GDPR — Data Processing

This page explains how 24SETUP DOO BACKA PALANKA, the company operating ScaleOcto, processes personal data on behalf of workspace owners under the EU General Data Protection Regulation (GDPR) and equivalent UK and Swiss data protection law.

Roles: Controller and Processor

If you create and manage a workspace on ScaleOcto, you act as the Controller for any personal data you collect from your own visitors, customers, or members through your workspace (“Customer Data”). ScaleOcto acts as your Processor: we process Customer Data only to provide the Services and on your instructions.

Your obligations as Controller

You are responsible for making sure you have a lawful basis and, where required, consent to collect and process the personal data you gather through your workspace, and for responding to requests from your own end users about their data.

How we process Customer Data

ScaleOcto processes Customer Data only to: perform the Services, act on your documented instructions, and comply with applicable law. We do not use Customer Data for our own marketing or sell it to third parties.

Sub-processors

ScaleOcto uses a limited number of sub-processors (such as hosting and infrastructure providers) to deliver the Services, each bound by data protection terms at least as protective as this policy. If we engage a new sub-processor, you may object in writing within five (5) business days of being notified, by contacting us at support@scaleocto.com.

Security measures

We maintain appropriate technical and organizational security measures designed to protect Customer Data against unauthorized access, loss, or disclosure.

Security incident notification

If we become aware of a security incident affecting your Customer Data, we will notify you without undue delay after becoming aware of it.

Data deletion

When you delete your workspace or account, we delete your Customer Data, except where we are required to retain it by law or where it remains for a limited time in backups before those backups are rotated out.

Assistance with data subject requests

If one of your end users contacts ScaleOcto directly about their personal data, we will not respond to them without your authorization, unless we are legally required to. We will forward the request to you and provide reasonable assistance so you can respond to it as Controller.

International data transfers

Customer Data may be transferred to and processed in Serbia and other countries where ScaleOcto or its sub-processors operate. Where required, we rely on appropriate safeguards for such transfers.

Questions

If you have questions about this page or need a signed Data Processing Agreement for your own compliance records, contact us at support@scaleocto.com.