Data Processing 
Agreement

This Data Processing Addendum ("Agreement") is entered into between The Scaling School AB ("TSS") and the entity identified as the Customer on a signed Order Form or via an online signup form ("Customer" or “Subscriber or “You”) and governs the Customer's access and use of the Service. The parties agree that this Agreement shall be incorporated into and form part of the Subscription Agreement and subject to the provisions therein, including limitations of liability.

In accordance with Article 28 of the General Data Protection Regulation (EU) 2016/679, these Terms serve as the Data Processing Agreement between the Customer as the data controller (the “Controller”) and TSS as the data processor (the “Processor”). The Customer instructs TSS to carry out processing of the data in accordance with the provisions outlined in these Terms.

1. Purpose

  1. You have decided to participate in, and/or completing the TSS mobile and web based tools to helps startup teams co-create alignment and efficiently prioritize activities (the “Purpose”)

2. Definitions

  1. “Data Subject” means an individual who is the subject of personal data.
  2. “Personal Data” means any information relating to an identified or identifiable natural person, including, but not limited to, names, addresses, telephone numbers, email addresses, and other contact information.
  3. “Processing” means any operation or set of operations performed on personal data, including, but not limited to, collecting, recording, storing, using, disclosing, or destroying personal data.

3. Responsibilities of the Processor

  1. The Processor shall process Personal Data only in accordance with the instructions of the Controller and shall not use the Personal Data for any purpose other than as set forth in this Agreement.
  2. The Processor shall take the technical and organizational measures required by applicable Data Protection Rules and take all security measures in connection with the processing as provided for in Article 32 of the GDPR. The Processor shall (i) assist the Controller in ensuring compliance with the Controller's obligations under Articles 32-36 of the GDPR, taking into account the type of processing and the information that the Processor has available, and (ii) considering the nature of the processing, help the Controller through technical and organizational measures, insofar as this is possible so that the Controller can fulfill its obligation to respond to the request for the exercise of the data subject’s rights in accordance with Chapter III of the GDPR.
  3. Processor shall notify Controller without undue delay upon Processor becoming aware of a Personal Data Breach affecting Controller’s Personal Data, providing Controller with sufficient information to allow the Controller to meet any obligations to report or inform Data Subjects of the Personal Data Breach under the Data Protection Laws.
  4. The Processor may engage other personal data processors (“sub-processors”) in provisioning of the Service or part thereof. The Processor engages sub-processor(s) in accordance with Appendix 1. The Controller hereby accepts the use of said subprocessor(s), including its/their sub-processor(s). The Processor undertakes to inform the Controller of any plans to engage new sub-processors or to substitute sub-processors by giving the Controller information about this at least 30 days before a new sub-processor is meant to be added. The Controller has the right to oppose a new sub-processor within 90 days of the Controller being informed of the plan to engage a new sub-processor by terminating this Agreement for immediate termination, without any other rights in consequence thereof.
  5. The Processor shall delete or return the Personal Data to the Controller upon termination of this Agreement, unless required by applicable law to retain the Personal Data.

4. Responsibilities of the Controller

  1. The Controller shall be responsible for ensuring that the Processing of Personal Data is carried out in accordance with the GDPR and other applicable privacy laws.
  2. The Controller shall provide the Processor with such information and instructions as are necessary for the Processor to perform its obligations under this Agreement.
  3. The Controller agrees to transfer of personal data outside EU/EEA required for the Service provided the transfer is in accordance with the conditions of GDPR for such transfer.
  4. The Company shall pay specially agreed upon remuneration to the Processor for such instruction (including features, actions and adaptations) that goes beyond those as standard in the Service.
  5. The Controller shall remunerate the Processor for claims for such payment that the Processor must provide to third parties, including data subjects and relevant regulatory authority, as a result of the Controller's violation of its obligations under this Personal Data Processor Agreement. The Controller’s responsibility for damage to the Processor under the Personal Data Processor Agreement shall be limited to such remuneration liability.

5. Duration

  1. The Supplier will process data on behalf of the Controller until the termination of the Service in accordance with these Terms. Upon termination, TSS will store the Controller’s data for a period up to to six months.

6. Indemnification

  1. The Processor shall indemnify and hold harmless the Controller from and against any and all claims, damages, and expenses arising from the Processor’s breach of its obligations under this Agreement.

Appendix 1 Sub-processors

Supplier utilizes the following sub-processors in its delivery of the Service:

Sub-Processor Location of Processing Data handled
Microsoft Corporation Redmond, Washington, USA Processing is covered by DPA including Model/Standard Contractual Clauses (SCC) Name, email, phone number
Outseta LLC USA Processing is covered by DPA including Model/Standard Contractual Clauses (SCC) Name, email, activity data
HubSpot, Inc. Germany Name, email, account activity data, marketing website activity