ScrumDo Data Processing Agreement (DPA)
Version: 2.0
Effective Date: January 1, 2019
Last Restated: July 11, 2026
This Data Processing Agreement (“DPA”) forms part of the ScrumDo Terms of Use (the “Agreement”) between ScrumDo, LLC (“ScrumDo,” “Processor,” “Service Provider,” or “Data Importer,” as applicable) and the customer identified in the applicable Order Form (“Customer,” “Controller,” “Business,” or “Data Exporter,” as applicable).
This DPA applies to ScrumDo’s Processing of Personal Data on behalf of Customer in connection with Customer’s use of the Services.
This DPA describes ScrumDo’s processor obligations when Personal Data is Processed under the Agreement. Customer instructions, including Account configuration, contribution routes, connected services, and feature use, must be consistent with the Terms of Use and applicable law. Sensitive or regulated deployments remain subject to any Enterprise review, Order Form, or additional written terms required by the Agreement.
If there is a conflict between this DPA and other terms in the Agreement regarding data protection, this DPA controls. For clarity, product access, project governance, eligibility, and data-handling requirements in the Terms of Use, an Order Form, or another written addendum are not displaced by this DPA. If the parties execute Standard Contractual Clauses (“SCCs”), the SCCs control to the extent of conflict regarding international transfers.
1. Definitions
Capitalized terms not defined herein have the meanings in the Agreement.
1.1 “Data Protection Laws” means all laws and regulations applicable to the Processing of Personal Data under the Agreement, including, where applicable: (a) GDPR; (b) UK GDPR and the UK Data Protection Act 2018; (c) Swiss data protection law; (d) applicable U.S. state privacy laws (including, where applicable, CCPA/CPRA) solely to the extent they apply to ScrumDo as a service provider/processor; and (e) any implementing or successor laws.
1.2 “GDPR” means Regulation (EU) 2016/679.
1.3 “UK GDPR” means GDPR as incorporated into UK law.
1.4 “Personal Data” means any information relating to an identified or identifiable natural person that is Processed by ScrumDo on behalf of Customer under the Agreement.
1.5 “Customer Data” means Content and other data submitted to or generated within the Services by or on behalf of Customer and/or its Authorized Users.
1.6 “Process” / “Processing” has the meaning given in GDPR.
1.7 “Subprocessor” means a third party engaged by ScrumDo to Process Personal Data on behalf of Customer in connection with the Services.
1.8 “Pilot Project” means a project, trial, pilot, proof-of-concept, evaluation, alpha, beta, or other pre-production offering expressly designated by ScrumDo or the Agreement as a pilot or non-production project.
1.9 “Security Incident” or “Personal Data Breach” means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data Processed by ScrumDo on behalf of Customer.
2. Details of Processing
2.1 Subject Matter. ScrumDo’s provision of the Services to Customer.
2.2 Nature of Processing. Hosting, storing, transmitting, analyzing, retrieving, and otherwise Processing Customer Data as necessary to provide the Services, including support, security monitoring, and feature delivery, in accordance with Customer instructions as reflected in the Agreement and Customer’s configuration and use of the Services.
2.3 Purpose of Processing. To provide the Services to Customer and as otherwise instructed by Customer through Customer’s use and configuration of the Services, and as permitted by the Agreement.
2.4 Duration of Processing. For the term of the Agreement and until deletion/return of Personal Data in accordance with Section 10 (Deletion/Return), unless retention is required by applicable law.
2.5 Categories of Data Subjects. Subject to the Agreement, Customer may submit Personal Data relating to individuals determined by Customer, which may include Customer’s employees, contractors, collaborators, customers, prospects, suppliers, research participants, and other individuals whose data Customer or its Authorized Users submit to the Services.
2.6 Categories of Personal Data. Determined by Customer and may include: identity and contact details; account and authentication data; usage and device data; Content submitted through Rooms, Boards, customer-contribution routes, or connected services (including work records, narratives, and interpretations); notification preferences, destination mappings, acknowledgement state, and delivery metadata; and other Personal Data included in Customer Data. Customer controls whether special categories of data are collected, subject to the Agreement.
2.7 Special Categories of Data. Where permitted by the Agreement, Customer may choose to collect special categories of data (GDPR Art. 9) through its prompts or content. Customer is responsible for ensuring a lawful basis and appropriate safeguards for any special category data it submits.
