Data Processing Agreement
The agreement (verwerkersovereenkomst) under which SSStudio processes personal data as a processor for an organisation that holds a LeraLink installation, in accordance with article 28 GDPR.
Last updated: 12 November 2026
1. Parties and status of this Data Processing Agreement
1.1 This Data Processing Agreement ("DPA") is between the customer named in the Order Form, as controller (the "Customer"), and SSStudio, trading as LeraLink, The Hague, the Netherlands, Chamber of Commerce (KvK) number 98779885, VAT identification number NL005352396B67 (postal address on request: legal@lera.link), as processor ("SSStudio").
1.2 This DPA forms part of the Customer Agreement between the parties. It applies to every Order Form, for a Pilot and for a Subscription, from the moment SSStudio first processes Customer Personal Data.
1.3 Terms that the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") defines, such as personal data, processing, controller, processor, data subject, personal data breach and supervisory authority, have the meaning given in the GDPR. Other capitalised terms have the meaning given in the Customer Agreement. In addition:
| Term | Meaning |
|---|---|
| Customer Personal Data | Personal data that SSStudio processes on behalf of the Customer in providing the Service for the Customer's Installation, as described in Annex 1. |
| Subprocessor | A processor engaged by SSStudio that processes Customer Personal Data. |
| Subprocessors and Recipients | The LeraLink register of that title, which is Annex 3 to this DPA. |
| Technical and Organisational Measures | The LeraLink document of that title, which is Annex 2 to this DPA. |
| Data Protection Law | The GDPR, the Dutch GDPR Implementation Act (Uitvoeringswet AVG) and other Union or Dutch law on the protection of personal data that applies to the processing. |
2. Roles of the parties
2.1 For Customer Personal Data, the Customer is the controller and SSStudio is the processor. The Customer determines the purposes and means of the processing in its Installation: who may be a member, what is published, which newsletters are sent, which content is restricted, and which AI Features are enabled under which AI Policy.
2.2 Where this DPA does not apply. SSStudio acts as a controller, and this DPA does not apply, for the following processing, which is described in the Privacy Statement:
- the platform-wide account with which a person signs in to one or more installations: email address, sign-in codes, passkeys, sessions, the record of documents the person accepted, and the list of the person's installations, which is never shown to any installation;
- the security of the Service, including prevention of abuse, rate limiting and the audit record of security-relevant actions;
- the customer relationship, contracts and invoicing;
- SSStudio's own website, the Hub and enquiries to SSStudio;
- SSStudio's own public-knowledge curation and discovery, including the Platform Record of concepts and entities, which is built from public sources such as Wikidata, Wikipedia and Wikimedia Commons and to which nothing from an Installation's content is written;
- the handling of notices of illegal content and other obligations that SSStudio has itself as a hosting service under Regulation (EU) 2022/2065 (the Digital Services Act).
2.3 Shared accounts and joint processing. Accounts are platform-wide: one person can be a member of several installations with the same account. An installation never sees another installation's memberships. The Customer receives from the shared account only what its Installation needs, such as the person's name and email address as a member. Where the parties together determine the purposes and means of a particular processing, they are joint controllers for that processing under article 26 GDPR. In that case they will set out their respective responsibilities in a written arrangement, and the essence of that arrangement will be made available to data subjects. Until such an arrangement exists, each party is responsible for the processing whose purposes and means it determines, as described in this DPA and in the Privacy Statement.
2.4 If SSStudio determines the purposes and means of a processing of Customer Personal Data in breach of this DPA, it is a controller for that processing (article 28(10) GDPR).
3. Subject matter, duration, nature and purpose
3.1 Subject matter. The processing of Customer Personal Data in providing the Service for the Customer's Installation: hosting, delivering and administering a multilingual knowledge site where the Customer's members write, translate, cite, review and publish Pieces, compose them into larger works, run editorial review, and send newsletters and notifications.
