Data Processing Addendum

Last updated: October 2026

1. When the DPA applies

The DPA applies where Offsight Inc. (“Offsight”) processes Personal Data on a customer’s behalf in the course of providing the Service. It is entered into alongside the Terms of Service and the customer’s Order Form, and forms part of that agreement. If you have signed a separate DPA with Offsight, that signed DPA controls wherever it differs from this page. If you have not, this page is the Data Processing Addendum between you and Offsight. It is incorporated into the Terms of Service, it binds you on the same basis as the Terms of Service, changes to it take effect as section 17 describes, and every reference on this page to “the DPA” means this page.

If this DPA conflicts with the Terms of Service on Model Improvement, Individual Monitoring, liability, indemnity or the extent of Offsight’s responsibility for security incidents, the Terms of Service control; on any other matter concerning the processing of Personal Data, this DPA controls.

It does not apply to personal data Offsight collects directly for its own purposes outside the Service — a demo request, a sales enquiry, a support message from a visitor. For that, Offsight is the controller and the Privacy Policy is the full description. Nor does it apply to Aggregated Anonymous Data, which is not Personal Data. It does apply to Customer Data: it governs Service Processing, as section 2 defines it, and it applies to Offsight’s use of Customer Data for Model Improvement in the role section 2 states, which section 4 describes.

Capitalized terms used here — including “Vision AI,” “Visual Data,” “Vision AI Results,” “Output,” “Customer Models,” “Base Models,” “Customer Data,” “Personal Data,” “Aggregated Anonymous Data,” “Model Improvement,” “Model Improvement Safeguards,” “Model Improvement Effective Date,” “Training Copies,” “Work-Area Activity Detection,” “Tools & Equipment Tracking,” “Individual Monitoring” (also called “People Tracking”), “Individual Monitoring Data,” “Biometric Data,” “Biometric Release Requirements,” “Facial Recognition,” “Monitoring Laws,” “Monitored Individual,” “Required Authorizations,” “Site,” “Consequential Employment Decision,” “Image Review,” “Second-Opinion Review,” “Sub-processor,” “Authorized Administrator,” “Material Change,” “Suspension Events,” “Covered Claims,” “Losses” and “Offsight Indemnitees” — have the meanings given in the Terms of Service, and mean the same thing on every Offsight legal page.

2. Roles and instructions

• Customer is the controller. You decide what goes into your tenant, who has access to it, how long it stays there, where your cameras point, what Vision AI detects, tracks, counts, locates or monitors, and whether any individual is monitored. For the Personal Data in Customer Data you are the controller and the “business”; as between you and Offsight, you are also the employer of your own workers and, for any Individual Monitoring, the “deployer.”
• Offsight is the processor for Service Processing. For everything Offsight does to provide the Service to you (“Service Processing”), it acts as your processor, service provider or contractor. It processes Personal Data only on your documented instructions — which, in practice, are this agreement, the configuration of your tenant and the actions your users take in the product — and only for the specified business purposes listed below. The specified business purposes, and your instruction to perform them, are part of this agreement and change only by an agreement signed by both parties or by an update under section 17. A configuration or other later instruction does not withdraw your instruction to perform Model Improvement, except where applicable law gives you a right that cannot be waived.
• Offsight’s role in Model Improvement. Offsight performs Model Improvement for its own business purposes. To the extent applicable law permits a processor or service provider to use Personal Data to build or improve its services, Offsight performs Model Improvement in that role. To the extent applicable law treats Model Improvement as outside that role, Offsight performs it as an independent controller (or “business” or “third party”), and you authorize and instruct Offsight to receive and use Customer Data for it. In either case, Offsight complies with the obligations that applicable law places directly on it. What Model Improvement covers is described in section 4.
• Sub-processors are engaged under Offsight’s responsibility. Offsight uses sub-processors to deliver the Service, on terms no less protective than those we owe you, and we remain answerable to you for their performance. The categories are in section 7.

Specified business purposes

Offsight processes the Personal Data in Customer Data only for the following business purposes, each of which you instruct it to perform:

• hosting, storing and transmitting Customer Data, including Visual Data;
• running Vision AI detection — machine states, Work-Area Activity Detection and Tools & Equipment Tracking — and recording Vision AI Results in your tenant;
• training, evaluating and maintaining Customer Models for you;
• Image Review and Second-Opinion Review, at your direction;
• processing requests made to the AI assistant and AI agents;
• Individual Monitoring, as you configure it;
• support, security, debugging, and detecting and preventing fraud and misuse of the Service;
• building and improving the quality of the Service provided to you;
• Model Improvement, to the extent applicable law permits a service provider or processor to use Personal Data to build or improve its services;
• creating Aggregated Anonymous Data; and
• complying with law.

