Data processing agreement

This is a template outline. Enterprise customers who need a signed DPA should request one at legal@scoringfactory.ai — we'll send the current version for execution.

1. Roles

Where ScoringFactory processes personal data on Customer's behalf to provide the Service, Customer is the "Controller" (or "Business") and ScoringFactory is the "Processor" (or "Service Provider"), as those terms are defined under applicable data protection law (e.g. GDPR, CCPA).

2. Subject matter & duration

ScoringFactory processes personal data for the duration of the underlying subscription agreement, solely to provide the scoring service described there.

3. Nature and purpose of processing

Collection, enrichment, and analysis of publicly available and Customer-provided information about founders and candidates, for the purpose of generating evidence-backed scores for Customer's diligence or hiring decisions.

4. Categories of data

• Data subjects: founders under diligence, job candidates, and Customer's own personnel (account users).
• Data types: name, public professional history, public writing/media, and any additional information Customer submits about a data subject.

5. Processor obligations

• Process personal data only on documented instructions from Customer, unless required otherwise by law.
• Ensure personnel with access are bound by confidentiality obligations.
• Implement the security measures described in our Trust & security page.
• Assist Customer in responding to data subject requests and regulator inquiries where required.
• Notify Customer without undue delay after becoming aware of a personal data breach affecting Customer's data.
• Delete or return all personal data at the end of the engagement, subject to legal retention requirements.

6. Subprocessors

Customer authorizes ScoringFactory to engage the subprocessors listed on our Trust & security page. We'll give notice before adding a new subprocessor so Customer can object on reasonable grounds.

7. International transfers

Where personal data is transferred outside the EEA or UK, the parties incorporate the Standard Contractual Clauses (or another lawful transfer mechanism) by reference.

8. Audit rights

Customer may request evidence of ScoringFactory's compliance, including any available SOC 2 report or completed security questionnaire, once per year. On-site audits are available for cause, with reasonable advance notice and confidentiality protections.

9. Liability

Liability under this DPA is governed by the limitation of liability provisions in the underlying Terms of Service.

10. Contact

Data protection questions or a signed copy of this DPA: legal@scoringfactory.ai.