3.2 Duration. For the term of the Customer Agreement and afterwards until SSStudio has erased or returned Customer Personal Data in accordance with clause 12.
3.3 Nature. Collection through the Installation, recording, organisation, structuring, storage, adaptation (including translation and formatting), retrieval, consultation, use, disclosure by transmission and publication as the Customer configures, indexing for search, combination with other content of the Installation, restriction, backup, export, erasure and destruction.
3.4 Purpose. Providing the Service to the Customer under the Customer Agreement, including support the Customer asks for and the handling of incidents. SSStudio processes Customer Personal Data for no other purpose.
3.5 Types of personal data and categories of data subjects. These are described in Annex 1. The Customer decides what personal data it places in Customer Content. Where the Customer places special categories of personal data (article 9 GDPR) or personal data relating to criminal convictions and offences (article 10 GDPR) in the Installation, it is responsible for the lawfulness of that processing, and it uses Restricted Pieces where those data must not be public.
4. Documented instructions
4.1 SSStudio processes Customer Personal Data only on the documented instructions of the Customer, including with regard to transfers of personal data to a third country or an international organisation, unless Union or Dutch law to which SSStudio is subject requires otherwise. In that case SSStudio informs the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.
4.2 The Customer's documented instructions are:
- the Customer Agreement, this DPA and the Order Form;
- the settings that the Customer, through its Owners and administrators, makes in the Installation, including members, roles, access, restriction of Pieces, publication, newsletters, AI Features and their editorial instructions;
- the AI Policy recorded for the Installation;
- the actions that the Service offers to individuals for their own data in the Installation, which the Customer instructs SSStudio to carry out when an individual uses them: downloading their data, leaving the Installation, deleting their account, and asking for correction or removal of an AI-written description of themselves, each as described in Your Data Rights;
- other written instructions from the Customer's contacts named in the Order Form, sent to privacy@lera.link or support@lera.link.
4.3 SSStudio informs the Customer immediately if, in its opinion, an instruction infringes the GDPR or other Union or Dutch data protection provisions. SSStudio may suspend carrying out that instruction until the Customer confirms or changes it.
4.4 If an instruction goes beyond the functions of the Service as described in the Documentation, SSStudio may decline it or agree to carry it out at a reasonable charge agreed in advance. If SSStudio cannot comply with an instruction and the Customer does not change it, the Customer may terminate the affected Order Form by written notice.
4.5 The Customer is responsible for the lawfulness of its instructions, for having a legal basis for the processing, and for informing data subjects. The Installation Privacy Statement Template can help with the last.
4.6 Two limits apply to every instruction and are part of the Service as built: Restricted Pieces are never sent to any AI model, and SSStudio does not use Customer Personal Data to train AI models.
5. Confidentiality
5.1 SSStudio ensures that every person authorised to process Customer Personal Data has committed themselves to confidentiality or is under an appropriate statutory obligation of confidentiality.
5.2 Today the only person with access to Customer Personal Data on behalf of SSStudio is its owner, who is bound by the confidentiality obligations of the Customer Agreement and this DPA. Before any other person, employee or contractor, receives access, SSStudio binds that person to confidentiality in writing and gives them only the access their work requires.
5.3 SSStudio accesses Customer Personal Data only where needed to provide the Service, to give support the Customer has asked for, to handle an incident, or to comply with the law.
6. Security of processing
6.1 SSStudio takes the technical and organisational measures required by article 32 GDPR. They are described in the Technical and Organisational Measures (Annex 2), which take into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing, as well as the risks for the rights and freedoms of natural persons.
6.2 SSStudio may change the measures, provided that the overall level of security does not decrease. It publishes material changes in a new version of Annex 2.
6.3 Annex 2 states honestly which measures are in place, which are built but not yet required, and which are planned.
7. Subprocessors
7.1 General written authorisation. The Customer gives SSStudio general written authorisation to engage Subprocessors (article 28(2) GDPR). The Subprocessors engaged on the effective date are listed in the Subprocessors and Recipients register (Annex 3), with the service each provides, the data concerned and the location of processing. Details of the transfer basis for each are available on request (legal@lera.link).