3. Processing particulars

4. AI processing under the DPA

This is the part that is new relative to conventional factory software, so the DPA addresses it explicitly.

• Model providers are sub-processors. Model inference is performed on Offsight’s behalf by third-party providers engaged as sub-processors under section 7, under commercial API terms.
• Scoped transmission. An AI request transmits the content of the request and the records, documents or images retrieved to answer it — not the tenant.
• Model providers do not train on your content. Inference requests are made under commercial API terms under which customer content is not used to train the provider’s models.
• Offsight trains its own models on Customer Data. Offsight uses Customer Data to train and improve its own AI models, including the Base Models it uses to provide the Service to all of its customers. This is Model Improvement, described under “Model Improvement” below.
• Permissions and attribution. An AI request executes in the context of the user who made it, bounded by that user’s per-module and per-user-group permissions, and the resulting actions are recorded in the audit trail against that user.
• Session records are Customer Data. Requests, actions and output are stored in your tenant, are subject to your retention decisions, and are exported and deleted with everything else, as section 15 describes.
• Human review. AI output — including Vision AI Results and any Output of Individual Monitoring — is decision support and can be wrong or incomplete. You are responsible for reviewing it before relying on it, as the Terms of Service section entitled “AI output requires human review” describes. Offsight does not design, market or offer Vision AI or the AI assistant for making Consequential Employment Decisions. If you use Output in any decision about an individual, you do so as controller and deployer and at your sole risk, and you are responsible for any notice, explanation, appeal or access right the law gives the individual.

Vision AI

• Detection runs on Offsight’s infrastructure. Vision AI detection, Tools & Equipment Tracking and the training of Customer Models are performed on computing infrastructure Offsight operates in its cloud hosting environment, not by an AI model inference sub-processor.
• Still images, no audio. Your cameras upload still images, not video and without audio.
• What Vision AI detects. Vision AI detects, recognizes, locates, tracks, counts and reports on the state, presence, identity, location and activity of what you configure it to monitor: the machines, tools, equipment, materials, work areas and operations you choose, and people whenever you configure it to detect, track, count, locate or monitor them. Work-Area Activity Detection reports whether an area, station or machine is active, idle or occupied, for the area as a whole, and, where you configure it to, whether people are present or working there. It does not itself identify any person or follow a person as the same individual across images, cameras or time. Configuring it to detect whether people are present or working is Individual Monitoring. Tools & Equipment Tracking applies its re-identification model to images of the detected tool or item of equipment, not to people. If you link a tool or item of equipment to a named individual, its location history may become Personal Data about that individual, and using it to follow that individual is Individual Monitoring.
• Customer Models are per customer. Each Customer Model starts from a Base Model, is further trained on your Visual Data, and is deployed only to process your Visual Data. Training runs with credentials limited to your Visual Data, and a Customer Model is not deployed for any other customer. Training a Customer Model is processing on your instructions to deliver the Service; it is not Model Improvement. Customer Models, including their weights and parameters, are Offsight’s property, are not Customer Data, and may be used in Model Improvement.
• Base Models. Base Models are the general detection and recognition models that Offsight develops and from which Customer Models start. Offsight builds them from open-source models, from datasets it is licensed to use and, under Model Improvement, from Customer Data, including Visual Data that shows people. Base Models are Offsight’s property and are used to provide the Service to Offsight’s customers generally.
• Image Review. If you request Image Review — the optional, paid check of training captures before a Customer Model is trained — the training captures under review, with the markups, labels, notes and capture details needed for the check, and reference captures from your account for comparison, are sent to an AI model inference sub-processor for that check.
• Optional Second-Opinion Review. Only if you turn on the account setting “Improve Vision AI capability and accuracy” — off unless turned on — Vision AI may send up to eight camera frames, the state being checked, and the related notes attached to training captures and to the area the camera watches to an AI model inference sub-processor, when a detection’s confidence falls just short of its threshold. The request is made with the provider’s response-storage option turned off, and the verdict is recorded beside the detection without overwriting it. This setting does not control Model Improvement.
• No other path to a model provider. Unless Second-Opinion Review is on or you request Image Review, Vision AI itself does not send Visual Data to a model provider. Visual Data that a user shares with, or asks, the AI assistant about — for example, the notes on a training capture, or an image attached to a chat — is transmitted as a scoped AI request, as described above, whether or not the setting is on.

Your cameras and your decisions

Offsight imposes no restrictions of its own on where you place cameras, what they capture, or what you use Vision AI to detect, track, count, locate or monitor, including people. You alone make those decisions. You alone are responsible for making sure that each of them is lawful in every country, state, province and locality where you operate a camera or where a Monitored Individual is located. The only rule the Terms of Service and this DPA set for those decisions is that you may not use the Service in violation of law, and complying with the law is your responsibility, not Offsight’s.

