In short
- When your company puts personal data into BlackSlate, such as scripts, writer details or submissions, you are the controller and we process it for you.
- We process it only on your instructions, keep it secure, use only the sub-processors we list, and help you meet your obligations.
- This addendum forms part of the Terms of Service for business customers.
The summary is for convenience; the full text below is what applies.
1. Scope and roles
This addendum applies where BlackSlate AI Ltd processes personal data on behalf of a customer that uses the Service for business ("Customer Personal Data"). The customer is the controller and BlackSlate is the processor. It forms part of our Terms of Service. Where we process personal data for our own purposes, such as billing and account administration, we are a controller and our Privacy Policy applies.
2. Details of the processing
| Subject matter | Providing the Service under the Terms of Service |
| Duration | For as long as the customer uses the Service, and until deletion under section 9 |
| Nature and purpose | Hosting, storage, display, sharing, analysis (including by our AI provider) and transmission, to provide the features the customer uses |
| Types of personal data | Names, contact and professional details, and personal data contained in scripts, drafts, notes, comments, deal records and submissions |
| Data subjects | The customer's users, writers, agents, collaborators, and people referred to in the customer's content |
3. Our obligations
- Process Customer Personal Data only on the customer's documented instructions, including those in the Terms of Service and given through the Service, unless the law requires otherwise, in which case we will tell the customer unless the law forbids it.
- Make sure everyone authorised to process it is bound by confidentiality.
- Apply appropriate technical and organisational security measures, described in section 5.
- Help the customer respond to requests from data subjects exercising their rights.
- Help the customer with security, breach notification, data protection impact assessments and consultation with the regulator, taking into account the information available to us.
- Make available the information reasonably needed to show we meet this addendum.
4. Sub-processors
The customer authorises us to use the sub-processors listed on our sub-processors page. We will update that page before adding or replacing a sub-processor, and the customer may object on reasonable data protection grounds. We impose data protection terms on each sub-processor that are no less protective than this addendum, and remain responsible for their performance.
5. Security
Our measures include encryption of data in transit, encrypted storage, access controls that keep each customer's data separate at the database level, server-side handling of privileged credentials, and restricted staff access. We review these measures as the Service and the risks change.
6. Personal data breaches
We will tell the customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, with the information the customer reasonably needs to meet its own obligations.
7. International transfers
Customer Personal Data is stored in the United Kingdom. Where a sub-processor processes it outside the UK, we rely on UK adequacy regulations or on the UK International Data Transfer Agreement or Addendum.
8. Audits
On reasonable notice, we will answer the customer's written questions about our compliance with this addendum. Where that is not enough to show compliance, and no more than once a year, we will agree a reasonable audit at the customer's cost.
9. Deletion
When the customer closes its account, or on request, we will delete Customer Personal Data from our live systems, after allowing the customer to export it, unless the law requires us to keep it. Backup copies are overwritten in the normal cycle.
10. Contact
Data protection questions: legal@blackslate.ai.