7.2 Notice of changes. SSStudio informs the Customer of any intended addition or replacement of a Subprocessor at least 30 days before the new Subprocessor processes Customer Personal Data. It does so by email to the Owners of the Installation and to the privacy contact named in the Order Form, and by an Announcement on the Hub. The notice names the Subprocessor, its service, the data concerned, the location and the transfer basis. Adding an AI model provider to a model order that can serve the Installation is such a change.
7.3 Right to object. The Customer may object to the change on reasonable grounds relating to data protection, by writing to privacy@lera.link within the 30-day notice period. SSStudio then, within 14 days:
- does not use the new Subprocessor for the Customer's Installation; or
- proposes a change in configuration or another measure that addresses the Customer's objection, such as a different AI Policy or switching off the AI Feature concerned.
If neither is possible or acceptable to the Customer, the Customer may terminate the affected Order Form by written notice before the change takes effect, or within 30 days after SSStudio's response if that comes later. No fee for early termination applies, and Fees paid in advance for the period after termination are refunded. Clause 18 of the Customer Agreement (exit and switching) applies.
7.4 Urgent replacement. If a Subprocessor must be replaced at short notice because it can no longer provide its service securely or lawfully, SSStudio may engage a replacement before the 30 days have passed. It informs the Customer as soon as possible, with its reasons, and the Customer's right to object under clause 7.3 applies from that notice.
7.5 Flow-down. SSStudio engages each Subprocessor by a written contract that imposes data protection obligations which offer at least the same level of protection as this DPA, in particular sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the processing meets the requirements of the GDPR (article 28(4) GDPR). Where a Subprocessor offers only its standard terms, SSStudio assesses before engaging it that those terms meet this requirement.
7.6 Liability. Where a Subprocessor fails to fulfil its data protection obligations, SSStudio remains fully liable to the Customer for the performance of that Subprocessor's obligations, subject to clause 15.
7.7 Recipients that are not Subprocessors. When an author looks up a source, the search terms the author enters are sent to the public bibliographic services listed in the Subprocessors and Recipients register (such as Crossref, DataCite, OpenAlex, Open Library, Google Books, Wikidata and Wikimedia Commons, and, where the Customer has enabled it, a web search provider). When an author cites a web page, or a link in imported work is checked, only the web address is sent. No account information is sent. Where such a service acts as a processor for SSStudio, it is a Subprocessor and is listed as one.
8. Assistance with data subject rights
8.1 Taking into account the nature of the processing, SSStudio assists the Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling the Customer's obligation to respond to requests for exercising the data subject's rights under Chapter III of the GDPR (article 28(3)(e) GDPR).
8.2 The Service offers the following tools for this:
- the Installation's administration lets the Customer find, correct, export and remove member records, contacts and content;
- individuals can download their data, leave the Installation and delete their account themselves, as described in Your Data Rights;
- an individual can ask for correction or removal of an AI-written description of themselves; a removal takes the text out in every language and leaves a mark that every automatic process honours; a person's correction is kept beside the machine-made text and never overwritten.
8.3 If SSStudio receives a request from a data subject that concerns Customer Personal Data, it forwards the request to the Customer's privacy contact within three Business Days and does not answer it itself, except to tell the data subject that the request has been forwarded, or to point the data subject to a self-service tool. Where a request concerns both Customer Personal Data and data for which SSStudio is controller, SSStudio answers for its own part and forwards the rest.
8.4 SSStudio provides this assistance without charge, unless a request for assistance is manifestly unfounded or excessive, in which case SSStudio may charge a reasonable fee agreed in advance.