2.8 Transcription, Translation, and PII Redaction Processing (If Enabled). Certain features may use third-party services for transcription, translation, PII redaction, or other feature processing to deliver user-requested functionality. Where enabled by Customer, Customer Data may be transmitted to Subprocessors for feature processing consistent with the Agreement, this DPA, and the Subprocessors List. AI Processing. (a) Local agents (BYOA): Where Customer runs a connected agent on Customer-controlled infrastructure under Customer's own provider credentials, ScrumDo does not transmit Customer Personal Data to the model provider. (b) Customer-configured AI: Where Customer enables an AI feature that uses a provider and credentials Customer configures, ScrumDo transmits the relevant Customer Data to that provider on Customer's documented instructions and using Customer's credentials. The provider operates under Customer's account and agreement and is not engaged by ScrumDo as a Subprocessor for that connection. Customer is responsible for the lawfulness of the instruction, the provider's terms and processing location, any required transfer safeguards, and determining the provider's role under Data Protection Laws. ScrumDo transmits only the Customer Data and feature inputs Customer configures and instructs ScrumDo to process; ScrumDo does not independently select or add Personal Data to the Content Customer directs to that provider. (c) ScrumDo operational AI: Where ScrumDo uses AI under its own provider account, such as for support assistance, that provider is ScrumDo's Subprocessor under Annex III and processes Customer Data only as needed to provide that operational feature. ScrumDo does not warrant the accuracy of any automated or AI-assisted output.
2.9 Notifications and Connected Destinations (If Enabled). Customer may instruct ScrumDo to route selected notification content and metadata to email, SMS, WhatsApp, Slack, Microsoft Teams, push, or webhook destinations. Customer is responsible for the lawfulness of that instruction, destination authorization, recipient and workspace mappings, channel consent, and the terms and processing location of any provider configured under Customer's own account. Where ScrumDo engages the delivery provider, that provider is a Subprocessor and is identified on the Subprocessors List.
3. Roles of the Parties
3.1 Customer as Controller. Customer is the Controller of Personal Data within Customer Data and is responsible for: (a) determining the purposes and means of Processing; (b) ensuring a lawful basis for Processing; (c) providing required notices; and (d) ensuring that its instructions comply with Data Protection Laws.
3.2 ScrumDo as Processor / Service Provider. ScrumDo Processes Personal Data on behalf of Customer as a Processor (and, where applicable under U.S. state privacy laws, as a “service provider” / “processor”) in accordance with Customer’s documented instructions.
3.3 Customer Instructions. Customer’s instructions are: (a) the Agreement and this DPA; and (b) Customer’s configuration and use of the Services. Additional or materially different instructions require prior written agreement.
3.4 Compliance with Law. If ScrumDo believes Customer’s instructions violate Data Protection Laws, ScrumDo will notify Customer. If ScrumDo is required by law to Process Personal Data in a way that conflicts with Customer’s instructions, ScrumDo will (to the extent permitted by law) notify Customer and limit Processing to what is required.
4. ScrumDo Obligations as Processor
4.1 Process on Instructions. ScrumDo will Process Personal Data only on documented instructions from Customer as described in Section 3.3.
4.2 Confidentiality. ScrumDo will ensure that personnel authorized to Process Personal Data are bound by confidentiality obligations.
4.3 Security Measures. ScrumDo will implement and maintain appropriate technical and organizational measures designed to protect Personal Data against a Personal Data Breach. A description of measures is provided in Annex II (Security Measures).
4.4 Personal Data Breach Notification. ScrumDo will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Personal Data Processed on behalf of Customer and will provide reasonable information available to ScrumDo to support Customer’s compliance obligations.
4.5 Assistance. Taking into account the nature of Processing and information available to ScrumDo, ScrumDo will provide reasonable assistance to Customer for:
(a) Data Subject requests (Section 9);
(b) security and breach notification obligations (Section 4.4); and
(c) DPIAs and prior consultation (Section 8), to the extent required by Data Protection Laws.
Customer will reimburse ScrumDo for commercially reasonable costs for assistance beyond what is included in the Services, where permitted by law and agreed in writing.
4.6 No Sale / No Sharing for Independent Benefit (U.S. state privacy). Where applicable, ScrumDo will not: (a) sell Personal Data; (b) retain, use, or disclose Personal Data for purposes other than providing the Services under the Agreement; or (c) combine Personal Data from Customer with Personal Data from other customers, except as permitted by applicable law and consistent with the Agreement for security, fraud prevention, and compliance. Product-improvement uses of Customer Data are limited by Section 10.4 and the de-identified, aggregated, or obfuscated data terms in the Agreement.
5. Subprocessors
5.1 Authorized Subprocessors. Customer authorizes ScrumDo to engage Subprocessors to provide the Services. A current list is available at: /legal/data-subprocessors (the “Subprocessors List”).
5.2 Subprocessor Obligations. ScrumDo will enter into a written agreement with each Subprocessor that imposes data protection obligations consistent with ScrumDo’s obligations under this DPA, including confidentiality and appropriate security measures.
