Data Processing Addendum

Scope and instructions

This Addendum forms part of the Terms between ScalePointer.io LLC and the Customer for personal data processed on the Customer’s behalf in Engagement. The Customer is a controller or a processor acting for its own clients; ScalePointer acts as processor or subprocessor accordingly. The Customer must have authority to give its instructions and appoint us. Account administration and our independent payment, security or legal processing are addressed in the Privacy Notice.

The subject matter is provision of business collaboration and file storage. Processing includes receiving, organizing, storing, displaying, transmitting, exporting and deleting records and files. It continues during authorized use and deletion processing. Data subjects can include the Customer’s staff, client contacts and invited collaborators. Data can include names, business contact details, roles, project communications, task records, audit information and authorized file contents. Restricted sensitive data is excluded under the Acceptable Use Policy.

The agreement, configured permissions and authorized actions in the app constitute documented instructions, including the fixed 90-day project deletion rule. We will process Customer personal data only on those instructions, unless law requires otherwise, in which case we will inform the Customer where legally permitted. We will notify the Customer if we believe an instruction infringes applicable data-protection law and may pause the affected processing while it is resolved.

Confidentiality and safeguards

We will restrict access to personnel who need it and are bound by confidentiality, and maintain appropriate technical and organizational measures taking account of the nature and risks of the processing. Current measures include HTTPS, verified TLS for production database connections and SMTP transport to SES, encrypted EC2 storage, private S3 storage with AWS KMS encryption, scoped application permissions, tenant access controls, restricted deployment access, and task-level audit records.

The Customer manages its users, access decisions, lawful instructions and independent exported copies. This is shared infrastructure with logical separation, not a dedicated database or customer-held encryption key for each client. No service-level, recovery-time, backup, end-to-end encryption or security certification is represented by this Addendum. Safeguards do not remove the need to assess whether a short-retention collaboration service is suitable for the intended data.

Other processors and international transfers

The Customer authorizes Amazon Web Services as the hosting, file-storage, key-management, email-delivery and operational-logging subprocessor. The configured production region is us-east-1, United States. Stripe receives subscription and payment information as described in the Privacy Notice; its independent payment activities are governed by its own terms. It is not a repository for project files.

Before adding or replacing a subprocessor for Customer personal data, we will give at least 30 days’ written notice, except that an urgent security or continuity change may require shorter notice with explanation. The Customer may object on reasonable data-protection grounds. We will work to resolve the concern; if no reasonable solution is available, the Customer may end the affected service and receive a refund for unused prepaid service for that affected portion. We will impose data-protection obligations appropriate to the delegated processing and remain responsible for our subprocessors’ performance of those obligations.

Processing and authorized support access may involve transfers between countries. Where the Customer’s data requires EU standard contractual clauses, a UK transfer addendum or another specific safeguard, the parties must arrange the appropriate instrument and complete its required details before that transfer. Acceptance of this Addendum alone does not execute those instruments or certify compliance with every country’s requirements.

Requests, incidents and cooperation

Taking account of the processing and information available to us, we will reasonably assist the Customer with applicable individual-rights requests, security duties, impact assessments and consultations with supervisory authorities. We will notify the Customer of requests concerning its data unless prohibited by law, and will not independently decide the Customer’s response except as required by law.

We will notify the Customer without undue delay after becoming aware of a personal-data breach affecting its data and provide available information about the nature, likely effects, affected data and response measures, supplementing it as the investigation proceeds. Notice is not an admission of fault. The Customer determines its required notices to individuals and authorities, unless law requires us to act independently.

We will make reasonably necessary information available to demonstrate compliance with this Addendum and cooperate with proportionate audits or inspections required by applicable law, subject to safeguards for security, confidentiality and other tenants. Administrative coordination must not prevent a legally required audit. Requests should be directed to hello@scalepointer.com.

Return, deletion and responsibility

Customers can export project records and files during authorized access, including read-only access, only before each project’s fixed 90-day deadline. The Customer instructs deletion at that deadline on every plan. Download in advance if a return copy is needed. After termination, on request and subject to the same deadline, we will assist with return or deletion of remaining Customer personal data and removal of remaining copies, unless law requires retention. We cannot return data already deleted under the agreed schedule.

Project expiry does not automatically delete account, billing or agreement records processed for our separate business purposes. Such records are subject to the Privacy Notice and applicable law. The Terms’ liability provisions apply to the extent lawful, without restricting a person’s statutory rights or either party’s non-excludable data-protection responsibilities. If the Addendum conflicts with the Terms on processing Customer personal data, this Addendum controls.