Data Processing Terms

1. Scope and Roles

These Data Processing Terms ("DPA") apply when Scaling Legal ehf. ("we", "Processor") processes personal data on behalf of a customer company ("Customer", "Controller") in providing chAIr. The Customer is the controller of the personal data in its company records in chAIr; we are its processor.

This DPA does not cover data for which we are the controller (for example our customers' account, billing contact and verification data), which is described in our Privacy Policy.

2. Details of the Processing

• Subject matter and purpose: providing chAIr to the Customer: storing and organising governance records, drafting content with AI at the Customer's request, sending emails the Customer chooses to send, deadline alerts and calendar feeds.
• Duration: for the term of the Customer's subscription and until deletion under section 9.
• Nature of processing: collection, storage, organisation, retrieval, transmission (email, calendar feed, personal share links), recording when shared documents are opened, AI-assisted drafting, export and deletion.
• Categories of data subjects: the Customer's board members, managing director, employees and other users; shareholders, option holders and investors; meeting attendees; contract counterparties' contact persons; other individuals the Customer records.
• Types of personal data: names, roles, email addresses and other contact details; shareholdings and other cap table entries; statements and decisions recorded in minutes; contract information; records of when recipients open documents shared with a personal link (date, time and whether a phone or computer was used; no IP address); records of which user downloaded which file from the workspace, and when; other information the Customer chooses to enter.
• Special categories: chAIr is not designed for special categories of personal data (Article 9 GDPR) or data on criminal convictions. The Customer should not enter such data unless it has a lawful basis and it is necessary.

3. Instructions and Confidentiality

• We process personal data only on the Customer's documented instructions, including with regard to transfers to third countries. The Terms of Service, this DPA and the Customer's use of chAIr's features (for example sending a shareholder communication or turning on calendar sync) are those instructions. We will tell the Customer immediately if we believe an instruction breaks data protection law.
• We do not use the Customer's personal data for our own purposes, do not sell it, and do not use it to train AI models.
• We may process personal data where required by EEA or Icelandic law; we will inform the Customer before doing so unless the law prohibits it.
• Everyone we authorise to process the personal data is bound by confidentiality.
• We keep a record of processing activities carried out on behalf of our customers, as required by Article 30(2) GDPR.

4. Security

We maintain appropriate technical and organisational measures under Article 32 GDPR, including:

• encryption in transit (TLS) and encryption of the database at rest;
• separation of each Customer's data enforced by access rules in the database;
• role-based access within each Customer (admin and read-only);
• verification of new company workspaces before outbound email and invitations are enabled;
• daily database backups, rate limiting and audit logging of changes;
• AI processing only on request and only in the European Union, without use of the data for model training;
• restricting our own staff's access to Customer data to what is needed for support, security and operating the service;
• a documented incident response plan and regular reviews of these measures.

5. Sub-processors

The Customer gives general authorisation for us to use sub-processors. Our current sub-processors are:

• Supabase — database and authentication — European Union (Paris)
• Amazon Web Services (Amazon Bedrock) — AI drafting — European Union
• Netlify — hosting and server functions — United States (Standard Contractual Clauses in Netlify's DPA)
• Resend — delivery of emails the Customer sends through chAIr and of alerts — United States (certified under the EU-US Data Privacy Framework)

We will give at least 30 days' notice (by email or in chAIr) before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds; if we cannot address the objection, the Customer may terminate the affected subscription and receive a refund of prepaid fees for the remaining period. We impose data protection obligations on each sub-processor that are no less protective than this DPA and remain responsible for their performance.

6. International Transfers

Customer records are stored in the European Union. Where a sub-processor processes personal data outside the EEA, the transfer is based on an adequacy decision (including the EU-US Data Privacy Framework for certified providers) or the European Commission's Standard Contractual Clauses.

7. Assistance to the Customer

• chAIr lets the Customer view, correct, export and delete its records. Where the Customer cannot respond to a data subject request using these features, we will assist on request.
• If we receive a request from a data subject about the Customer's records, we will refer it to the Customer and not respond ourselves unless the Customer instructs us to.
• We will provide reasonable information to help the Customer with data protection impact assessments and prior consultations with Persónuvernd, taking into account the nature of the processing and the information available to us.

8. Personal Data Breaches

We will notify the Customer without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting the Customer's data, so that the Customer can notify Persónuvernd within the 72 hours required by Article 33 GDPR where needed. The notice will include the information available to us that the Customer needs to meet its obligations under Articles 33 and 34 GDPR, and we will update it as more information becomes available.

9. Return and Deletion

The Customer can export its records at any time. If the subscription is cancelled, it continues to the end of the paid period and we remind the Customer's admins to export the records. We delete the records within 30 days after the subscription ends and, until then, provide an export on request. Copies in backups are deleted as the backups expire, within a further 30 days. We keep data after that only where EEA or Icelandic law requires it.

10. Information and Audits

We will make available the information necessary to demonstrate compliance with this DPA and Article 28 GDPR. The Customer may audit our compliance, on at least 30 days' written notice, no more than once a year (unless required by a supervisory authority or following a breach), at its own cost and subject to confidentiality. We may first answer by providing documentation and our sub-processors' certifications and reports where these are sufficient.

11. Customer's Obligations

• The Customer is responsible for having a lawful basis for the personal data it puts into chAIr and for informing the people concerned (Articles 13 and 14 GDPR), for example board members and shareholders.
• The Customer is responsible for the content of messages it sends through chAIr and for the recipients it chooses.
• The Customer should enter only the personal data it needs for its governance records.

12. General

If this DPA conflicts with the Terms of Service, this DPA prevails for the processing of personal data. The limitation of liability in the Terms of Service applies to this DPA to the extent permitted by law. This DPA is governed by Icelandic law and the Reykjavík District Court (Héraðsdómur Reykjavíkur) has jurisdiction.

Questions: privacy@chair.is