Team terms (DPA)

Draft for racegenie.app. Version 1. Last updated: [DATE]. For a solicitor's review before it is relied on [SOLICITOR: review the whole document]. Not legal advice.

These terms are between Genie Dynamics Ltd, company number 17494764, registered office 128 City Road, London, EC1V 2NX ("we", "us") and the team that uses GenieCloud ("the team", "you"). The team owner accepts them for the team on the team website, before the team is created, and again when a new version is published. We record who accepted, which version and when.

The terms of use (https://cloud.racegenie.app/terms) and the privacy policy (https://cloud.racegenie.app/privacy) also apply. If they conflict with this document about the team's data, this document wins.

Part 1. Team terms

The service

GenieCloud is the team cloud behind raceGENIE (the Mac app) and myRaceGENIE (the driver app): sync between the team's Macs, backups, video copies, plans and timetables shared with drivers, timing and AI analysis. What a plan includes is shown on the team website.

The owner's responsibilities

• The owner manages the team's members, roles, invitations and sharing settings, and keeps them up to date.
• The owner makes sure the team has the right to put each item into GenieCloud, and a lawful basis for the personal data it records about its drivers, crew and other people (including a parent or guardian's permission for drivers under 18).
• The team tells its drivers and crew how it uses their data (its own privacy notice). It may point them to our privacy policy for the parts we control.
• The team does not put health data or other special category data into notes, uploads or plans. A medical check or emergency contact the team keeps in raceGENIE stays on the team's own Mac and is never sent to GenieCloud.

Payment and ending

Plans, prices and payment are on the team website (Stripe). If the paid plan ends, the team's data is read-only for 90 days and then the cloud copy is deleted; if the owner deletes the team, it closes after a cooling-off period and is erased 90 days later (see Part 2, section 9). Export the team's data before deleting the team.

Liability

Our liability to the team is as set out in the terms of use [SOLICITOR: set a business-to-business cap here, for example the fees paid in the previous 12 months].

Part 2. Data processing agreement (UK GDPR Article 28)

1. Roles

For the team's data (section 3), the team is the controller and we are its processor. We process it only to provide GenieCloud to the team.

We are a controller, not a processor, for: user accounts and sign-in, myRaceGENIE driver profiles and a driver's own uploads, the iPhone app, billing, support and security records. The privacy policy covers those.

2. Subject matter and duration

The subject matter is the hosting, sync, backup, sharing and analysis of the team's data in GenieCloud. This agreement lasts as long as we hold the team's data: while the team uses GenieCloud, and after it ends until the data is deleted (section 9).

3. Nature and purpose; types of data; data subjects

4. Our obligations

We will:

1. Instructions. Process the team's data only on the team's documented instructions. The team's instructions are this agreement and what the team does in the service (its settings, sharing, uploads and deletions). If we are required by law to do otherwise, we will tell the team first unless the law forbids it. We will tell the team if we think an instruction breaks data protection law.
2. Confidentiality. Make sure anyone we authorise to handle the team's data is bound to confidentiality. Our staff see a team's data only while a team owner has given support access, for a limited time; each look is logged in the team's audit log, and staff see counts and settings, never laps, notes, profiles or video.
3. Security. Keep the measures in section 5 (or ones at least as good).
4. Sub-processors. Use only the sub-processors in section 6, under section 6's rules.
5. Data subjects' requests. Help the team, as far as the service allows, to answer requests from its data subjects (access, correction, deletion, objection, restriction, portability). The team export gives the team a copy of its data. If a request comes to us, we will pass it to the team without undue delay and will not answer it ourselves unless the team asks.
6. Other help. Help the team, taking into account what we know, with security, breach notification, data protection impact assessments and prior consultation with the ICO.
7. Breaches. Tell the team owner without undue delay after we become aware of a personal data breach affecting the team's data, with what we know then (what happened, the data and people affected, likely consequences, what we are doing), and more as we learn it.
8. Deletion and return. At the end, delete or return the team's data as in section 9.
9. Information and audits. Make available the information needed to show we meet Article 28, and allow and contribute to audits by the team or an auditor it appoints, on reasonable notice, at reasonable times, under confidentiality, no more than once a year unless there has been a breach or the ICO requires it [SOLICITOR: check audit terms]. We may answer first with documents (this agreement, our security summary, our sub-processor list).

5. Security measures

What is built today:

• Location. The team's data is held by Amazon Web Services in London (eu-west-2). The website files are served through AWS CloudFront.
• Encryption. In transit, every connection uses TLS. At rest, the database (Aurora PostgreSQL) and the storage buckets (S3) are encrypted with keys in AWS Key Management Service (KMS).
• Field-level encryption. The most sensitive values are encrypted again with their own KMS key, bound to the record and field: a driver profile's licence and weight, and the entry snapshots a team keeps for a meeting.
• Separation between teams. Postgres row-level security checks, on every request, that a person reads only their own teams' rows; the API repeats the checks. The team's Macs sign in with their own revocable device keys.
• Roles. Owners, managers, engineers, crew, drivers and viewers see what their role allows; what drivers see of plans and laps is set by the team.
• Audit. The team's audit log records who changed what, sharing changes, reads of driver profiles, and every support look. AWS CloudTrail records administrative actions on the cloud accounts.
• Backups. Database backups are kept for 35 days. Earlier versions of stored files are kept for 30 days after they are replaced or deleted.
• Data minimisation. GenieCloud holds no date of birth, licence number, emergency contact or medical data.
• Testing. Cross-team access is tested by an automated leak test against the running service. An independent security review is planned [CONFIRM before relying on it].

6. Sub-processors

The team gives general authorisation for us to use these sub-processors:

We have a written contract with each that gives at least the protection of this agreement. Transfers to the United States rely on [CONFIRM WITH EACH: the UK-US data bridge, or the international data transfer agreement or UK addendum].

Changes. We will tell the team owner at least [NOTICE PERIOD: 30] days before we add or replace a sub-processor (by email and on the team website). The team may object on reasonable data protection grounds within that time. We will then try to resolve it; if we cannot, the team may end the paid plan and receive a pro-rata refund of any prepaid fees [SOLICITOR: check]. We remain responsible to the team for our sub-processors.

7. International transfers

We do not move the team's data out of the UK except to the sub-processors above, under the safeguards named there.

8. The team's obligations

The team's instructions must be lawful. The team is responsible for having a lawful basis for the personal data it puts into GenieCloud, for telling its data subjects, and for answering their requests.

9. At the end: deletion and return

• Before the end: the team owner can export the team's data at any time (team website, Settings, Team data). The export lists the backed-up library files and video copies with download links.
• When the paid plan ends: the data stays read-only for 90 days, and the owner can still export it. Then the cloud copy is deleted: database rows, library backups and video copies.
• When the owner deletes the team: after the cooling-off period (when the deletion can still be cancelled), nobody can open the team any more, so export before deleting. The data is erased 90 days after the deletion.
• Backups: deleted data leaves the database backups within 35 days, and earlier versions of stored files within 30 days.
• Copies on the team's Macs are the team's own and are not affected.
• We keep only what the law requires us to keep (for example billing records), and the team's audit log entries that record the deletion.

10. Changes to this agreement

We will publish a new version and tell the team owner before it takes effect. The team owner is asked to accept the new version on the team website.

11. Law

English law applies. The courts of England and Wales have jurisdiction [SOLICITOR: check].