Legal
Data processing
When a customer's SiteOS installation holds personal data, such as worker locations or camera detections, the customer decides why and how it is used. This page explains where we fit.
Draft, pending legal review. Version of 21 October 2026. This text has not been reviewed by counsel and may change before it takes effect. Where something is not yet decided, the page says so.
Roles
- You are the controller of the personal data your site collects in SiteOS: the people tracked, the footage analysed and the accounts you create.
- In an installation you run yourself, including an air-gapped one, we do not receive that data. We act as a processor only if you give us access, for example for support, and then only under a written agreement.
- For a hosted service, ELEVEN22SPX LTD would act as your processor. A hosted service is planned and not yet offered.
The agreement
We sign a data processing agreement with every customer whose personal data we process, covering what GDPR Article 28 requires. Our template is being revised for EU and US customers and is pending legal review. Ask for the current draft through the briefing request form.
Tools in the platform for your duties
- Retention policies per organisation, with a preview of what a purge would remove.
- Erasure of a person's records, with a dry run and an explicit confirmation.
- Export of the organisation's data, for access and portability requests.
- A tamper-evident record of privileged and administrative actions.
Sub-processors
An installation you run yourself uses no sub-processors of ours. The sub-processor list for the hosted service will be published here before that service is offered.