When we say "you", "your" or "Data Subject" we mean any natural person that shares personal data with us via Website.
When we say "processing" we mean any operation or set of operations which is performed on personal data or sets of personal data. This includes activities such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
When we say "Data Processors" or "processor" we mean any natural or legal person who processes the data on behalf of the Data Controller. In some cases, ScaleRoad is a Data Processor and in others, Data Controller (as further explained in Section 2). In addition, we may use the services of various service providers to process your data more effectively. In such cases, they are either our processors or sub-processors.
When we say "consent" we mean your explicit consent on the processing of personal data. Persons who are 15 years of age or older may give free consent to the processing of their personal data.
In relation to your personal data processed on or via the Website and the Service, ScaleRoad may be either a Data Controller or Data Processor.
We may collect and receive information about you in various ways:
1. Information you provide through the use of the Service (for example, by creating the ScaleRoad account).
|DATA WE COLLECT||PURPOSE||LEGAL BASIS||RETENTION|
|Email address, password, name, time zone and sometimes profile photo|
(if the User decides to provide such personal data)
The User will also obtain the User ID so that we can identify that User in the future.
|Creating and maintaining a User Account on the Website according to the Terms of Service.||Processing is necessary for the performance of the Agreement (as defined in Section 1 of the Terms of Service). Without providing an email address, password and time zone, the User may not create the User Account.||Until the account is deleted in accordance with the Terms of Service.|
Such as name, address, bank account and payment card details. The payer may not be the User subscribing to the Paid Plan, so it is possible to receive the information from another User.
|When subscribing to any of the Paid Plans or when changing any Paid Plan in accordance with the Terms of Service, this information is being collected by a third party processor.||Processing is necessary for the User’s performance of the Agreement which includes providing Additional Features based on the selected Paid Plan.||We keep only the last four digits of the credit card number under subscription billing info until such Agreement is terminated and for the period necessary to comply with the applicable financial and tax accounting and other statutory obligations in accordance with the applicable law.|
i.e., the data you decide to share with us.
|If you send us an inquiry at firstname.lastname@example.org or otherwise request support, we will collect data you decide to share with us.||Processing of personal data is either necessary to provide a Service or part thereof, or the processing is based on your consent.||If the processing is based on your consent, we keep the information until you withdraw your consent or for one year, whichever date comes first.|
If you decide to sign up for our newsletter, we use your email address.
|This newsletter allows us to inform you of the new features of the Service, updates, as well as other news relevant to the company.||Processing is based on your consent. You have the right to withdraw your consent at any time, without affecting the lawfulness of the processing based on consent prior to such withdrawal. You may unsubscribe from receiving a newsletter from us. If you wish to do so, simply follow the instructions found at the end of each email.||We may use your email for this purpose until you unsubscribe or until you delete your User Account.|
(when provided by other Users)
|Users may invite non-users via ScaleRoad to join their team, in which case they provide the non-user’s email address.||Processing is necessary for the performance of the Agreement between us and the User who provided the information and it is also in the User’s legitimate interest.||After sending the message to you we do not keep your personal data unless you decide to become a User, in which case other purposes apply.|
|Other personal data||For the prevention and detection of fraud, money laundering or other crimes or to respond to a binding request from a public authority or court.||The processing is necessary to comply with legal and regulatory obligations.||In accordance with the applicable statutory deadlines.|
As previously stated, concerning your personal data processed on or via the Service, ScaleRoad is a Data Processor and the Owner of the ScaleRoad account is the Data Controller. ScaleRoad processes personal data following instructions from the Data Controller and under the Terms of Service. The purpose of such personal data processing is primarily for providing a reliable Service as well as user experience optimization.
As a processor, ScaleRoad is permitted to collect, use, disclose and/or otherwise process your personal data only following the instructions of the owner (admin) of the ScaleRoad account.
ScaleRoad will never:
— Sell any kind of personal information or data
— Disclose this information to marketers or third parties not specified in Section 7
We take administrative, technical, organizational and other measures to ensure the appropriate level of security of personal data we process. Upon assessing whether a measure is adequate and which level of security is appropriate, we consider the nature of the personal data we are processing and the nature of the processing operations we perform, the risks to which you are exposed by our processing activities, the costs of the implementation of security measures and other relevant matters in the particular circumstances.
Some of the measures we apply include access authorization control, information classification (and handling thereof), protection of integrity and confidentiality, data backup, firewalls, data encryption and other appropriate measures. We equip our staff with the appropriate knowledge and understanding of the importance and confidentiality of your personal data security.
ScaleRoad utilizes external processors for certain processing activities. We use information audits to identify, categorize and record all personal data that is processed outside the company, so that the information, processing activity, processor and legal basis are all recorded, reviewed and easily accessible.