9. Assistance with articles 32 to 36 GDPR
9.1 Taking into account the nature of the processing and the information available to it, SSStudio assists the Customer in ensuring compliance with its obligations under articles 32 to 36 GDPR (article 28(3)(f) GDPR). In particular SSStudio:
- provides the Technical and Organisational Measures and answers reasonable questions about security (article 32);
- notifies personal data breaches as set out in clause 10, and provides the information the Customer needs to notify the supervisory authority and, where required, data subjects (articles 33 and 34);
- provides information about the Service that the Customer needs for a data protection impact assessment, including how AI Features and the knowledge layer work, and takes part in a reasonable number of consultations about it (article 35);
- provides information the Customer needs for a prior consultation of the supervisory authority (article 36).
9.2 Clause 8.4 applies to the cost of this assistance.
10. Personal data breaches
10.1 SSStudio notifies the Customer of a personal data breach affecting Customer Personal Data without undue delay, and in any case within 48 hours, after becoming aware of it.
10.2 SSStudio notifies the Owners of the Installation and the privacy and security contacts named in the Order Form by email, and by phone where the Order Form gives a number and the breach is serious. The notification includes, as far as the information is available:
- a description of the nature of the breach, including where possible the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
- the name and contact details of the contact point at SSStudio where more information can be obtained (privacy@lera.link);
- a description of the likely consequences of the breach;
- a description of the measures taken or proposed by SSStudio to address the breach, including, where appropriate, measures to mitigate its possible adverse effects.
10.3 Where it is not possible to provide all the information at the same time, SSStudio provides it in phases without undue further delay. SSStudio does not wait for a complete investigation before its first notification.
10.4 SSStudio takes the measures reasonably needed to contain the breach and to limit its consequences, and keeps the Customer informed until the breach is closed. SSStudio does not notify the supervisory authority or data subjects of a breach of Customer Personal Data on behalf of the Customer, unless the Customer asks it to in writing. Where the same incident also affects data for which SSStudio is controller, SSStudio meets its own obligations for that data.
10.5 SSStudio documents every personal data breach, its facts, its effects and the remedial action taken, and makes the record concerning the Customer available to it (article 33(5) GDPR).
10.6 Notifying a breach is not an acknowledgement of fault or liability.
11. International transfers
11.1 Customer Personal Data are stored in Cloudflare's European Union jurisdiction: the databases, files (images, audio, documents, export packages and backups), configuration and job queues. They are processed on Cloudflare's global network, usually in the data centre nearest the person making the request.
11.2 The following processing takes place, or may take place, outside the European Economic Area, as Annex 1 describes: the search index; temporary caches of configuration and public pages in Cloudflare's network; anonymous reading statistics; AI processing, as far as the Installation's AI Policy allows; email delivery by a provider established in the United States; and maintenance operations run on GitHub's infrastructure, which include restore rehearsals and the preparation of a masked copy of SSStudio's own Hub for its staging environment; both read a database backup in memory. Copies of the data that were held outside the European Union before the move of 3 November 2026 are kept unwritten until 3 December 2026 and are then deleted.
11.3 SSStudio transfers Customer Personal Data to a third country, or allows a Subprocessor to do so, only where:
- the European Commission has decided that the country, or the sector or organisation concerned, ensures an adequate level of protection (article 45 GDPR), including, for a recipient in the United States certified under it, the EU–US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795); or
- appropriate safeguards are in place under article 46 GDPR, in particular the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914, Module 3 (processor to processor) for transfers by SSStudio to a Subprocessor, together with the supplementary measures that a transfer impact assessment shows to be needed.
11.4 Details of the transfer basis for each Subprocessor are available on request (legal@lera.link). The Customer instructs SSStudio to make the transfers described in this clause and in Annex 1.
11.5 An Installation under the EU only AI Policy is left out of the search index, and can use only models hosted in the European Union and recorded as not training on inputs. The Customer can choose this policy, or the No external AI policy, to reduce transfers for AI processing.
