Data processing agreement

This data processing agreement ("DPA") is part of the terms of use between SCOI Technologies Private Limited ("Sharelatch", the "processor") and each account holder ("you", the "controller"). It applies automatically when you use Sharelatch. It covers the personal information of the people who open your links ("viewers") and of anyone you invite to your workspaces.

It's written to meet Article 28 of the EU and UK General Data Protection Regulation and India's Digital Personal Data Protection Act, 2023, where they apply.

1. What we process


Purpose	Showing your documents to viewers, recording reading activity for you, sending you alerts, and keeping the service secure
People	Viewers of your links, and members you invite
Information	When a link was opened; reading time per page or section; how far they read; rough place (country, region, city); device type, browser and system; shortened and (for 30 days, for security only) full IP address; email address if your link asks for one; a random browser ID where tracking is allowed
Sensitive information	None is needed. Don't ask viewers for it through Sharelatch
How long	While your account is open, within your plan's limits (view details up to a year; full IP addresses 30 days), then deleted. On account closure, within 30 days, and backups within a further 30 days

2. Your responsibilities

You decide why and how viewer information is used, and you're responsible for having a lawful basis for it.
Sharelatch tells viewers that reading is recorded, and in the European Economic Area, the UK, Switzerland and (from May 2027) India, asks them first, as described in the viewer privacy notice. Don't remove or work around these steps.
If your own privacy notice to viewers is needed, you provide it.

3. Our responsibilities

We will:

process the information only on your instructions, which are these terms and your settings in the app, unless the law requires otherwise (and then tell you, where allowed);
make sure everyone at Sharelatch who can reach it is bound to keep it confidential;
keep it secure, with encryption in storage and in transit, hashed sign-in codes, encrypted backups, a production database not reachable from the internet, and access limited to the people who run Sharelatch;
use only the companies on services we use, under contracts with at least the same protections, and tell you about changes in advance on that page, so you can object;
help you answer viewers' requests to see, correct or delete their information (viewers can also write to us; we'll pass requests to you or act on your instructions);
tell you without undue delay, and within 72 hours of becoming aware, if a breach affects your viewers' information;
help you with impact assessments and regulators' questions where reasonably needed;
delete the information when you delete it or close your account, as in section 1;
give you the information needed to show we meet this DPA, and answer reasonable questions about it.

4. Transfers

Information is processed in Singapore, India and on Cloudflare's worldwide network. For transfers of information about people in the European Economic Area, the UK or Switzerland to countries without an adequacy decision, the European Commission's standard contractual clauses (module two, controller to processor, and module three where we use subprocessors), with the UK addendum where needed, apply between you and us and are part of this DPA.

5. Order of documents

If this DPA and the terms of use disagree about personal information, this DPA wins.

Contact

hello@sharelatch.com