We have strict due diligence procedures and measures in place and review, assess and background check all processors prior to forming a business relationship. We obtain company documents, certifications, references and ensure that the processor is adequate, appropriate and effective for the task we are employing them for.
We audit their processes and activities prior to contract and during the contract period to ensure compliance with the data protection regulations and review any codes of conduct that oblige them to confirm compliance.
This is the list of processors and sub-processors with whom we share your personal data:
|The Rocket Science Group, LLC (MailChimp)||Email services based on Cloud||USA|
|Formspree, Inc.||Contact form submissions||USA|
|Amazon Web Services, Inc.||Cloud Infrastructure as a Service (IaaS)||USA|
|MongoDB, Inc.||Managed database service in the cloud||USA|
|Render Services, Inc.||Cloud application hosting||USA|
|Netlify, Inc.||Static website hosting||USA|
|SendGrid, Inc.||Email services based on Cloud||USA|
|Stripe, Inc.||Payment provider||USA|
|PayPal Holdings, Inc.||Payment provider||USA|
|Paddle Ltd.||Merchant of record||UK|
We may also share your personal data with our outside accountants, legal counsels and auditors.
Please keep in mind that, subject to your instructions to us while using the Service, your data may be shared with third parties in the following situations:
— If you join another user's team;
— If you invite another user to join your team;
— If you invite a non-user to join ScaleRoad;
— If you decide to share user content from your account to persons who do not have an account on ScaleRoad by providing links to such user content.
We may transfer your personal data to countries other than the one you reside in. Given that we follow internal rules for the protection of personal data that are stricter than the applicable law, in these cases, we transfer your personal data only:
1. To the countries within the EEA;
2. To the countries which ensure an adequate level of protection;
3. To the countries which do not belong to those specified under items 1. and 2., but only by applying the appropriate safeguard measures.
The period for which we store your personal data depends on a particular purpose for the processing of personal data, as explained in detail in Section 4. We retain personal data for as long as we reasonably require it for legal or business purposes. In determining data retention periods, we take into consideration the applicable law, contractual obligations, and the expectations and requirements of our Users. When we no longer need personal information, or when you request us to delete your information, where this is legal, we will securely delete or destroy it.
However, as an exception to the retention periods in Section 4 the data may be processed to determine, pursue or defend claims and counterclaims.
Given that transparency is one of our cornerstone principles, we grant Data Subjects certain rights in relation to their personal data. These rights may be exercised by Data Subject when ScaleRoad operates as a Data Controller.
You can send us a request for a copy of the personal data we hold about you.
We have ensured that appropriate measures have been taken to provide such in a concise, transparent, intelligible and easily accessible form, using clear and plain language. Such information is provided in writing free of charge. It may be provided by other means when authorized by the Data Subject and with prior verification as to the subject's identity.
Information is provided to the Data Subject at the earliest convenience, but at a maximum of 30 days from the date the request was received. Where the retrieval or provision of information is particularly complex or is subject to a valid delay, the period may be extended by two further months where necessary.
If the personal data we have about you is incorrect, you have the right to request that we correct those data. Where notified of inaccurate data by the Data Subject, we will rectify the error within 30 days and inform any third party of the rectification if we have disclosed the personal data in question to them.
You have the right to request from us that your personal data is deleted in certain circumstances including:
— The personal data are no longer needed for the purpose for which they were collected;
— You withdraw your consent (where the processing was based on consent);
— You object to the processing and no overriding legitimate grounds are justifying us processing the personal data;
— The personal data have been unlawfully processed; or
— To comply with a legal obligation.
However, this right does not apply where, for example, the processing is necessary:
— To comply with a legal obligation; or
— For the establishment, exercise or defense of legal claims.
If the accuracy of the personal data is contested, you consider the processing is unlawful but you do not want it erased, we no longer need the personal data but you require it for the establishment, exercise or defense of legal claims or you have objected to the processing and verification, you can exercise your right to the restriction of processing.
Where you have provided personal data to us, you have the right to receive such personal data back in a structured, commonly used and machine-readable format, and to have those data transmitted to a third-party Data Controller without hindrance but in each case only where:
— The processing is carried out by automated means; and
— The processing is based on your consent or the performance of a contract with you.
If you have provided your consent to the collection, processing and transfer of your personal data, you have the right to fully or partly withdraw your consent. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose(s) to which you originally consented unless there is another legal ground for the processing.
If you have any concerns or requests in relation to your personal data, please contact us at email@example.com and we will respond as soon as possible but not later than within 30 days.
Effective as of 31/03/2021