Data Processing Agreement

Introduction

This Data Processing Agreement (the "DPA") is an annex to the Scalign Terms of Service and forms an integral part of the agreement between you (the "Data Controller") and Scalign AS (the "Data Processor"). The DPA governs the processing of personal data by Scalign on behalf of the Data Controller in connection with the services provided under the Terms of Service.

Definitions

"Applicable Data Protection Laws" means the EU General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Norwegian Personal Data Act, and, where applicable, the UK GDPR, together with any implementing legislation.
"Personal Data" means any information relating to an identified or identifiable natural person.
"Processing" means any operation or set of operations performed on Personal Data, whether or not by automated means.

“Third Party Services” means any external sources, services, platforms, or applications with which the Data Controller chooses to integrate the Service, and from which Personal Data may be retrieved or to which Personal Data may be sent.

Scope and purpose

The Data Processor shall process Personal Data solely for the purpose of providing the services described in the Terms of Service and in accordance with the Data Controller's documented instructions. The Terms of Service, this DPA, and the Data Controller's configuration and use of the Service constitute the documented instructions. The Data Processor shall inform the Data Controller without undue delay if, in its opinion, an instruction infringes Applicable Data Protection Laws. The Data Processor shall not use Personal Data to train machine-learning models.

Data Controller's obligations

The Data Controller shall ensure that Personal Data provided to the Data Processor is collected and processed in accordance with applicable data protection laws. The Data Controller is responsible for the accuracy, quality, and legality of Personal Data and the means by which it was acquired.

The Data Controller is solely responsible for determining and documenting the lawful basis for processing Personal Data, including obtaining any required consents from data subjects for the recording, analysis, and use of conversation data and synced email. Scalign does not obtain consent on behalf of the Data Controller.

The Data Controller shall provide documented instructions to the Data Processor regarding the processing of Personal Data and shall ensure that such instructions comply with applicable laws and regulations. The Data Controller shall promptly inform the Data Processor of any changes to the processing of Personal Data that may affect the Data Processor’s obligations under this DPA.

Third party integrations

The Data Controller may integrate the Service with Third Party Services and, as a result, retrieve data from and send data to such third parties. The Data Controller is responsible for ensuring that any Personal Data shared with or received from Third Party Services via such integrations is processed in accordance with applicable data protection laws and the terms of this DPA. The Data Processor shall process Personal Data obtained through such integrations solely for the purpose of providing the Service and in accordance with the Data Controller’s documented instructions.

Details of processing

Subject Matter and Duration: The processing of Personal Data shall be carried out for the duration of the Terms of Service.
Types of Personal Data: Names and contact information (email, phone number, etc.), meeting recordings (audio/video), transcripts and transcript metadata, calendar data, email exchanged with the Data Controller's customer contacts where the Data Controller enables email sync, data from open web sources, and any other Personal Data relevant to the Service. This may include Personal Data retrieved from or sent to Third Party Services as directed by the Data Controller.
Categories of Data Subjects: Users and employees of the Data Controller; participants in recorded meetings, including external participants who are not users of the Service; senders, recipients and persons mentioned in synced email; employees and representatives of the Data Controller's prospects, customers, and business partners; and other Data Subjects relevant to the Service.
Nature and Purpose of Processing: Collection, recording, structuring, storage, retrieval, consultation, use, analysis, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, and destruction.

Data processor obligations

The Data Processor shall implement appropriate technical and organizational measures to protect Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, damage, alteration, or disclosure. The measures in place are described in Annex II (Technical and Organisational Measures), which forms part of this DPA.

The Data Processor shall ensure that any personnel authorized to process Personal Data are subject to confidentiality obligations.

The Data Processor shall assist the Data Controller in ensuring compliance with applicable data protection laws, including responding to data subject requests and conducting data protection impact assessments.

The Data Processor shall notify the Data Controller without undue delay and in any event within seventy-two (72) hours of becoming aware of a Personal Data breach affecting the Data Controller's Personal Data, and shall provide all information reasonably necessary to support the Data Controller's compliance with its breach-notification obligations, including the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed to address it.

For the purposes of this clause, the Data Processor is deemed to have become aware of a Personal Data breach when it has established, with a reasonable degree of certainty, that a security incident has occurred that led to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data. A preliminary indication or unverified alert that is still under investigation does not by itself constitute awareness, provided the Data Processor investigates without undue delay.

The Data Processor shall not be responsible for the processing of Personal Data by Third Party Services integrated by the Data Controller, except to the extent that such processing is carried out by the Data Processor on behalf of the Data Controller within the scope of the Service.

Sub-processors

The Data Processor has the Data Controller’s prior general written authorization to engage sub-processors to assist in the processing of Personal Data. The Data Processor maintains a current list of sub-processors at https://www.scalign.ai/legal/sub-processors, updated whenever a sub-processor is added or replaced. The Data Controller has the right, on request to hello@scalign.ai, to be notified of such changes by email. The Data Controller may object to a change on reasonable data-protection grounds; the parties shall then discuss the objection in good faith, and if it is not resolved, the Data Controller may terminate the affected Services without penalty. The Data Processor shall ensure that any sub-processors are bound by obligations consistent with this DPA.

Data subject rights

The Data Processor shall promptly notify the Data Controller of any requests received from data subjects exercising their rights under applicable data protection laws.

Audit rights

The Data Controller shall have the right to conduct audits or inspections to verify the Data Processor's compliance with this DPA.

The Data Processor shall provide all necessary information and access to facilities to facilitate such audits. As an alternative, the Data Processor may provide a third party audit report.

International transfers

Where the Data Processor transfers Personal Data outside the EEA, such transfers are carried out under an appropriate transfer mechanism under Chapter V of the GDPR, namely: (a) the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), incorporated into the Data Processor's agreements with the relevant sub-processors; (b) the UK International Data Transfer Addendum where the UK GDPR applies; or (c) an applicable adequacy decision. For transfers relying on the Standard Contractual Clauses, the Data Processor carries out and maintains transfer impact assessments and applies supplementary technical and organizational measures, including encryption in transit and at rest, as appropriate. A current list of sub-processors and their processing locations is maintained on the sub-processors page (www.scalign.ai/legal/sub-processors).

Where Personal Data is transferred to or from Third Party Services integrated by the Data Controller, the Data Controller is responsible for ensuring that such transfers comply with applicable data protection requirements.

Liability

The liability of each party under or in connection with this DPA is subject to the exclusions and limitations of liability set out in the Terms of Service, including the exclusion of indirect and consequential damages and the aggregate liability cap. The limitations and exclusions in the Terms of Service and in this DPA are not cumulative. The parties' total aggregate liability arising out of or in connection with the Terms of Service and this DPA, taken together, is subject to a single aggregate cap as set out in the Terms of Service.

Nothing in this DPA or the Terms of Service limits or excludes either party's liability to the extent that such liability cannot be limited or excluded under applicable law, including any liability to a data subject or a supervisory authority under Applicable Data Protection Laws, or liability arising from gross negligence or wilful misconduct. As between the parties, liability in respect of claims by data subjects or supervisory authorities shall be apportioned according to each party's respective responsibility for the harm caused.

Term and termination

This DPA shall remain in effect for the duration of the Terms of Service. Upon termination, the Data Processor shall, at the choice of the Data Controller, return or delete all Personal Data. Personal Data is deleted through the Data Processor's managed deletion process within thirty (30) days of termination (or, where return is requested, of the return), except where retention is required by law; copies in encrypted backups expire within a further forty-two (42) days. The Data Processor shall confirm deletion in writing on request.

Governing law

This DPA shall be governed by and construed in accordance with Norwegian law.