Laws that may apply to you include, for example:

• laws that ban cameras in restrooms, locker rooms, changing areas and lactation spaces, such as California Labor Code section 435, New York Labor Law section 203-c and Connecticut General Statutes section 31-48b;
• laws that require every party’s consent to record a conversation, such as California Penal Code section 632, if any camera or device you connect records audio;
• biometric privacy laws, such as the Illinois Biometric Information Privacy Act, Texas Business and Commerce Code section 503.001 and Washington’s biometric identifier law;
• workplace electronic-monitoring notice laws, such as Connecticut General Statutes section 31-48d, New York Civil Rights Law section 52-c and Delaware Code title 19, section 705;
• Section 7 of the National Labor Relations Act;
• state laws on artificial intelligence and automated decisions in employment, such as Colorado’s artificial intelligence act, the Illinois Human Rights Act’s rules on artificial intelligence, California’s regulations on automated decision-making technology, and New York City Local Law 144.

These are examples of laws you are responsible for. They are not rules Offsight sets, and the list is not complete. The Acceptable Use Policy gives further examples.

Offsight may suspend or restrict the Service, or any part of it, only on a Suspension Event. Offsight does not suspend or restrict Vision AI, Individual Monitoring or any camera because of what you choose to monitor, except under item (c) of that definition. Offsight will give notice of a suspension unless the law or the order prevents it, or unless the security threat requires immediate action, and will lift the suspension once the Suspension Event ends. Individual Monitoring is your sole responsibility and risk, as section 8 sets out.

Model Improvement

Offsight uses Customer Data — including Visual Data that shows people, their faces and their activity — to train and improve its AI models, including the Base Models it uses to provide the Service to all of its customers.

“Model Improvement” means Offsight’s use of Customer Data to train, retrain, fine-tune, test, evaluate, validate, improve and develop Offsight’s AI models, including Base Models and other models Offsight uses to provide the Service to its other customers. The Customer Data used includes Visual Data that shows people, their faces and their activity, Vision AI Results, Individual Monitoring Data, and the markups, labels and notes attached to them. Training a Customer Model for you is not Model Improvement. The license for Model Improvement is in the Terms of Service section entitled “Model Improvement,” and Offsight’s role in performing it is stated in section 2.

“Training Copies” means copies of Customer Data, including Visual Data and the markups, labels and notes attached to it, that Offsight selects and stores for Model Improvement. Training Copies are not subject to the retention periods that apply to Customer Data in your tenant. Offsight keeps them for as long as it uses them for Model Improvement, including after this agreement ends, and protects them as the Model Improvement Safeguards describe. Training Copies are Customer Data, and any Personal Data in them remains Personal Data.

The “Model Improvement Safeguards” are the following commitments, which are the only limits on Model Improvement. Offsight:

• (a) does not disclose your Customer Data, or any image or other data that identifies you or any individual, to any other customer;
• (b) does not use Customer Data to create a faceprint, face template or other biometric template of any individual;
• (c) does not sell Customer Data; and
• (d) protects Training Copies and other Customer Data used for Model Improvement with commercially reasonable security measures.

Making a model trained with your Customer Data available to other customers is not a disclosure of your Customer Data. Offsight’s models, including their weights and parameters, are Offsight’s property and are not Customer Data. Model Improvement does not depend on any setting, and there is no opt-out other than any that applicable law requires. The account setting “Improve Vision AI capability and accuracy” controls only Second-Opinion Review.

Model Improvement applies from the Model Improvement Effective Date to all Customer Data that Offsight holds on that date and to all Customer Data provided after it (section 17). You represent that you have obtained every Required Authorization that Model Improvement needs (section 10), and claims arising from Offsight’s use of Customer Data for Model Improvement are Covered Claims under your indemnity (section 16). Training Copies, and the models trained with Customer Data, are kept by Offsight after the agreement ends, and are not returned or deleted with Customer Data (section 15).

5. Offsight’s commitments as processor

Offsight personnel who can access Customer Data are subject to confidentiality obligations. Access to Customer Data in your tenant is granted on a need-to-perform basis, and that access is logged. Support access to a tenant is auditable.

The commitments in this section apply to Service Processing, and to Model Improvement to the extent Offsight performs it as your processor, service provider or contractor (section 2). To the extent applicable law treats Model Improvement as outside that role, Offsight performs it as an independent controller, as section 2 states, and complies with the obligations that applicable law places directly on it.