5.3 Changes and Objections. ScrumDo may update the Subprocessors List from time to time. Where required by Data Protection Laws, ScrumDo will provide Customer a mechanism to object to new Subprocessors on reasonable data protection grounds. If the parties cannot resolve an objection, Customer may terminate the affected Services as provided in the applicable Agreement/Order Form for that subject matter.
5.4 Liability for Subprocessors. ScrumDo remains responsible for its Subprocessors’ performance of their obligations under this DPA to the extent required by Data Protection Laws.
6. International Transfers
6.1 Processing Locations. Customer acknowledges ScrumDo may Process Personal Data in the United States and other locations where ScrumDo and its Subprocessors operate, as necessary to provide the Services and subject to the applicable service configuration, Order Form, proposal, or security review commitments.
6.2 Transfer Mechanisms. Where Data Protection Laws require a transfer mechanism for transfers of Personal Data to countries without an adequacy decision, the parties agree the applicable mechanism(s) may include:
the EU SCCs (Commission Implementing Decision (EU) 2021/914), as incorporated by reference in Annex IV; and/or
the UK Addendum to the EU SCCs (or UK IDTA, as applicable) in Annex V, except that Annex V does not apply to Pilot Projects unless the parties expressly agree otherwise in writing; and/or
Swiss transfer addenda where applicable.
6.3 Conflicts. For transfers subject to SCCs, the SCCs control to the extent required by applicable law.
6.4 Transfer Impact and Supplementary Measures. ScrumDo will implement supplementary measures where appropriate and will make available reasonable information to support Customer’s transfer assessments, consistent with confidentiality and security constraints.
7. Audits and Compliance Information
7.1 Information. ScrumDo will make available to Customer information reasonably necessary to demonstrate compliance with this DPA, consistent with confidentiality obligations and security considerations.
7.2 Audit Requests. Where required by Data Protection Laws, Customer may request an audit. Any audit will:
(a) be limited in scope to Processing of Personal Data under this DPA;
(b) be conducted at reasonable times with at least 30 days’ notice;
(c) not unreasonably interfere with ScrumDo operations;
(d) be performed by Customer or an independent auditor bound by confidentiality; and
(e) be subject to ScrumDo’s reasonable security and confidentiality requirements.
7.3 Costs. Customer bears costs of audits unless otherwise required by law or agreed in writing.
8. DPIAs and Prior Consultation
To the extent required by Data Protection Laws and taking into account the nature of Processing and information available to ScrumDo, ScrumDo will provide reasonable assistance to Customer with DPIAs and prior consultation with supervisory authorities, limited to Processing under this DPA.
9. Data Subject Requests
9.1 Customer Responsibility. Customer is responsible for responding to Data Subject requests as Controller.
9.2 ScrumDo Assistance. ScrumDo will provide reasonable assistance, taking into account the nature of Processing and available information, to enable Customer to respond to Data Subject requests, to the extent required by Data Protection Laws.
9.3 Direct Requests to ScrumDo. If ScrumDo receives a Data Subject request relating to Personal Data under Customer’s control, ScrumDo will, where legally permitted, direct the Data Subject to Customer and notify Customer.
10. Deletion or Return of Personal Data
10.1 Deletion/Return. Upon termination or expiration of the Agreement, ScrumDo will delete or return Personal Data Processed under this DPA as described in the Agreement and applicable Order Form, unless retention is required by law.
10.2 Backups and Residual Copies. Personal Data may persist in backups for a limited period consistent with ScrumDo’s backup and retention practices. During that period, ScrumDo will protect such data and limit access consistent with this DPA.
10.3 Customer Deletion Requests. Where the Services provide deletion functionality, Customer may delete Personal Data through the Services. ScrumDo will implement deletions within the Services as designed, subject to technical constraints and legal requirements.
10.4 De-identified Data Carve-Out; BAA Boundary. (Restating practice in effect since January 1, 2019.) Any rights ScrumDo may have under the Agreement (including the Terms of Use) to create or use de-identified, aggregated, or obfuscated data for service improvement do not apply to (a) Personal Data covered by a Business Associate Agreement (BAA), including Protected Health Information; (b) Content designated by Customer as private or confidential; or (c) data otherwise restricted by an Order Form, SOW, or this DPA. Where a BAA is in place, the BAA controls and ScrumDo will not derive de-identified datasets from BAA-covered Personal Data except as expressly permitted by the BAA and applicable law.
10.5 Purge Privileges Tied to Account Status. (Restating practice in effect since January 1, 2019.) Extended retention windows, controlled-purge timing, and post-termination export concessions made available under the Agreement are conditioned on Customer being on a paid plan and in good standing. This Section 10.5 does not reduce Customer's rights under applicable Data Protection Laws, a BAA, or any executed Order Form.
