This page is a template outline. Customers who need a signed DPA should email legal@scoringfactory.ai for the current execution copy.
1. Roles
When ScoringFactory processes personal data for a Customer, the Customer is the "Controller" or "Business" and ScoringFactory is the "Processor" or "Service Provider" as defined by applicable data-protection law, including GDPR and CCPA.
2. Subject matter and duration
ScoringFactory processes personal data for the duration of the underlying subscription agreement solely to provide the scoring service described there.
3. Nature and purpose of processing
Processing includes collecting, enriching, and analyzing publicly available and Customer-provided information about founders, companies, and candidates to generate evidence-backed scores for diligence, sourcing, or hiring decisions.
4. Categories of data
- Data subjects. Founders under diligence, job candidates, company representatives, and Customer personnel who use the account.
- Data types. Names, public professional histories, public writing and media, and information the Customer submits about a data subject.
5. Processor obligations
- Process personal data only under documented Customer instructions unless law requires otherwise.
- Bind personnel with access to confidentiality obligations.
- Apply the security measures described on the Trust & security page.
- Help the Customer respond to data-subject requests and regulator inquiries where required.
- Notify the Customer without undue delay after learning of a personal-data breach affecting Customer data.
- Delete or return personal data at the end of the engagement, subject to legal retention requirements.
6. Subprocessors
The Customer authorizes ScoringFactory to use the subprocessors described on the Trust & security page. We will give notice before adding a new subprocessor so the Customer may object on reasonable grounds.
7. International transfers
Where personal data moves outside the EEA or UK, the parties incorporate the Standard Contractual Clauses or another lawful transfer mechanism by reference.
8. Audit rights
A Customer may request available evidence of ScoringFactory's compliance, including a completed security questionnaire, once per year. On-site audits are available for cause with reasonable notice and confidentiality protections.
9. Liability
The limitation-of-liability terms in the underlying Terms of Service govern liability under this DPA.
10. Contact
For data-protection questions or a signed copy, email legal@scoringfactory.ai.