California service-provider terms

Offsight does not sell Customer Data. Where the California Consumer Privacy Act applies, Offsight acts as your service provider or contractor and, for the Personal Data it processes on your behalf:

• will not sell or share it, as the CCPA defines “sell” and “share”;
• will not retain, use or disclose it for any purpose other than the specified business purposes in section 2, or outside the direct business relationship between you and Offsight;
• will not combine it with personal information that Offsight receives from or on behalf of anyone else, or collects itself, except as the CCPA permits;
• will comply with the obligations the CCPA places on it, and will give the Personal Data the same level of privacy protection the CCPA requires of you;
• gives you the right to take reasonable and appropriate steps to make sure it uses the Personal Data consistently with your CCPA obligations — including assessments, audits or other reviews of its compliance at least once every twelve months — which Offsight may meet by providing a report from a qualified, independent assessor;
• will notify you if it determines that it can no longer meet its CCPA obligations, and gives you the right, on notice, to take reasonable and appropriate steps to stop and remediate unauthorized use;
• will help you respond to consumer requests, including by deleting or correcting the Personal Data you identify across Visual Data, detection overlays and training captures in your tenant;
• will notify you when it engages a Sub-processor, and will bind each one by written contract to these same restrictions (section 7); and
• certifies that it understands these restrictions and will comply with them.

Processor terms under other state privacy laws

Where another US state privacy law applies, Offsight, as processor:

• processes Personal Data only on your documented instructions, and does not process it beyond them;
• binds each person who processes it to a duty of confidentiality;
• deletes or returns it at the end of the Service, as section 15 describes, unless the law requires it to be kept (Training Copies are kept as sections 4 and 15 describe);
• makes available to you the information reasonably necessary to demonstrate its compliance with these obligations;
• allows and cooperates with reasonable assessments by you or an assessor you designate or, instead, arranges an assessment by a qualified, independent assessor using an appropriate and accepted control standard, and gives you the report on request;
• engages Sub-processors only under a written contract imposing the same obligations, after notice and an opportunity to object (section 7);
• maintains reasonable security, as section 6 describes;
• on your written request, stops processing the Personal Data you identify where the law gives you that right, which may stop the related parts of the Service from working;
• assists you, by appropriate technical and organizational measures, with your obligations on the security of processing — including the security of the AI systems used to provide the Service — on breach notification, and on data protection assessments (section 11); and
• maintains a written privacy program that it aligns with the NIST Privacy Framework.

6. Security measures

Offsight maintains reasonable administrative, technical and physical security measures appropriate to the nature of Customer Data. Its technical and organizational measures include:

• encryption in transit (TLS) and, for Customer Data in your tenant, encryption at rest;
• two-factor authentication;
• per-module and per-user-group permissions administered by customer admins;
• tenant isolation and per-tenant data separation;
• audited access to your tenant, including administrative and support access;
• API keys with rotation, live usage metering and enforceable limits;
• for Vision AI: camera uploads over encrypted FTPS, with unencrypted FTP and older TLS versions refused; upload-only camera credentials that cannot read back, list or delete; camera images written to server-generated storage paths under the customer’s tenant; Visual Data in the tenant encrypted at rest; Vision AI images kept private rather than given public links, with training captures opened through short-lived signed links; and Customer Model training with credentials limited to that customer’s Visual Data;
• for Training Copies and other Customer Data used for Model Improvement: commercially reasonable security measures, as Model Improvement Safeguard (d) in section 4 provides;
• for Biometric Data, if any: the standard of care in section 9; and
• managed cloud infrastructure in the United States — containerized services, a managed relational database with a read replica, and a caching tier.

Offsight will respond to reasonable written security questionnaires from a customer and its assessors, subject to confidentiality, and will describe the architecture and the parties involved in delivering it under that cover.

7. Sub-processors and notice

Offsight engages Sub-processors to deliver the Service. They fall into a small number of categories:

• cloud hosting, storage and compute, including the compute Offsight uses for Model Improvement;
• AI model inference, which covers the AI assistant and AI agents, Image Review and Second-Opinion Review;
• design-file processing;
• transactional and notification email;
• subscription billing and payment processing; and
• DNS and edge delivery for our public website.

Vision AI adds a new type of data — images — but no new category. Visual Data is stored and processed within cloud hosting, storage and compute, and reaches AI model inference only through Image Review when you request it, through Second-Opinion Review when the setting is on, or when a user shares it with the AI assistant, as described in section 4. Offsight also uses its cloud hosting, storage and compute Sub-processors to store Training Copies and to perform Model Improvement. Cameras are hardware the customer procures from third parties; camera manufacturers are not Offsight sub-processors, and anything a camera sends anywhere other than to the Service is not processing by Offsight.

