Data Processing Agreement

1. Introduction

This Data Processing Agreement ("DPA") forms part of the Terms of Service between SoTech Studio Ltd ("Processor", "we", "us" or "our"), a company registered in England and Wales, and the Customer ("Controller", "you" or "your") using the Thrivespace platform ("Platform").

It sets out how we process personal data on your behalf, in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It applies to all personal data we process for you through the Platform.

2. Definitions

Terms not defined here have the meaning given in the UK GDPR or the Terms of Service.

• "Personal Data" means information about an identified or identifiable person that we process for you through the Platform.
• "Processing" means anything done with Personal Data, including collecting, storing, using, sharing and deleting it.
• "Data Subject" means the person the Personal Data is about.
• "Subprocessor" means a company we use that processes Personal Data for us.
• "Data Breach" means a breach of security that leads to Personal Data being lost, destroyed, changed, disclosed or accessed without authority.

3. Roles

You, the Controller

You decide what Personal Data goes into the Platform and why. You are responsible for:

• Having a lawful basis for the processing
• Telling the people concerned how their data is used
• Answering requests from Data Subjects, with our help
• Keeping the Personal Data accurate

Us, the Processor

We are responsible for:

• Processing Personal Data only on your documented instructions
• Protecting it with appropriate technical and organisational measures
• Helping you answer requests from Data Subjects
• Telling you about a Data Breach without undue delay
• Making sure everyone who handles it is bound by confidentiality

4. What we process

Whose data

• Your employees and workers
• Your contractors and consultants
• Your managers and administrators

What data

• Names, email addresses and contact details
• Job titles, teams, roles and reporting lines
• Training records, certificates and other evidence
• Credentials, memberships and qualifications
• Learning events and reflections
• Goals, reviews, 1-to-1 notes, skills and development plans
• Recognition, announcements and anonymous wellbeing check-ins

Why

Only to provide the Platform to you, in line with the Terms of Service and your instructions.

5. Your instructions

We process Personal Data only on your documented instructions, unless the law requires otherwise. If it does, we will tell you first unless the law forbids it.

You instruct us to process Personal Data to:

• Provide the Platform and its features
• Store and show Customer Data as your Authorised Users direct
• Produce the reports and exports your Authorised Users ask for
• Give technical support and fix problems
• Keep the Platform secure

6. Subprocessors

You give us general written permission to use Subprocessors. They are listed on our Subprocessors page.

Before we add or replace a Subprocessor, we will:

1. Tell you at least 30 days in advance, if you have asked to hear about changes
2. Explain what the Subprocessor will do
3. Give you the chance to object

If you object and we cannot reasonably meet the objection, you may end the affected service under the Terms of Service.

Every Subprocessor is bound by data protection terms at least as protective as this DPA.

7. Security

We protect Personal Data with appropriate technical and organisational measures, including:

• Encryption in transit (TLS 1.2 or higher) and where it is stored (AES-256)
• Keeping each organisation's data apart from every other's
• Access controlled by permissions
• Daily backups, each kept for 7 days
• Error and uptime monitoring
• Confidentiality obligations for everyone who handles it

Our Security page has the detail.

8. Data Subject requests

We will help you respond to requests under the UK GDPR, including requests to see, correct, delete, restrict, move or object to the use of Personal Data.

If a Data Subject contacts us directly, we will tell you promptly and will not respond except to acknowledge it, unless you ask us to.

9. Data Breaches

If there is a Data Breach, we will:

1. Tell you without undue delay, and within 72 hours of becoming aware of it
2. Give you the information you need to meet your own obligations
3. Act straight away to contain it and put it right
4. Work with you and with the Information Commissioner's Office

We will tell you, as far as we know it, what happened, what kinds of data and roughly how many people were affected, the likely consequences and what we are doing about it.

10. Data that leaves the UK

We will not transfer Personal Data outside the United Kingdom without appropriate safeguards, such as Standard Contractual Clauses with the UK Addendum or a UK adequacy decision. Where each Subprocessor processes data is shown on our Subprocessors page.

11. Keeping and deleting data

We process Personal Data for as long as you use the Platform. When the agreement ends:

1. For 30 days you can ask us for a copy of your Customer Data
2. When you ask us to close your workspace, or once those 30 days have passed, we delete Personal Data from our systems
3. Backups that still hold it are replaced within 7 days
4. We will confirm deletion in writing if you ask

If the law requires us to keep any Personal Data for longer, we will tell you what and why.

12. Checking we comply

We will give you the information you reasonably need to show we are meeting this DPA. This includes answering a written security questionnaire once a year, and our current security and Subprocessor information.

If that is not enough to show compliance, or a regulator requires it, we will agree a further audit with you. It will be at your cost, on at least 30 days' notice, at a reasonable time and without disrupting our work or other customers' data. If an audit finds a material breach of this DPA, we will pay for it.

13. Liability

Each side's liability under this DPA is subject to the limits in the Terms of Service, except where the law does not allow those limits to apply to breaches of data protection law.

14. How long this DPA lasts

This DPA lasts as long as we process Personal Data for you. The parts that need to continue after the agreement ends, such as confidentiality and deletion, will do so.

15. Governing law

This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

16. Contact us

SoTech Studio Ltd

Email: privacy@thrivespace.space

You can also contact the Information Commissioner's Office (ICO) at ico.org.uk (opens in a new tab).