Data Processing Addendum

When you use CRAFT in a way that causes us to process personal data on behalf of your organization, you are the data controller and CRAFT is your data processor within the meaning of the GDPR and UK GDPR. A Data Processing Addendum (DPA) is the contract that governs that relationship.

What the DPA Covers

• Roles: who is controller, who is processor
• Categories of data processed and data subject types
• Processing instructions and purpose limitation
• Confidentiality obligations of CRAFT personnel
• Technical and organizational security measures
• Sub-processor management and notification obligations
• International data transfers, including the EU Standard Contractual Clauses and UK International Data Transfer Addendum
• Data subject rights assistance
• Data breach notification
• Data return and deletion on termination
• Audit rights
• Liability and indemnification aligned with the EULA

Current Subprocessor List

The subprocessors we use to deliver the Site, the licensing service, and the desktop product are listed in the Privacy Policy. We will notify active early access participants at least 30 days in advance of adding a new subprocessor so you can object before the change takes effect.

International Data Transfers

Where personal data is transferred outside the EEA, UK, or Switzerland to a jurisdiction that the European Commission has not deemed adequate, CRAFT relies on the EU–US Data Privacy Framework (where applicable), the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, and a Transfer Impact Assessment aligned with EDPB recommendations. These mechanisms are incorporated into the DPA and available on request. See Privacy Policy § International Data Transfers for details.

Contact

[TBD — legal entity name]
[TBD — registered office address]
Privacy contact: [email protected]