In short
- When your company puts personal information into Sora Build, you decide what happens to it and we process it only on your instructions.
- Our staff and service providers are bound to confidentiality and security, and we'll tell you about new providers in advance.
- We help you answer requests from the people in your data, and we tell you without undue delay about any breach.
- When you leave, you can export your data, and then we delete it.
This summary is here to help. The full text below is what applies.
On this page
1. Scope
This Data Processing Addendum ("DPA") forms part of the Terms of Service between the Customer and Asterpolaris. It applies to personal information in Customer Data that we process on the Customer's behalf when providing Sora Build ("Customer Personal Data").
For Customer Personal Data, the Customer is the controller (or the organization in control of it) and we are the processor (or service provider). Account and website information we handle for our own purposes is covered by our Privacy Policy instead.
2. Details of the processing
| Item | Description |
|---|---|
| Subject matter and purpose | Providing Sora Build to the Customer: scheduling, project collaboration, client and trade partner portals, invoicing and payments, notifications, integrations and support. |
| Duration | For the term of the agreement, and until deletion as described below. |
| People concerned | The Customer's Users, and the clients, owners, trade partners, suppliers and other contacts the Customer adds to its workspace. |
| Types of information | Names, email addresses, phone numbers, job titles and roles, project addresses, messages, approvals, photos and files, invoice and payment details, and usage records. |
| Sensitive information | None is intended. The Customer should not put special categories of personal information into the Service unless a feature is built for it. |
3. Our obligations
- We process Customer Personal Data only on the Customer's documented instructions, which are the agreement and the Customer's use and configuration of the Service, unless the law requires otherwise (in which case we'll tell the Customer, where allowed).
- We don't sell Customer Personal Data, use it for our own advertising, or combine it with other data except as needed to provide the Service.
- Everyone who processes it for us is bound by confidentiality.
- We maintain technical and organizational security measures suited to the risk, including encryption in transit, tenant isolation enforced in the database, access controls, and audit logging.
4. Subprocessors
The Customer authorizes us to use the subprocessors listed on our Subprocessors page. We impose data-protection terms on each that are at least as protective as this DPA, and we remain responsible for their performance.
We'll update that page and notify workspace owners at least 30 days before adding or replacing a subprocessor. If the Customer has a reasonable data-protection objection, we'll work in good faith to address it; if we can't, the Customer may end the affected Service and receive a refund of any prepaid fees for it.
5. Helping the Customer
Taking into account the nature of the processing, we'll help the Customer respond to requests from individuals to exercise their rights, and with security, breach notification and data-protection assessments. If we receive a request directly about Customer Personal Data, we'll pass it to the Customer rather than answering it ourselves, unless the law requires otherwise.
6. Security incidents
We'll notify the Customer without undue delay after becoming aware of a breach of security that affects Customer Personal Data. We'll share what we know, what we're doing about it, and what the Customer may need to do, and update the Customer as we learn more.
7. International transfers
Customer Personal Data may be processed in Canada, the United States and other countries where we or our subprocessors operate. Where the law requires a transfer mechanism (such as the European Commission's Standard Contractual Clauses or the UK Addendum), the parties agree that it applies and is incorporated by reference, with the Customer as exporter and us as importer.
8. Return and deletion
The Customer can export Customer Data while its workspace is active, and for 30 days after the agreement ends on request. After that we delete Customer Personal Data within a reasonable time, except for copies in backups (overwritten on their normal cycle) and records the law requires us to keep, which stay protected under this DPA.
9. Audits
On reasonable written request, no more than once a year, we'll provide the information reasonably needed to show that we comply with this DPA, such as answers to a security questionnaire. Any further audit needs to be agreed in advance, at the Customer's cost, with reasonable notice and confidentiality.
10. Contact
For questions about this DPA, or to request a countersigned copy, write to us through our contact page.
This DPA takes effect when the Customer accepts the Terms of Service and ends when we stop processing Customer Personal Data.