Legal
Data processing addendum
Draft. This page is waiting for legal review before Sastra Cloud accepts paying customers.
This addendum is part of the terms of service. It applies when your organization (the “controller”) uses Sastra Cloud to process personal data, and Lectio (the “processor”) processes that data on your behalf.
1. Subject and duration
Lectio processes personal data contained in your workspace for as long as the workspace exists, plus the 30-day retention period after cancellation or suspension.
2. Nature and purpose
Hosting, storage, backup, transmission (including email sent to and from the correspondence address), and the AI processing described in the privacy policy, all for the purpose of providing the service.
3. Types of data and data subjects
Names, email addresses, roles, messages, documents, agreements, financial figures, and correspondence relating to your teammates, publishers, printers, funders, rights holders and other contacts your team records.
4. Your instructions
Lectio processes personal data only on your documented instructions, which are these terms and the way you and your team use the service. If Lectio believes an instruction breaks the law, it will tell you.
5. Confidentiality
People authorized by Lectio to process the data are bound by confidentiality. Access to workspace content is limited to what is needed to provide support you asked for.
6. Security
Lectio applies measures appropriate to the risk: one isolated database and storage bucket per workspace; encryption in transit and at rest; encrypted backups kept 30 days; secrets stored sealed; access to production limited to named administrators with multi-factor authentication; logging of administrative access; and dependency and code scanning on every release.
7. Subprocessors
You authorize the subprocessors listed on the subprocessors page. Lectio will announce a new subprocessor by email at least 30 days before it starts processing your data, and you may object; if the objection cannot be resolved, you may cancel and export your data.
8. Data subject requests
Lectio will help you answer requests from data subjects, mainly by giving you the export and deletion tools in the product, and by forwarding requests it receives directly.
9. Breach notification
Lectio will tell you without undue delay, and within 72 hours of becoming aware, if a personal data breach affects your workspace, with what it knows at the time and updates as it learns more.
10. Deletion and return
At the end of the service you may export the full database and all files. Lectio deletes the workspace and its backups 30 days after cancellation or suspension, unless the law requires it to keep some data longer.
11. Audits
Lectio will make available the information needed to show it meets these obligations, and will allow audits by you or an auditor you appoint, at reasonable intervals and with reasonable notice, at your cost.
12. International transfers
Data is stored in the region you choose. Some subprocessors operate from other countries; transfers rely on standard contractual clauses or an adequacy decision, as noted on the subprocessors page.