Each is engaged under a written contract imposing data-protection obligations no less protective than those in the DPA, is permitted to use the information only to provide its service to Offsight, and is bound to confidentiality. Offsight remains responsible to the customer for their performance.

The identified list of sub-processors, with the data categories each one receives, is provided to customers and their assessors on request. Request it — and email notice of additions or replacements — at support@offsight.com. Offsight gives notice before a new or replacement Sub-processor begins processing Customer Data. You may object in writing to support@offsight.com on reasonable data-protection grounds before the Sub-processor begins processing; the parties will discuss the objection in good faith, and if it cannot be resolved you may terminate the affected Order Form and receive a pro-rata refund of prepaid fees for the remaining term.

8. INDIVIDUAL MONITORING — YOUR SOLE RESPONSIBILITY AND RISK

INDIVIDUAL MONITORING IS AVAILABLE WHENEVER YOU CONFIGURE VISION AI TO DETECT, TRACK, COUNT, LOCATE OR MONITOR PEOPLE, OR USE VISUAL DATA OR OUTPUT TO EVALUATE OR ATTRIBUTE ACTIVITY TO A SPECIFIC INDIVIDUAL. NO SEPARATE SETTING, APPROVAL OR ATTESTATION IS REQUIRED. BY USING INDIVIDUAL MONITORING YOU ACCEPT, FOR YOURSELF AND YOUR COMPANY, FULL RESPONSIBILITY FOR THAT USE, AND YOU ACKNOWLEDGE AND AGREE THAT:

• (1) YOU ALONE DECIDE WHETHER, WHERE, WHEN AND HOW TO MONITOR ANY INDIVIDUAL, AND, AS BETWEEN YOU AND OFFSIGHT, YOU ARE THE EMPLOYER, CONTROLLER, “BUSINESS” AND “DEPLOYER” FOR THAT MONITORING;
• (2) YOU USE INDIVIDUAL MONITORING AT YOUR SOLE LEGAL RISK, AND YOU ARE SOLELY RESPONSIBLE FOR COMPLYING WITH ALL MONITORING LAWS OF EVERY COUNTRY, STATE, PROVINCE AND LOCAL JURISDICTION WHERE YOU OPERATE A CAMERA OR WHERE A MONITORED INDIVIDUAL IS LOCATED;
• (3) YOU WILL OBTAIN AND MAINTAIN EVERY REQUIRED AUTHORIZATION. THAT MEANS GIVING EVERY NOTICE, POSTING EVERY SIGN, OBTAINING EVERY CONSENT AND RELEASE (INCLUDING WRITTEN BIOMETRIC RELEASES WHERE THE LAW REQUIRES THEM), COMPLETING EVERY ASSESSMENT, AND MEETING EVERY OBLIGATION TO NOTIFY, CONSULT OR BARGAIN WITH A UNION OR OTHER EMPLOYEE REPRESENTATIVE. YOU WILL ALSO HANDLE EVERY REQUEST FROM A MONITORED INDIVIDUAL;
• (4) OFFSIGHT HAS NO RELATIONSHIP WITH MONITORED INDIVIDUALS, CANNOT GIVE NOTICE OR OBTAIN CONSENT ON YOUR BEHALF, DOES NOT PROVIDE LEGAL ADVICE, AND MAKES NO REPRESENTATION THAT ANY USE OF VISION AI OR INDIVIDUAL MONITORING IS LAWFUL IN ANY JURISDICTION;
• (5) OFFSIGHT HAS NO RESPONSIBILITY, AND NO LIABILITY TO YOU, FOR YOUR INDIVIDUAL MONITORING OR FOR ANY DECISION YOU MAKE ABOUT ANY INDIVIDUAL; AND
• (6) YOU WILL DEFEND, INDEMNIFY AND HOLD HARMLESS THE OFFSIGHT INDEMNITEES AGAINST EVERY COVERED CLAIM AND ALL LOSSES, AS SET OUT IN THE TERMS OF SERVICE SECTION ENTITLED “CUSTOMER INDEMNITY” AND SUMMARIZED IN SECTION 16. THAT OBLIGATION HAS NO CAP AND SURVIVES TERMINATION.

“Individual Monitoring,” also called “People Tracking,” means any of the following, whether or not any individual is named, and by whatever means, including face, body, gait, clothing, appearance, badge, tag or assignment:

• (a) configuring or using Vision AI, a Customer Model or any other feature of the Service to detect, track, count, locate or monitor people, including detecting whether people are present or working in an area;
• (b) any feature or use of the Service that recognizes a person as the same individual across images, cameras, areas or time; identifies or re-identifies an individual; or attributes presence, location, movement, activity, behavior, attendance or performance to a specific individual;
• (c) any use of Visual Data or Output, alone or combined with other information such as schedules, work assignments, or badge or timekeeping records, to evaluate a specific individual or to attribute activity to one.

