Data processing addendum outline

Roles of the parties

The customer is the controller of the files it uploads. That means the customer decides why and how those files are used.

Scopereader acts as processor. That means it handles the files on the customer's behalf, to provide the service. [for lawyer] Role wording, and whether other roles apply to account data.

Subject matter and duration

Subject matter: storing, processing and indexing uploaded construction documents so the customer can search them.

Duration: while the customer has an account, plus the time needed to remove copies. [for lawyer] Term, end date and what happens at the end.

Types of data

• Uploaded construction documents: specifications, drawings and addenda. We also keep what is extracted from them, such as text, section list, sheet list and search index.
• The account email.

[for lawyer] Whether the documents can hold personal data, which groups of people it could concern, and how to describe that.

Security measures

This outline points to the seven statements on the security page. It adds none.

• Local mode does not upload files
• Hybrid post-quantum key exchange, when the browser supports it
• Files are encrypted at rest with AES-256
• Each customer's data is separated at the database level
• We don't use your documents to train AI
• Deletion on request
• What we do not accept in the hosted product

Those statements are a draft, pending verification. No certifications or audit reports are claimed. [for lawyer] How security measures are described in the addendum.

Subprocessors

Outside providers help run the service. The draft list names each one, what it does and what data it may handle.

[for lawyer] Whether the customer approves new providers or may object, and how.

Help with requests

If someone asks the customer about data held in the service, we would help the customer find it. We would help with the answer as far as the service allows.

[for lawyer] Scope of help, time limit, cost and how requests reach us.

Deletion on request

Ask us to delete your data and we will. This page does not give a deletion time. [for lawyer] Time limit, backups and written confirmation.

Return of data

The customer already holds the original files it uploaded. [to be confirmed] Whether we offer an export of the index or other data, and in what form.

[for lawyer] Return terms and timing.

Audit and information requests

The customer may ask how its data is handled, and we would answer. No audit reports are claimed.

[for lawyer] Audit rights, notice, cost and confidentiality.

Left out on purpose

[for lawyer] Breach notice, transfers between countries, liability, governing law, signatures and the effective date. None is drafted here, and none is claimed.

Contact: [contact address to be added]