Data processing agreement

1. Parties and roles

This agreement is made between the customer identified in Annex I, Part A (the Controller) and the Scout Lane entity identified in Annex I, Part A (the Processor).

It applies to all processing of personal data that the Processor carries out on behalf of the Controller in providing the Scout Lane service under the terms of service (the "Principal Agreement"), and forms part of that agreement.

Where the Processor determines its own purposes — account administration, billing, security, its own website — it acts as controller, and the privacy policy governs instead. This agreement does not cover that processing.

2. Definitions

GDPR means Regulation (EU) 2016/679. Personal data, processing, controller, processor, data subject, personal data breach and supervisory authority carry the meanings given to them there. Sub-processor means a processor engaged by the Processor to carry out processing on behalf of the Controller.

3. Scope and duration

The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subject are set out in Annex I, Part B, as Article 28(3) requires.

This agreement takes effect when the Controller first uses the service, or on the date of signature below if it is executed separately, and continues for as long as the Processor processes personal data on the Controller's behalf. Clauses that by their nature should survive — confidentiality, deletion, liability — survive termination.

4. Documented instructions

The Processor processes personal data only on the Controller's documented instructions, including as to transfers to a third country, unless required to do otherwise by Union or member state law — in which case it informs the Controller of that requirement before processing, unless the law forbids it on important grounds of public interest.

The Controller's documented instructions are: this agreement, the Principal Agreement, and the configuration and actions the Controller and its authorised users perform inside the product — creating projects, uploading material, creating and scoping client logins, enabling downloads, deleting content.

The Processor informs the Controller if, in its opinion, an instruction infringes the GDPR or other data protection law, and may suspend that instruction until it is withdrawn or amended.

5. Personnel

The Processor ensures that every person authorised to process the personal data is bound by an obligation of confidentiality, is subject to appropriate training, and has access only to the data they need to do their job. Production access is limited to named individuals, is logged, and is withdrawn when it is no longer required.

6. Security measures

The Processor implements and maintains the technical and organisational measures set out in Annex II, which are designed to meet Article 32 having regard to the state of the art, the cost of implementation, and the nature, scope, context and purposes of the processing as well as the risk to data subjects.

Measures may be updated, provided the level of security is not reduced. The current measures are described in more detail on the security page.

7. Sub-processors

The Controller gives the Processor general written authorisation to engage sub-processors. Those currently engaged are listed in Annex III.

The Processor gives the Controller at least 30 days' notice by email before adding or replacing a sub-processor. The Controller may object on reasonable data protection grounds within that period; if the objection cannot be resolved, the Controller may terminate the affected part of the service and receive a pro-rata refund of prepaid fees.

The Processor imposes on each sub-processor, by contract, data protection obligations no less protective than those in this agreement, and remains fully liable to the Controller for the sub-processor's performance.

8. Data subject requests

Taking into account the nature of the processing, the Processor assists the Controller by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Controller's obligation to respond to requests to exercise data subject rights under Chapter III GDPR.

In practice most of this is self-service: the Controller can search, export, correct and delete material, gallery logins and viewing records from inside the product without asking us. Where a request cannot be met that way, the Processor helps within a reasonable period and at no charge for a proportionate volume of requests.

If a data subject contacts the Processor directly about data processed on the Controller's behalf, the Processor does not respond substantively. It forwards the request to the Controller without undue delay and tells the data subject that it has.

9. Further assistance

Taking into account the nature of the processing and the information available to it, the Processor assists the Controller in complying with Articles 32 to 36 GDPR: security of processing, breach notification to the supervisory authority and to data subjects, data protection impact assessments and prior consultation.

10. Personal data breach

The Processor notifies the Controller without undue delay, and in any event within 48 hours of becoming aware of a personal data breach affecting personal data processed on the Controller's behalf.

The notification describes, so far as it is known at the time:

• the nature of the breach, including the categories and approximate number of data subjects and records concerned;
• the likely consequences;
• the measures taken or proposed to address it and to mitigate its effects;
• a contact point for further information.

Where the full picture is not available within 48 hours, the Processor sends what it has and follows up in phases. The Processor does not notify a supervisory authority or a data subject on the Controller's behalf unless the Controller asks it to in writing.

11. Return and deletion

At the Controller's choice, the Processor deletes or returns all personal data processed on the Controller's behalf at the end of the provision of services, and deletes existing copies, unless Union or member state law requires it to be stored.

The mechanics, stated plainly:

• The workspace remains available in read-only form for 30 days after the service ends, so the Controller can export everything.
• After that period the workspace is deleted: the storage subtree holding the material is removed from disk and the database rows are deleted.
• Copies held in encrypted backups expire on a rolling 30-day cycle. Until they expire they are not accessible for any operational purpose and are used only for disaster recovery.
• The Processor certifies deletion in writing on request.

12. Audits

The Processor makes available to the Controller all information necessary to demonstrate compliance with Article 28, and allows for and contributes to audits, including inspections, conducted by the Controller or an auditor it mandates.

Audits are limited to once in any twelve-month period unless a breach or a supervisory authority makes another necessary, require 30 days' written notice, take place in working hours, must not disrupt the service or compromise another customer's confidentiality, and are subject to confidentiality undertakings. The Processor may satisfy an audit request by providing documentation, written answers or a current third-party report where that reasonably addresses the Controller's questions.

13. Transfers

Personal data processed under this agreement is stored and processed in Germany and is not transferred outside the European Economic Area, except as recorded in Annex III. Where a transfer to a third country does take place, it is made only under a valid Article 46 safeguard — in practice the European Commission's Standard Contractual Clauses — together with any supplementary measures the transfer risk assessment requires.

14. Liability and precedence

The liability provisions of the Principal Agreement apply to this agreement and to any claim arising from it.

If this agreement conflicts with the Principal Agreement on a data protection matter, this agreement prevails. If it conflicts with Standard Contractual Clauses entered into between the parties, those clauses prevail.