Individual Monitoring is available whenever you configure or use the Service in any of these ways. It does not need to be enabled, approved or attested to, and Offsight does not review or approve it. You accept responsibility for it, as this section and the Terms of Service section entitled “Individual Monitoring” describe, by using it and by accepting the Terms of Service or an Order Form. Configuring Work-Area Activity Detection to detect whether people are present or working is Individual Monitoring, and so is using Tools & Equipment Tracking to follow an individual you have linked to a tool or item of equipment. Offsight’s Vision AI does not currently offer Facial Recognition. If you use Facial Recognition or any other biometric process on Visual Data or Output, inside or outside the Service, that use is Individual Monitoring at your sole risk. The Acceptable Use Policy gives examples of Monitoring Laws you are responsible for.

9. Biometric Data

Offsight’s Vision AI does not currently offer Facial Recognition, and Offsight does not use Customer Data to create a faceprint, face template or other biometric template of any individual. A photograph or other Visual Data is not in itself Biometric Data, unless a law that applies treats it as such. Whether any Customer Data is Biometric Data therefore depends on the laws that apply to you, to a Site or to a Monitored Individual, and on how you use the Service. This section applies to any Customer Data that is Biometric Data, from the time it is collected until it has been destroyed.

• Your releases. Where a law that applies requires it, you meet the Biometric Release Requirements before any Biometric Data is collected. Your notices, consents and releases name Offsight and its Sub-processors as recipients and processors of the Biometric Data, including for Model Improvement.
• Standard of care. Offsight stores, transmits and protects Biometric Data using the reasonable standard of care in its industry, and in a manner at least as protective as the way it protects other confidential and sensitive information, including, for Biometric Data in your tenant, encryption in transit and at rest.
• Incidents. Offsight notifies you of any security incident affecting Biometric Data as section 14 describes.
• Retention. Biometric Data, including any Biometric Data in Training Copies, is subject to the Biometric Data retention and destruction policy in the Privacy Policy, which states the limits the law sets.
• Requests. Offsight helps you respond to access, deletion and other requests from Monitored Individuals within the deadlines applicable law sets — for example, forty-five (45) days under Washington’s My Health My Data Act.

You remain responsible for your own biometric policies, notices, retention schedules and consents. Any use of the Service that creates Biometric Data is your decision and at your sole risk, and claims arising from it are Covered Claims under your indemnity (section 16).

10. Your instructions and warranties

You are responsible for the lawfulness of your instructions and of the Customer Data you submit. You represent and warrant, when you accept the agreement and for as long as any camera sends images to Vision AI, and you agree, that:

• you have obtained, and will maintain, every Required Authorization. That includes every notice and consent needed for Offsight to use Customer Data, including Visual Data that shows Monitored Individuals, for Model Improvement as the Terms of Service and this DPA describe;
• your notices to workers and others who may appear in Visual Data tell them that images are processed by Offsight as your vendor and are used by Offsight to train and improve its AI models;
• you have the right to connect each camera you connect to the Service and to submit the resulting Visual Data, including at a Site that someone else owns or controls, where any permission you need from the owner, and any notice owed to other employers and their workers, are Required Authorizations; and
• you will provide copies of your notices, consents, releases, assessments and policies on request, where Offsight reasonably needs them to respond to a claim, an individual or a regulator.

Offsight relies on these representations. It does not review or approve your notices, consents, camera placements or Vision AI configurations, and its use of Customer Data for Model Improvement does not shift any part of your responsibility for the Required Authorizations to Offsight.

11. Assistance and documentation

Taking into account the nature of the processing and the information available to it, Offsight will give you reasonable assistance with:

• your privacy risk assessments and cybersecurity audits under the California regulations, and the data protection and impact assessments other state laws require;
• your obligations on automated decision-making technology, by providing the facts about the Service that you reasonably need to meet them; and
• the information requests that Colorado and Connecticut law allow a deployer to make of a developer.

On request, Offsight will provide a documentation sheet for Vision AI covering its intended uses, its known limitations, the categories of data used to train Base Models, and guidance on human review. Output and Vision AI Results can be exported through the Service’s export functions or with Offsight’s assistance, so that you can meet your record-retention duties and individuals’ requests for their data.

This assistance does not change what the Service is for, or who is responsible for how you use it. Offsight does not design, market or offer Vision AI or the AI assistant for making Consequential Employment Decisions. If you use Output in one, you do so as the deployer and at your sole risk.