12. Deletion or return at the end of the processing
12.1 At the end of the provision of the Service, SSStudio, at the choice of the Customer, returns Customer Personal Data to the Customer and then deletes it, or deletes it, and deletes existing copies, unless Union or Dutch law requires storage of the personal data (article 28(3)(g) GDPR).
12.2 Return is made through the export packages described in clause 18 of the Customer Agreement and in the Data Export and Exit Policy, in open formats (JSON and NDJSON, Markdown, HTML and CSV, with the original media files), during the Transition Period and a Data Retrieval Period of at least 30 calendar days.
12.3 After the Data Retrieval Period, SSStudio deletes Customer Personal Data from its live systems without undue delay, with a target of seven days and no later than 30 days after the end of that period. Deletion of a whole Installation is carried out by SSStudio as a documented operation, not by a self-service function. Backups that contain Customer Personal Data expire within 30 days after that deletion, at the end of their normal 30-day retention. Until then they remain protected under Annex 2 and are not used, except to restore the Service after a disaster, after which the Customer's data are deleted again. SSStudio confirms the deletion in writing on request.
12.4 SSStudio keeps the audit record of security-relevant actions, which it holds as controller for the security of the Service and to establish, exercise or defend legal claims, as described in the Privacy Statement. That record contains identifiers of the accounts that acted and what they did; it does not contain the content of Pieces.
12.5 Published works and their credits that the Customer moves to another provider are the Customer's to keep; this clause does not oblige the Customer to delete them.
13. Demonstrating compliance and audits
13.1 SSStudio makes available to the Customer all information necessary to demonstrate compliance with the obligations laid down in article 28 GDPR, and allows for and contributes to audits, including inspections, conducted by the Customer or another auditor mandated by the Customer (article 28(3)(h) GDPR).
13.2 Documentation first. SSStudio first provides documentation: this DPA and its annexes, Security Documentation and Assurance, written answers to a reasonable security questionnaire, and the certifications and audit reports that Cloudflare and other Subprocessors make available for their services. SSStudio does not hold an ISO 27001 or SOC 2 certification and has not yet had an independent penetration test carried out; Annex 2 states the current position.
13.3 Audit. If the documentation is not sufficient to demonstrate compliance, or if a supervisory authority requires it, the Customer may have an audit carried out:
- at most once per calendar year, unless a personal data breach affecting the Customer or a supervisory authority's request gives reason for a further audit;
- with at least 30 days' written notice to privacy@lera.link, stating the scope, the auditor and the proposed dates;
- remotely, or at SSStudio's place of business, during Business Days and support hours;
- by an independent auditor who is bound by confidentiality and who is not a competitor of SSStudio;
- without access to the data of other customers, to secrets such as keys and credentials, or to the infrastructure of Subprocessors, whose compliance is shown by their own reports.
13.4 The Customer bears the costs of the audit, including SSStudio's reasonable time at the hourly rate stated in the Order Form. If the audit shows that SSStudio has materially breached this DPA, SSStudio bears the reasonable costs of the audit and remedies the breach without delay at its own cost.
13.5 The auditor's report is Confidential Information of both parties. The Customer gives SSStudio a copy. The parties discuss the findings and agree a plan to address them within a reasonable time.
13.6 This clause does not limit the powers of a supervisory authority.
14. Other obligations
14.1 SSStudio keeps a record of the categories of processing it carries out on behalf of the Customer (article 30(2) GDPR) and makes it available to the supervisory authority on request.
14.2 SSStudio cooperates with the supervisory authority in the performance of its tasks (article 31 GDPR).
14.3 SSStudio has not appointed a data protection officer, because it is not required to under article 37 GDPR. Questions about data protection go to privacy@lera.link.
14.4 If a public authority asks SSStudio for access to Customer Personal Data, SSStudio refers the authority to the Customer where possible and informs the Customer without delay, unless the law prohibits this. SSStudio discloses only what it is legally required to, after checking that the request is lawful, and challenges a request where it has reasonable grounds to consider it unlawful.
