Data Processing Addendum

The roles

For data you put into the platform, you are the controller and we are the processor. You decide what personal data to process and why; we process it to provide the service and for nothing else. For your own account data — who signed up, who was billed — we are the controller.

What we do with it

• ·Process it only to provide the platform, and only on your instructions.
• ·Keep it confidential, and bind our staff and sub-processors to the same.
• ·Apply the technical and organisational measures described in the security overview.
• ·Help you respond to requests from the people whose data it is.
• ·Tell you about a personal data breach without undue delay, with what we know at the time rather than waiting for a complete picture.
• ·Return or delete it when the agreement ends, at your choice.

Sub-processors

We use a small number of sub-processors to provide the platform. They are listed on the sub-processors page, which is the authoritative list. We will give notice before adding one, and you may object on reasonable data-protection grounds.

International transfers

Where personal data moves out of its region of origin, the transfer relies on the standard contractual clauses incorporated into the addendum, together with the supplementary measures described there. You choose the region your workloads run in, which is the primary control over where data sits.

Audits

You may audit our compliance with this addendum, at reasonable intervals and on reasonable notice, and we will answer security questionnaires as part of that. Where we hold a current third-party report we will provide it; where we do not, we will say so rather than imply otherwise.

Getting it signed

Write to legal@scaleai.markets. If your organisation has its own addendum you would rather use, send it; we would rather read yours than argue about ours.