Last updated: [EFFECTIVE DATE] · Draft for attorney review
1. Roles of the parties
For personal data contained in Customer Content, Customer acts as the business/controller and SCOUT acts as the service provider/processor, processing personal data only on Customer's instructions as set out in the Terms of Service and this Addendum. [ATTORNEY REVIEW: confirm this characterization against the specific privacy frameworks that apply to each customer's jurisdiction.]
2. Processing instructions
SCOUT will process personal data within Customer Content only to provide, secure, and support the service, and otherwise only on Customer's documented instructions, except where required by law.
3. Categories of data & data subjects
Personal data processed may include Customer's own personnel and Customer's customers' contact and transaction information (name, contact details, service/job history, communications, payment status). Customer determines what personal data it submits to SCOUT.
4. Confidentiality
SCOUT limits access to personal data to personnel who need it to provide the service, and binds them to confidentiality obligations.
5. Security measures
SCOUT implements the technical and organizational measures described on the Security page, including tenant data isolation, authenticated and role-limited administrative access, hashed credentials, and audit logging of administrative actions.
6. Subprocessors
SCOUT uses subprocessors (such as hosting/database infrastructure and payment processing providers) to provide the service, under written terms requiring a comparable level of data protection. [ATTORNEY REVIEW: attach or link the current named subprocessor list and define the notice period/objection mechanism for new subprocessors.]
7. Incident response
SCOUT will notify Customer without undue delay, and in any event within [BREACH NOTIFICATION TIMELINE], upon confirming a security incident affecting Customer's personal data, and will provide information reasonably necessary for Customer to meet its own notification obligations.
8. Assistance with data subject rights requests
SCOUT will provide reasonable assistance to Customer in responding to a verified data subject request (access, correction, deletion) concerning personal data within Customer Content, since Customer is best positioned to verify and respond to such requests about its own customers.
9. Deletion & return
On termination of the subscription, SCOUT will make Customer Content available for export for a limited period and will then delete it, except as required to be retained by law, consistent with the Privacy Policy's retention terms.
10. Audits
[ATTORNEY REVIEW: define whether and under what conditions (notice, frequency, confidentiality, cost allocation) Customer may audit SCOUT's compliance with this Addendum, or whether SCOUT will instead provide audit reports/documentation in lieu of a direct audit right.]
11. International transfers
[ATTORNEY REVIEW: confirm where Customer Content is hosted and, if personal data is transferred across borders (e.g., from the EEA/UK), define the transfer mechanism used (such as Standard Contractual Clauses) if and when applicable.]
12. Subcontractors & compliance cooperation
SCOUT remains responsible for a subprocessor's performance of the obligations it has agreed to. SCOUT will cooperate in good faith with Customer's reasonable requests related to compliance with applicable data-protection law concerning the service.