11. Confidentiality of this DPA
The terms of this DPA and any compliance materials provided under Section 7 may be treated as confidential information of ScrumDo unless otherwise required to be disclosed by law.
12. Liability
12.1 Agreement Controls. Liability under this DPA is subject to the limitation of liability provisions in the Agreement, except where prohibited by Data Protection Laws.
12.2 SCC Liability. Where SCCs apply, liability allocation within the SCCs governs to the extent required.
13. Governing Law; Venue (Georgia) - with SCC Carve-Out
13.1 Governing Law. Except as expressly required for SCCs or other mandatory transfer mechanisms, this DPA and any disputes arising from it are governed by the laws of the State of Georgia, without regard to conflict of law principles.
13.2 SCC Carve-Out. To the extent SCCs require governance by the law of an EU Member State (and/or UK law for the UK Addendum), the SCCs/UK Addendum govern for that limited purpose only.
14. Updates
ScrumDo may update this DPA to reflect changes in law or transfer mechanisms. If Customer has an active paid subscription, ScrumDo will provide notice of material updates via email or in-app notification. Continued use of the Services after the effective date of the update constitutes acceptance where permitted by law; otherwise, updates will apply upon renewal or execution of an updated Order Form.
Annex I - Details of Processing
A. Subject Matter: Provision of the Services to Customer.
B. Duration: Term of Agreement plus deletion/return period per Section 10.
C. Nature of Processing: Hosting, storage, transmission, retrieval, analysis, support, security monitoring, and feature delivery.
D. Purpose: Provide Services and related support/security as instructed by Customer.
E. Categories of Data Subjects: Employees, contractors, collaborators, customers, prospects, suppliers, research participants, and other individuals whose data Customer submits.
F. Categories of Personal Data: Contact information, account/authentication data, device/usage data, Content submitted through Accounts, Rooms, Boards, contribution routes, or connected services (including work records, narratives, and interpretations), and any Personal Data included in Customer Data, subject to the Agreement.
G. Special Categories: Only if Customer is permitted to collect them under the Agreement; Customer responsible for lawful basis and safeguards.
Annex II - Technical and Organizational Security Measures (Summary)
ScrumDo maintains a security program designed to protect Personal Data, which may include measures such as:
access controls and least-privilege administration;
authentication controls and credential management;
encryption in transit and (where applicable) at rest;
logging and monitoring for security events;
vulnerability management and patching practices;
secure development practices and change management;
incident response procedures; and
backups and availability controls.
Detailed security documentation may be made available to enterprise customers under an appropriate confidentiality arrangement.
Annex III - Subprocessors
The current list of Subprocessors is maintained at:
/legal/data-subprocessors
Customer acknowledges this list may change over time as described in Section 5.
Annex IV - EU Standard Contractual Clauses (SCCs)
Where required for transfers of Personal Data from the EEA to third countries without an adequacy decision, the parties incorporate the EU SCCs (Commission Implementing Decision (EU) 2021/914) by reference as follows:
Module Two (Controller to Processor) applies where Customer is Controller and ScrumDo is Processor.
Module Three (Processor to Processor) applies where Customer is Processor and ScrumDo is Processor/Subprocessor (if applicable).
The parties will complete or deem completed the SCC annexes as follows:
Annex I (SCC): consistent with Annex I of this DPA
Annex II (SCC): consistent with Annex II of this DPA
Annex III (SCC): Subprocessors consistent with Annex III of this DPA
Where the SCCs require selection of options, the default selections are:
audits: per Section 7 of this DPA;
onward transfers: permitted subject to Subprocessor controls (Section 5) and transfer safeguards (Section 6).
If Customer requires a signed copy of the SCCs with completed fields, ScrumDo will provide it upon reasonable request.
Annex V - UK Addendum (UK GDPR)
Where required for transfers subject to UK GDPR, and except for Pilot Projects unless the parties expressly agree otherwise in writing, the parties incorporate the UK International Data Transfer Addendum to the EU SCCs (or successor mechanism) by reference. The EU SCCs as incorporated in Annex IV will apply, as modified by the UK Addendum.
Annex VI - Optional U.S. Education Data (FERPA) Note (If Applicable)
If Customer is an educational institution subject to FERPA and Customer submits Education Records as Personal Data, Customer remains responsible as Controller for FERPA compliance and for determining whether ScrumDo is acting as a “school official” under Customer’s policies. ScrumDo will Process such data only as instructed and consistent with this DPA and the Agreement. Additional FERPA terms, if required, should be addressed in an Order Form or addendum.