Data Processing Addendum

This Data Processing Addendum ("DPA") supplements the Cairn Script Terms of Service and applies when GoodCraft, LLC processes personal data on your behalf in connection with the Service.

Roles

For the personal data you submit to the Service, you are the Controller and we are the Processor (as those terms are defined under GDPR / UK GDPR).

Sub-processors

A current list of approved sub-processors is maintained in our Privacy Policy. We will give you at least 30 days' notice of any new sub-processor by email.

Security measures

We implement the technical and organizational measures described in our Security overview. We will assist you with DPIAs and respond to data subject requests within the timelines required by applicable law.

International transfers

Personal data may be transferred to the United States, where our hosting infrastructure is located. We rely on the Standard Contractual Clauses (SCCs) published by the European Commission for transfers from the EEA, UK, and Switzerland.

Signed DPA

Enterprise customers may request a counter-signed copy of this DPA, along with our standard SCCs, by emailing legal@cairnscript.com.