as protective as this DPA, as far as their standard terms allow;
  • stay responsible for their work under this DPA; and
  • give Company notice of a new subprocessor by updating the Subprocessors page at least 30 days before it starts processing Company Personal Data, except in an emergency. Company may object in writing on reasonable data protection grounds. If the parties cannot resolve the objection, Company may stop using the Hub.

2.5 Help with requests from individuals

If a person asks Brooks to access, correct or delete Company Personal Data, Brooks will send the request to Company and will not answer it except as Company directs or the law requires. Brooks will give Company reasonable help to answer such requests, taking into account what the Hub can do.

2.6 Breach notice

If Brooks confirms a breach of security that led to unauthorized access to, or loss of, Company Personal Data, Brooks will notify Company without undue delay, and within 5 days after confirming it. The notice will say, as far as known: what happened, what data and how many people are involved, what Brooks has done and will do, and a contact. Brooks will update Company as it learns more and will give reasonable help so Company can meet its own notice duties. Notifying Company is not an admission of fault.

2.7 Deletion or return

When Company's use of the Hub ends, Company may ask in writing, within 30 days, that Brooks return or delete Company Personal Data. Brooks will do so within 90 days of the request. Return will be in a common format Brooks chooses (for example CSV files and the original uploaded files). Brooks may keep copies (a) in backups until they expire in the normal cycle, and (b) where the law or a legal claim requires, in both cases still protected under this DPA. If Company makes no request, Company Personal Data follows the Data Retention Schedule.

2.8 Audits

Brooks will give Company the information reasonably needed to show it meets this DPA. Company will first send a written questionnaire, which Brooks will answer within a reasonable time. If the answers are not enough, or a regulator requires it, Company may ask for a further review once per year, at its own cost, with at least 30 days' notice, during business hours, and under confidentiality terms. It may not access other customers' data or put Brooks's security at risk.

3. Company's duties

Company will:

  • have a lawful basis and give the notices needed to put Company Personal Data in the Hub;
  • not put in the Hub Social Security numbers, financial account or card numbers, driver's license or passport numbers, health information, or other sensitive data the Hub is not built for;
  • keep its users' accounts secure and turn off accounts that are no longer needed; and
  • tell Brooks promptly if it learns of a security problem with the Hub.

4. Liability, term and law

  • The limits of liability in the Terms apply to this DPA.
  • This DPA lasts as long as Brooks processes Company Personal Data.
  • If this DPA conflicts with the Terms about Company Personal Data, this DPA controls. If a signed subcontract or other written agreement between Brooks and Company has its own data protection terms, those terms control.

5. Contact

Brooks Building Solutions, Inc., 4501 Beverly Ave, Jacksonville, FL 32210 · mrubio@brookssolutions.net

Change log

  • 1.0 – first version

Version 1.0 · SHA-256 2ba8ece8b5e08edd2bfe6b763e9c30a7dc1ea4dcf5c12f1b87cea05b1ff30d63