Data Processing Addendum

How this applies

This Data Processing Addendum ("DPA") forms part of the Terms of Service between your organization ("Customer", "you") and Sortie HQ ("we", "us"). It applies automatically whenever we process personal data on your behalf, and it takes precedence over the Terms of Service on anything to do with personal data.

You do not need to sign anything for it to apply. If your procurement process needs a signed and dated copy, or your own paper instead of ours, email runiondd@gmail.com.

Words we use

• Data protection law — the EU GDPR, the UK GDPR and the UK Data Protection Act 2018, the Swiss FADP, and US state privacy laws including the CCPA as amended by the CPRA, each where they apply.
• Customer personal data — personal data inside the content you put into Sortie HQ, and personal data about your users that we process to run the service for you.
• Controller, processor, data subject, processing and personal data breach carry the meanings given in the GDPR.
• SCCs — the Standard Contractual Clauses annexed to European Commission Implementing Decision (EU) 2021/914.
• UK Addendum — the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner.

Roles and instructions

For Customer personal data, you are the controller and we are the processor. Where you are yourself acting as a processor for someone else, we are a sub-processor and you confirm you have the authority to appoint us.

We process Customer personal data only on your documented instructions. Your instructions are:

• The Terms of Service and this DPA.
• Your configuration and use of the product — including which model provider you connect, which integrations you switch on, and who you invite.
• Any further written instruction you send us, provided it is lawful and technically feasible. If it requires work beyond ordinary operation of the service, we may charge for it, and we will agree that with you first.

If we believe an instruction breaks data protection law, we will tell you and may pause that processing. If we are ever legally required to process your data for some other reason, we will tell you before doing so unless the law forbids it.

We do not use Customer personal data for our own purposes. We do not sell it, we do not share it for advertising, and we do not use it to train machine-learning models — ours or anyone else's.

What you are responsible for

• Having a lawful basis for the personal data you put into Sortie HQ, and giving the notices your own people are owed.
• Deciding what goes in. Sortie HQ is a planning tool — do not put special-category data, protected health information, payment card numbers, government ID numbers or children's data into it. It is not built for that and we make no claims for it.
• Managing who has access to your workspace, and removing people when they leave.
• Choosing, funding and contracting with your model provider.

Confidentiality

Everyone we authorise to process Customer personal data is bound by confidentiality — by contract or by professional obligation — and access is limited to the people who need it to run or support the service. In practice, Sortie HQ is a solo operation, so that is one person.

Security

We maintain appropriate technical and organisational measures, set out in Annex II, taking into account the state of the art, cost, and the risk to individuals. We may change those measures over time but will not materially reduce the overall level of protection.

Annex II describes what is actually in place today, which does not include a SOC 2 report or an ISO 27001 certificate. We would rather you knew that during the review than after it.

Sub-processors

You give general authorisation for us to use sub-processors. The current list is Annex III, and it is also published on the privacy page.

• Every sub-processor is bound by written terms that impose data protection obligations no weaker than these.
• We remain responsible to you for what our sub-processors do.
• Before adding or replacing one, we will give the account administrator at least 30 days' notice by email.
• You can object on reasonable data-protection grounds within those 30 days. We will try to find an alternative. If we cannot, you may terminate the affected part of the service and we will refund any unused prepaid fees.

The model provider you choose

Every organization starts on a key we provide. Any organization can connect its own provider account instead, and which one it uses changes who is responsible for what.

So, concretely:

• For a customer-configured provider, we act on your instruction to transmit. You are responsible for that provider's terms and for any zero-retention arrangement you want with them. It is named in Annex III as a customer-selected sub-processor.
• If your organization uses the key we provide — the default — our provider — Anthropic — processes that content as our sub-processor, under our agreement with them, and the notice and objection rights above apply to it in the ordinary way.
• Either way, we store any provider key encrypted and we log only call metadata: provider, model, purpose, tokens, latency, cost. Prompt and completion text are not written to our logs.

Data subject requests

If a data subject contacts us directly about data we hold on your behalf, we will not respond ourselves — beyond telling them to contact you — and we will pass the request to you promptly.

We will help you meet your own obligations to respond, taking account of what the product can do. Today that help is partly manual: the product has no self-serve export-everything or delete-account function, so we run those requests by hand, and we aim to come back to you within 10 business days of a request from you. Self-serve export and deletion are on the roadmap and are not available yet.

Breach notification

If we become aware of a personal data breach affecting Customer personal data, we will notify you without undue delay and in any case within 72 hours, at the administrator's email address. The notice will describe what we know — the nature of the breach, the categories and rough number of records affected, the likely consequences, and what we are doing about it — and we will follow up as we learn more.

We will help you meet your own notification duties to regulators and to affected individuals. A notification is not an admission of fault.

International transfers

Sortie HQ is hosted in the United States. Where you transfer personal data from the EEA, the UK or Switzerland to us, the following apply and are incorporated into this DPA by reference:

• EEA: the SCCs, Module Two (controller to processor). In clause 7 the docking clause applies; in clause 9 Option 2 (general written authorisation) applies with the 30-day notice above; in clause 11 the optional independent dispute body does not apply; in clause 17 the governing law is that of Ireland; in clause 18(b) the forum is the courts of Ireland. Annex I and Annex II of the SCCs are populated by Annex I and Annex II of this DPA, and the list of sub-processors by Annex III.
• UK: the UK Addendum, with the SCCs as its Approved Addendum. Tables 1 to 3 are completed by the parties' details and the Annexes of this DPA; in Table 4, neither party may end the Addendum as set out in section 19.
• Switzerland: the SCCs as adapted by the Swiss Federal Data Protection and Information Commissioner, with references read to include the FADP.

If a transfer mechanism is invalidated in future, we will work with you in good faith to put a valid one in place.

Audits and evidence

We will make available the information you reasonably need to show that we are meeting these obligations. In practice that means:

• We complete security and privacy questionnaires, and we answer follow-up questions directly.
• We provide documentation of the measures in Annex II and the current sub-processor list.
• Where you have a specific regulatory requirement for an on-site or third-party audit, we will agree scope, timing and cost with you in advance. Audits happen no more than once a year unless a regulator or a breach makes another one necessary, and are subject to confidentiality.

We do not have a SOC 2 or ISO 27001 report to hand you instead. When that changes, this section changes with it.

Deletion and return

When the service ends, you can ask us to return a copy of Customer personal data, delete it, or both. We keep it for 30 days after termination so you have time to ask, then delete it, except where the law requires us to keep something — billing records for tax being the main example.

Deleted data persists in database backups until those backups age out. While it is there it stays protected by the measures in Annex II and is not processed for any other purpose.

California

For personal information covered by the CCPA, we act as a service provider. We do not sell or share it, we do not retain, use or disclose it for any purpose other than performing the service for you, and we do not combine it with personal information from other sources except as the CCPA permits. We certify that we understand and will comply with these restrictions.

Liability and precedence

Each party's liability under this DPA is subject to the limits in the Terms of Service, except where data protection law does not allow that. Where this DPA and the Terms of Service conflict on personal data, this DPA wins. Where this DPA and the SCCs conflict, the SCCs win.

Annex I — Details of processing

Annex II — Security measures

These are the measures in place today, described as they are rather than as a checklist.

Annex III — Sub-processors

Usage analytics are absent from this list because there is no one to add. The analytics software runs on our own server, sets no cookies and records no personal data, so no third party receives it. The privacy policy sets out what it does record.

To be told when this list changes, email runiondd@gmail.com and we will add you to the notification list.