12. International transfers

Offsight is based in the United States and the Service is operated on infrastructure in the United States. If you operate a camera at a Site outside the United States, or otherwise transfer Personal Data to the Service from a jurisdiction that restricts such transfers, any notice, consent or other authorization the law there requires, and having the transfer mechanism that law requires in place before the transfer, are Required Authorizations. On your request, Offsight will enter into the transfer mechanism that law requires for its processing.

13. Data subject requests

As controller, you handle requests from your own people and from anyone else who appears in your Visual Data. Offsight will provide reasonable assistance — and the product itself does much of the work, since an administrator can search, export and delete records directly. On your instruction, Offsight will delete or correct the Personal Data you identify across Visual Data, detection overlays and training captures in your tenant. Where a data subject contacts Offsight about data in your tenant, we will direct them to you rather than act on your data without your instruction. A request about Training Copies or Offsight’s own use of Customer Data for Model Improvement is handled as the last paragraph of this section describes.

Visual Data is found by camera and time rather than by name, because Work-Area Activity Detection and Tools & Equipment Tracking do not identify the people in an image. Offsight will assist with that search; raw camera frames older than thirty days will already have been deleted. Requests that concern Individual Monitoring Data are handled in the same way.

Training Copies are Customer Data, and any Personal Data in them remains Personal Data. Where applicable law gives an individual a right that applies to Training Copies or to Offsight’s own use of Customer Data for Model Improvement, the individual may make the request to support@offsight.com, and Offsight will honor it to the extent the law requires. Aggregated Anonymous Data is not Personal Data. Because it cannot reasonably be linked to the person making a request, it is outside the scope of access, correction and deletion requests.

14. Incident notification

Offsight will notify the customer without undue delay after becoming aware of a personal data breach affecting Customer Data — including any breach affecting Training Copies, Biometric Data or Individual Monitoring Data — and will provide the information reasonably available to it so that the customer can meet its own notification obligations, together with reasonable cooperation in investigation and remediation.

15. Return and deletion

On termination, the customer can export Customer Data using the export functions of the Service, with assistance available. Once the export window has passed, Customer Data is deleted in accordance with the agreement, except Training Copies, which Offsight keeps for Model Improvement as section 4 describes. Note that Customer Data may be irretrievably deleted if an account is ninety (90) days or more delinquent.

For Visual Data, raw camera frames and detection overlay images are deleted automatically on the schedule in the processing particulars (section 3). Training captures and their markups, annotations and notes are deleted in accordance with the agreement at termination or on your request, except Training Copies. Removing a training capture in the product does not by itself immediately erase the stored image. Individual Monitoring Data follows the rule for the Visual Data, Output or other Customer Data it is made of. Biometric Data, if any, is also subject to the Biometric Data retention and destruction policy in the Privacy Policy.

Training Copies, Aggregated Anonymous Data, and the Base Models, Customer Models and other Offsight models trained with Customer Data are kept by Offsight after the agreement ends, and are not returned or deleted with Customer Data. Offsight’s models are not Customer Data. Training Copies remain subject to the Model Improvement Safeguards for as long as Offsight keeps them. Any Biometric Data in Training Copies is destroyed as the Biometric Data retention and destruction policy requires.

16. LIABILITY AND INDEMNITY

EACH PARTY’S LIABILITY ARISING OUT OF OR RELATING TO THIS DPA IS SUBJECT TO THE LIMITATIONS AND EXCLUSIONS IN THE TERMS OF SERVICE SECTION ENTITLED “LIMITATION OF LIABILITY,” INCLUDING ITS EXCLUDED CLAIMS, AS IF THIS DPA WERE PART OF THE TERMS OF SERVICE.

AS THE TERMS OF SERVICE SECTION ENTITLED “CUSTOMER INDEMNITY” PROVIDES, YOU WILL DEFEND, INDEMNIFY AND HOLD HARMLESS THE OFFSIGHT INDEMNITEES FROM AND AGAINST EVERY COVERED CLAIM AND ALL LOSSES ARISING FROM IT. “COVERED CLAIMS” AND “LOSSES” HAVE THE MEANINGS GIVEN IN THE TERMS OF SERVICE SECTION ENTITLED “CUSTOMER INDEMNITY,” WHICH CONTROLS. THAT OBLIGATION APPLIES IN FULL TO PROCESSING OFFSIGHT PERFORMS UNDER THIS DPA AND TO MODEL IMPROVEMENT. IT APPLIES EVEN IF THE COVERED CLAIM ALLEGES, OR THE LOSS IS CAUSED IN PART BY, THE ACTIVE OR PASSIVE NEGLIGENCE, STRICT LIABILITY OR STATUTORY VIOLATION OF AN OFFSIGHT INDEMNITEE. IT DOES NOT APPLY ONLY TO THE EXTENT A LOSS IS FINALLY DETERMINED TO HAVE BEEN CAUSED BY (I) THE FRAUD, GROSS NEGLIGENCE OR WILLFUL MISCONDUCT OF AN OFFSIGHT INDEMNITEE, (II) OFFSIGHT’S BREACH OF ITS SECURITY OBLIGATIONS OR OF THE MODEL IMPROVEMENT SAFEGUARDS, OR (III) AN ACT OR OMISSION FOR WHICH APPLICABLE LAW, INCLUDING COLORADO REVISED STATUTES SECTION 6-1-1707(7), DOES NOT PERMIT INDEMNIFICATION. NOTHING IN THIS DPA LIMITS THAT OBLIGATION. IT IS UNLIMITED, IS NOT SUBJECT TO ANY CAP, LIMITATION OR EXCLUSION OF LIABILITY IN THE TERMS OF SERVICE OR THIS DPA, AND SURVIVES THE TERMINATION OR EXPIRATION OF THE AGREEMENT, OF THIS DPA AND OF EVERY ORDER FORM.

