Data Processing Agreement

1. Words we use

• Data protection law means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003, and any law that changes or replaces them, including the Data (Use and Access) Act 2025.
• Customer personal data means personal data we process on the Customer's behalf when we provide Scout Suite.
• Sub-processor means another company we use that processes Customer personal data.
• Controller, processor, data subject, personal data breach and special category data have the meanings they have in data protection law.

2. Who is responsible for what

The Customer is the controller of Customer personal data, and we are its processor. The Customer decides what personal data goes into Scout Suite and why. It is responsible for having a lawful basis for it, including a condition for any special category data, and for telling data subjects how their data is used.

We are the controller of some personal data of our own, such as account holders' sign-in details, billing contacts and our website analytics. Our Privacy Policy covers that data, not this DPA.

GoCardless. If the Customer connects its own GoCardless account to collect Direct Debit or pay by bank, GoCardless and the Customer are independent controllers of the payers' details held in that account, under GoCardless's own terms. When we read or change that account we do so on the Customer's instructions, as its processor. GoCardless's agreement with us as an integration partner requires us to tell GoCardless without undue delay if we receive a request or complaint addressed to GoCardless, or if a personal data breach concerns data processed for the Customer's GoCardless account. We do that, and tell the Customer.

3. What we process

• Subject matter and purpose: providing Scout Suite to the Customer, including support, security and keeping the service running.
• Duration: for as long as the Customer uses Scout Suite, and then until we delete the data under section 11.
• Nature of the processing: storing, organising, showing, sending, transcribing, analysing (including with AI features when someone uses them), exporting and deleting data, as the Customer's use of Scout Suite requires.
• Data subjects: the Customer's young people, parents and carers, volunteers, trustees, members, supporters, hirers, suppliers and anyone else the Customer records or contacts through Scout Suite.
• Types of personal data: names and contact details, dates of birth, membership, roles, attendance, badges and awards, photos, consents, finance and payment records, messages, calls, recordings and transcripts, and anything else the Customer chooses to record.
• Special category data: health and medical information, dietary needs, additional needs and disabilities, and any other special category or safeguarding information the Customer chooses to record. See section 13.

4. Following the Customer's instructions

We only process Customer personal data on the Customer's documented instructions. Those instructions are: the Terms and this DPA; the way the Customer and its users set up and use Scout Suite; and any other reasonable written instructions the Customer gives us that fit the Terms.

If the law requires us to process Customer personal data in any other way, we will tell the Customer first, unless the law forbids that.

We will tell the Customer straight away if we think an instruction breaks data protection law.

5. Confidentiality

Everyone we allow to process Customer personal data is bound to keep it confidential, by contract or by law, and only gets the access their work needs.

6. Security

We take appropriate technical and organisational measures to protect Customer personal data, as Article 32 of the UK GDPR requires. They currently include:

• Encryption in transit: Scout Suite is only available over encrypted connections (HTTPS).
• Encryption at rest: our hosting provider encrypts the database and stored files. We encrypt the access details for some connected accounts, such as payment account tokens, again before storing them.
• Access controls: role-based permissions in each Group, District and County, so people only see what their role allows. Team Leaders can be limited to their own section, and parents only see their own family's records.
• Sign-in protection: hashed passwords, passkeys, single sign-on for organisations that set it up, and limits on repeated sign-in attempts.
• Audit logs: changes and deletions are recorded, with who made them and when.
• Privacy mode: one switch blurs young people's names, email addresses and photos when a screen might be seen by others.
• Tamper-evident conversation records: each conversation record is digitally signed, so any change can be detected.
• Backups: the database can be restored to any point in the last 30 days.
• Separate test environment: we test changes on a separate copy of Scout Suite that only holds test data.
• Limited staff access: only the people who need it can access the systems that hold Customer personal data.
• Card details: we never see or store full card numbers. Payment providers hold them.

We review these measures and may change them, as long as the overall level of protection doesn't go down.

7. Sub-processors

The Customer gives us general authorisation to use sub-processors. The current list, with what each one does and where it processes data, is on our sub-processor page, which forms part of this DPA. Optional sub-processors only receive Customer personal data when the Customer uses the feature that needs them.

