Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service or other written agreement (the “Agreement”) between Scale, a Ventureship company (“Scale”), and the customer that uses Odin (“Customer”).

It applies where Scale processes personal data on Customer's behalf in providing Odin, and where data protection laws such as the GDPR, UK GDPR, Swiss data protection law or US state privacy laws (“Data Protection Laws”) apply. For that processing, Customer is the controller and Scale is the processor (or service provider).

• Subject matter: providing the Odin desktop agent, cloud workspace, specialists, memory, swarms, portfolios and related support.
• Duration: the term of the Agreement, plus the period until deletion described below.
• Nature and purpose: hosting, storing, analyzing and otherwise processing Customer data to perform tasks and provide the Service as instructed.
• Categories of data subjects: Customer's authorized users, and individuals whose information appears in Customer content or on screen during tasks.
• Categories of personal data: account and contact details, workspace content, task records, screen data captured during tasks, device information and usage data. Customer should not submit special category data unless it has assessed that doing so is appropriate.

Scale will process personal data only on Customer's documented instructions, which are set out in the Agreement, this DPA and Customer's use and configuration of the Service, unless the law requires otherwise. Scale will tell Customer if it believes an instruction infringes Data Protection Laws. Scale will not sell Customer personal data or use it for purposes outside the Agreement.

The desktop agent captures screen data only when an authorized user starts a task, and uses it to perform that task. Users can stop tasks, turn screen access off and disconnect devices at any time. Customer is responsible for informing its users about appropriate use and for configuring policies, such as preferring Guide mode for sensitive systems.

Scale ensures that personnel authorized to process personal data are bound by confidentiality obligations and access it only as needed to provide, secure and support the Service.

Scale implements appropriate technical and organizational measures, including:

• encryption of data in transit;
• access controls based on least privilege, with authentication for administrative access;
• device approval for every computer connected to an account;
• logging and monitoring of security-relevant events;
• rate limiting and abuse protection;
• secure development and change review practices; and
• incident response procedures.

Scale may update these measures over time, provided the overall level of protection is not materially reduced.

Customer authorizes Scale to engage subprocessors to help provide the Service. Scale imposes data protection terms on each subprocessor that are no less protective than this DPA and remains responsible for their performance. A current list of subprocessors is available on request through our contact page. Scale will give notice of new subprocessors, and Customer may object on reasonable data protection grounds, in which case the parties will work in good faith to resolve the objection.

Taking into account the nature of the processing, Scale will help Customer respond to requests from individuals exercising their rights, and will provide reasonable assistance with data protection impact assessments and consultations with supervisory authorities. If Scale receives a request directly, it will refer the individual to Customer where appropriate.

Scale will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer personal data, and will provide information reasonably available to help Customer meet its own obligations. Scale will take reasonable steps to contain and remediate the breach.

Where personal data is transferred outside the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, the parties agree that the applicable standard contractual clauses, and any required addendum, are incorporated into this DPA by reference, with Customer as data exporter and Scale as data importer.

On termination of the Agreement, Scale will delete or return Customer personal data within a reasonable period, unless the law requires it to be kept. Customer can export or delete much of its content through the Service before termination.

Scale will make available information reasonably necessary to demonstrate compliance with this DPA. Where that information is not sufficient and an audit is required by Data Protection Laws, Customer may request one on reasonable notice, no more than once a year, at Customer's cost, subject to appropriate confidentiality and without access to other customers' data.

Each party's liability under this DPA is subject to the limitations in the Agreement, to the extent permitted by law. If this DPA conflicts with the Agreement, this DPA prevails for the processing of personal data. If the standard contractual clauses apply and conflict with this DPA, the clauses prevail.

To request a countersigned copy of this DPA, the subprocessor list or other information, contact Scale, a Ventureship company, through our contact page.