OFFSIGHT HAS NO RESPONSIBILITY AND NO LIABILITY TO YOU FOR ANY LOSS ARISING FROM INDIVIDUAL MONITORING, FROM ANY OTHER USE OF VISION AI INVOLVING INDIVIDUALS, FROM YOUR PLACEMENT OR CONFIGURATION OF CAMERAS, FROM ANY DECISION YOU MAKE ABOUT AN INDIVIDUAL, OR FROM YOUR FAILURE TO COMPLY WITH MONITORING LAWS OR TO OBTAIN THE REQUIRED AUTHORIZATIONS, INCLUDING ANY SUCH LOSS ALLEGED TO ARISE FROM OFFSIGHT’S NEGLIGENCE, EXCEPT TO THE EXTENT CAUSED BY OFFSIGHT’S FRAUD, GROSS NEGLIGENCE OR WILLFUL MISCONDUCT, OR BY OFFSIGHT’S BREACH OF ITS SECURITY OBLIGATIONS OR OF THE MODEL IMPROVEMENT SAFEGUARDS.

Offsight remains responsible to you for performing its own obligations as processor under this DPA, its security obligations and the Model Improvement Safeguards (section 4), subject to the Terms of Service section entitled “Limitation of liability.” None of these responsibilities narrows your defense and indemnity obligations or the allocation of risk above.

NOTHING IN THIS DPA OR THE TERMS OF SERVICE EXCLUDES OR LIMITS ANY LIABILITY, OR WAIVES ANY RIGHT, THAT CANNOT BE EXCLUDED, LIMITED OR WAIVED UNDER APPLICABLE LAW, INCLUDING CALIFORNIA CIVIL CODE SECTION 1668. EACH PROVISION OF THIS DPA THAT ALLOCATES RISK OR LIABILITY APPLIES TO THE FULLEST EXTENT THE LAW ALLOWS. THIS DPA DOES NOT WAIVE ANY RIGHT OF A MONITORED INDIVIDUAL OR OTHER THIRD PARTY THAT CANNOT BE WAIVED BY CONTRACT.

SECTIONS 8, 9, 10, 15 AND 16, AND THE SUBSECTION OF SECTION 4 ENTITLED “MODEL IMPROVEMENT,” SURVIVE ANY TERMINATION OR EXPIRATION OF THE AGREEMENT OR OF THIS DPA. OFFSIGHT’S CONFIDENTIALITY, SECURITY AND DELETION OBLIGATIONS UNDER THIS DPA CONTINUE FOR AS LONG AS IT HOLDS CUSTOMER DATA.

17. Changes to this DPA

Offsight may update this DPA as the Terms of Service section entitled “Changes to these Terms” provides. Offsight will give notice of a Material Change at least thirty (30) days before it takes effect, by email to your Authorized Administrators and/or by notice in the Service or on Offsight’s website. A Material Change takes effect at the end of that notice period, and your continued use of the Service after it takes effect is your acceptance of it. Other updates take effect when Offsight posts them or gives notice of them. If you do not agree to an update, your remedy is to stop using the Service and terminate the affected Order Form before the update takes effect, and Offsight will refund any prepaid fees for the remainder of its term. An update does not apply to a dispute that arose before it took effect.

If a DPA, Order Form or other agreement signed by both you and Offsight conflicts with an update, the signed agreement controls for its term. A signed DPA changes only as it provides.

Model Improvement applies from the Model Improvement Effective Date, as the Terms of Service section entitled “Model Improvement” defines it, to all Customer Data that Offsight holds on that date and to all Customer Data provided after it.

18. Contact

Questions about this policy: support@offsight.com. Contract questions: sales@offsight.com.

Offsight Inc.
650 California St
San Francisco, California 94108