Data Processing Agreement

This Data Processing Agreement (DPA) forms part of the Terms of Service between Scoritz Limited, trading as RunYourBlock (we, the processor), and the company that subscribes for a block (you, the controller). It applies whenever we process personal data in your customer data. Words defined in the Terms of Service have the same meaning here.

1. Roles and scope

1. You are the controller and we are your processor for the personal data in your customer data, as described in Annex 1.
2. Each of us will comply with the UK GDPR and the Data Protection Act 2018 (together, data protection law).
3. You are responsible for having a lawful basis for the personal data you put into the Service and for giving residents the information data protection law requires (for example, in your company's privacy notice).

2. Instructions

1. We process personal data only on your documented instructions, including about transfers outside the UK, unless the law requires otherwise. If it does, we'll tell you first unless the law forbids that.
2. Your instructions are: these terms, the DPA, and the way you and your authorised users configure and use the Service.
3. We'll tell you straight away if we think an instruction breaks data protection law.

3. Confidentiality

Everyone we allow to process your personal data is bound by a duty of confidentiality, and has access only to the extent their role needs.

4. Security

1. We take the technical and organisational measures required by Article 32 of the UK GDPR, described in Annex 2 and on our security page.
2. We may improve these measures over time, but we won't reduce the overall level of protection.

5. Sub-processors

1. You give us general written authorisation to use the sub-processors listed on our sub-processors page.
2. We'll give the account owner at least 30 days' notice by email before adding or replacing a sub-processor that handles customer data. You may object on reasonable data protection grounds. If we can't resolve the objection, you may end the subscription before the change takes effect and we'll refund fees paid for the period after that.
3. We put data protection terms in each sub-processor contract that give the same level of protection as this DPA. We remain fully liable to you for our sub-processors.

6. Where data is processed

1. Customer data is hosted in the United Kingdom.
2. Some sub-processors process limited data elsewhere, as shown on the sub-processors page (for example, email delivery through Germany and Ireland). We only transfer personal data outside the UK where data protection law allows it: to a country the UK treats as adequate, to a recipient covered by UK adequacy regulations (such as the UK Extension to the EU-US Data Privacy Framework), or under the UK International Data Transfer Agreement or Addendum.

7. Helping you meet your obligations

1. Residents' rights. The Service lets you find, export, correct and delete personal data. If we receive a request from a resident about your customer data, we'll pass it to you promptly and won't respond to it ourselves except to say we've passed it on. We'll give you reasonable help to respond.
2. Security, breaches and assessments. We'll give you reasonable help with your security obligations, breach notifications, data protection impact assessments and any consultation with the regulator, taking into account the information available to us.

8. Personal data breaches

1. We'll tell you without undue delay, and in any case within 48 hours, after we become aware of a personal data breach affecting your customer data. This is so that you can decide whether to report it to the regulator, which must normally be done within 72 hours of a controller becoming aware of it.
2. We'll tell you what we know: what happened, the data and people likely to be affected, the likely consequences, and what we've done or propose to do. We'll update you as we learn more.
3. We'll take reasonable steps to contain the breach and reduce its effects.

9. Deleting or returning data

1. While your subscription is active, you can export your customer data at any time.
2. When the contract ends, you have 90 days to export your data (see the Terms of Service). We then delete customer data from our live systems within a further 30 days, and backups are overwritten within 35 days after that, unless the law requires us to keep it.
3. If you ask, we'll confirm in writing when deletion is complete.

10. Audits and information

1. We'll make available the information you reasonably need to show that we are meeting this DPA, such as our security documentation and answers to reasonable questionnaires.
2. If that isn't enough, you (or an independent auditor you appoint, who is bound by confidentiality) may audit our compliance once a year, with at least 30 days' notice, during working hours, in a way that doesn't disrupt the Service or put other customers' data at risk. Each side pays its own costs, unless the audit finds that we are in material breach.

11. Liability and precedence

1. The limits on liability in the Terms of Service apply to this DPA, except where data protection law does not allow that.
2. If this DPA conflicts with the Terms of Service about personal data, this DPA wins.
3. This DPA lasts as long as we process personal data for you, and is governed by the law of England and Wales.

Annex 1: details of the processing

Annex 2: security measures

• Encryption in transit for all connections (HTTPS with modern TLS).
• UK hosting of the app, its database and backups.
• Separation between blocks: each block's data is kept apart in the database by row-level security, and every request is checked against the block it belongs to.
• Strong sign-in: passwordless sign-in links or codes, with two-factor authentication required for account owners and directors.
• Least privilege: roles limit what each person can see and do. Our own staff don't access a block's data except to provide support you've asked for, or where needed to keep the Service secure or comply with the law.
• Audit trail: every change is recorded in a hash-chained log that shows if records have been altered.
• Backups: regular encrypted backups stored separately from the live system, with restore drills to prove they work.
• Secrets: sensitive values, such as two-factor keys, are encrypted in the database.
• Updates and testing: dependencies are kept up to date, and changes are tested automatically before release.
• Incident response: a documented process for investigating and reporting security incidents (see section 8).