At least 30 days before we add or replace a sub-processor, we tell the Customer: we update the sub-processor page, its change log and its feed, email the Customer's admins and show a notice in Scout Suite. If we have to replace one urgently, for example because of a security problem or a provider closing, we give as much notice as we can and explain why.

The Customer can object to a new sub-processor during the notice period, on reasonable data protection grounds, by emailing privacy@scoutsuite.app. We will try to resolve the objection, for example by keeping the Customer off the new provider or turning the affected feature off for it. If we can't: for an optional sub-processor, the Customer can stop using the feature that needs it; for a core sub-processor, the Customer can end its use of Scout Suite before the change takes effect.

Each sub-processor is bound by a written contract with data protection obligations that protect Customer personal data at least as well as this DPA does. We remain responsible to the Customer for the work of our sub-processors.

8. Helping with data subject requests

Scout Suite gives the Customer tools to deal with most requests itself: it can find, correct, export and delete people's records, and keep track of subject access requests and their deadlines.

If someone contacts us directly about Customer personal data, we pass the request to the Customer without undue delay, and don't answer it ourselves unless the Customer asks us to. Where the tools aren't enough, we help the Customer respond, as far as we reasonably can given the nature of the processing.

9. Personal data breaches

If we become aware of a personal data breach affecting Customer personal data, we tell the Customer without undue delay, and we aim to do so within 48 hours. That gives the Customer time to report it to the ICO within 72 hours where it needs to.

We tell the Customer what we know, and add to it as we find out more: what happened, the kinds and rough number of people and records involved, the likely consequences, what we have done or plan to do about it, and who to contact for more information.

We email the Customer's admins, and take reasonable steps to contain the breach and stop it happening again. Telling the Customer about a breach is not an admission of fault.

10. Impact assessments and the ICO

We help the Customer with data protection impact assessments (DPIAs), and with any consultation with the ICO, by giving it the information it reasonably needs about how Scout Suite processes personal data. Our sub-processor page and the AI features section of our Privacy Policy are a good place to start.

11. Deleting or returning data at the end

While it uses Scout Suite, the Customer can download a full copy of its data at any time from Settings, Data export, and can delete individual records.

The Customer must export anything it wants to keep before its subscription ends. We don't provide exports after that. We keep the Customer's data until the subscription ends, and then for 60 days. After that we delete Customer personal data, including the conversation records held on vcon.store, unless the law requires us to keep it. Copies in our database backups are removed as the backups expire, within a further 30 days.

We keep our own billing and accounting records about the Customer for as long as the law requires. Our Privacy Policy covers those.

12. Information and audits

We give the Customer the information it reasonably needs to show that we meet our obligations under Article 28, for example by answering a security questionnaire or a Trustee Board's questions.

If that isn't enough, the Customer, or an independent auditor it appoints who is bound to confidentiality, can audit our compliance, including by inspection. The Customer must give at least 30 days' written notice, and audits can happen no more than once in any 12 months unless there has been a personal data breach or a regulator requires one. Audits must not disrupt the service or put other customers' data at risk. Each side pays its own costs.

13. Special category data and children

Scout Suite holds information about children, including medical and safeguarding information. We treat it with extra care:

• medical and other sensitive records are only shown to people whose role allows it;
• AI features only process it when someone uses a feature on a record that contains it;
• we never use it for marketing or analytics, and we never sell it.

The Customer must only record the special category data it needs, with a lawful basis and an Article 9 condition, and should set up roles so that only the right people can see it.

14. International transfers

We and our sub-processors may process Customer personal data outside the UK. When we do, we make sure data protection law allows the transfer, using one of these: a country the UK has approved, such as the EEA countries; the UK-US data bridge, for US companies certified to it; or the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU standard contractual clauses, with a transfer risk assessment. The sub-processor page says which applies to each company.

Phone calls are handled on our own servers in the UK.

15. Liability

Each party's liability under this DPA is subject to the limits in the Terms, except where data protection law doesn't allow liability to be limited.

16. Changes and general terms

We may update this DPA to reflect changes in the law or in Scout Suite. We will tell the Customer's admins about important changes at least 30 days before they take effect, and we won't make changes that reduce the protection of Customer personal data.

This DPA is governed by the laws of England and Wales, as the Terms are.

Questions about this DPA: privacy@scoutsuite.app.