Legal
Data Processing Addendum
This addendum applies where you use ChartForce as an organization and your use involves personal data protected by the GDPR, UK GDPR, or a comparable law. It supplements the Terms of Service and takes effect automatically — you do not need to sign anything, though we will countersign a copy on request.
1Scope of processing
| Item | Detail |
|---|---|
| Subject matter | Providing the ChartForce data visualization service. |
| Duration | For as long as your account is active, plus the retention periods in the Privacy Policy. |
| Nature and purpose | Storing and processing prompts, uploaded files and generated charts; transmitting the necessary parts to the subprocessors listed at Subprocessors; and publishing charts to the people and websites you configure, which is your instruction. |
| Types of personal data | Account identifiers and email addresses; any personal data contained in prompts, uploaded files or images that your users choose to submit. |
| Categories of data subject | Your authorized users, any individuals appearing in content they submit, and the people you invite to view a published chart. |
Someone you invite to view a chart signs in with an account of their own. For that account we are the controller, under the Privacy Policy; the invitation list itself is processed on your instructions under this addendum.
ChartForce is not designed to process special-category data, and you agree not to submit it.
2Our obligations
- We process personal data only on your documented instructions, which include your use of the service and any configuration you set. We tell you if an instruction appears to breach data-protection law.
- We ensure people authorized to process the data are bound by confidentiality.
- We implement appropriate technical and organizational measures — the current measures are described at Security.
- We assist you, taking account of the nature of processing, with responding to data-subject requests, with data-protection impact assessments, and with breach notification.
- We notify you without undue delay after becoming aware of a personal data breach affecting your data.
- We make available the information needed to demonstrate compliance with Article 28, and allow for audits as described below.
- On termination we delete your data according to the Privacy Policy's retention schedule, or return it — the account export gives you a machine-readable copy at any time.
3Subprocessors
You give general authorization for us to engage subprocessors. The current list is at Subprocessors, which also explains how to receive notice of changes and how to object. We impose data-protection obligations on each subprocessor no less protective than those in this addendum, and remain liable for their performance.
4International transfers
Where we transfer personal data out of the EEA, UK or Switzerland, the European Commission's Standard Contractual Clauses (Decision 2021/914) are incorporated into this addendum by reference, with the controller-to-processor module applying. The UK International Data Transfer Addendum applies to UK transfers, and the Swiss amendments to Swiss ones.
For the purposes of the Clauses: you are the data exporter and we are the data importer; the description of processing is the table above; the technical and organizational measures are those at Security; and general subprocessor authorization applies with 30 days' notice.
5Audits
We will respond to reasonable security questionnaires and provide documentation of our measures. Where that is genuinely insufficient for your regulatory obligations, we will accommodate an audit once in any 12-month period, on 30 days' notice, at your cost, conducted so as not to disrupt the service or compromise other customers' data.
6Data-subject requests
If a data subject contacts us directly about data we process for you, we will forward it to you rather than answer it, unless legally required to respond. The account export and deletion functions in Settings let you handle most requests yourself, immediately.
7Liability and precedence
Each party's liability under this addendum is subject to the limitations in the Terms of Service. Where this addendum conflicts with the Terms of Service on the processing of personal data, this addendum prevails; where it conflicts with the Standard Contractual Clauses, the Clauses prevail.
To request a countersigned copy, or to discuss terms for a Team agreement, email legal@chartforce.ai.