14.5 The Customer informs SSStudio without undue delay if it becomes aware of an issue concerning the processing under this DPA, such as an incorrect configuration or a complaint by a data subject that SSStudio needs to know about.
15. Liability
15.1 The liability of each party under or in connection with this DPA is governed by clause 15 of the Customer Agreement, including its limits and its exceptions. This DPA does not create a separate or additional limit.
15.2 Nothing in this DPA or the Customer Agreement limits the rights of data subjects under article 82 GDPR. Where one party has paid full compensation to a data subject for damage for which the other party is wholly or partly responsible, it may claim back from the other party the part of the compensation corresponding to that party's part of the responsibility (article 82(5) GDPR).
16. Precedence
16.1 For every matter of data protection, this DPA prevails over the Customer Agreement, the Service Level Agreement, the Acceptable Use Policy and the Terms of Service. An Order Form changes a provision of this DPA only where it names that provision and states the change expressly.
16.2 If standard contractual clauses apply under clause 11.3, those clauses prevail over this DPA where they conflict.
17. Term, changes and governing law
17.1 This DPA starts when the first Order Form is signed, or earlier when SSStudio first processes Customer Personal Data, and continues for as long as SSStudio processes Customer Personal Data. Clauses 5, 10, 12, 13 and 15 continue to apply after the end of the Customer Agreement for as long as needed to give them effect.
17.2 SSStudio may change this DPA only with at least 30 days' notice as described in the Change Notification Policy. A change that reduces the protection of Customer Personal Data requires the Customer's written agreement, unless it is required by law, by a decision of a supervisory authority or court, or by new standard contractual clauses of the European Commission. If the Customer reasonably objects to a change required in that way, it may terminate the affected Order Form by written notice before the change takes effect.
17.3 This DPA is governed by Dutch law. Disputes are brought before the competent court in The Hague, as clause 26 of the Customer Agreement provides.
Annex 1 — Description of the processing
A. General
| Item | Description |
|---|---|
| Controller | The Customer named in the Order Form. Privacy contact: as named in the Order Form. |
| Processor | SSStudio, trading as LeraLink. Contact: privacy@lera.link. |
| Subject matter and purpose | As set out in clauses 3.1 and 3.4. |
| Duration | As set out in clause 3.2. |
| Storage location | Cloudflare's European Union jurisdiction, since 3 November 2026, for the databases, files, configuration and job queues. |
| Processing location | Cloudflare's global network, usually the data centre nearest the person making the request; and the locations in section D below. |
B. Categories of data subjects
| Category | Who they are |
|---|---|
| Members | People with an account who are members of the Installation in any role: readers, authors, translators, editors, reviewers, publishers and administrators, including Owners. |
| Contributors credited | People credited as author, translator, editor or in another role on a work, whether or not they are members. |
| Submitters and reviewers | People who submit work to a venue of the Installation, and people invited to review it. |
| Newsletter subscribers and contacts | People who subscribe to a newsletter or are otherwise recorded as a contact of the Installation. |
| Event participants | People who register for an event of the Installation. Depending on an event's settings, registered participants' names or pictures may be shown to others who see the event. |
| Commenters | People who comment on, annotate or react to content in the Installation. |
| Persons in content | People who are named, quoted, depicted or recorded in Customer Content, including people about whom the knowledge layer writes a description where the Customer has enabled it. |
| Readers | People who read the Installation's public pages; their reading is counted anonymously. |
C. Processing activities, personal data and retention
| Processing activity | Personal data | Data subjects | Retention |
|---|---|---|---|
| Hosting and delivering the Installation (public site, member area, Studio, administration) | All Customer Personal Data in Customer Content | All categories | For the term of the Customer Agreement and the exit periods; then clause 12 |
| Membership and access | Name and display name, email address as a member, profile picture, public profile address, biographies, interface and content language preferences, memberships, roles, grants and their expiry, invitations | Members | Until the member leaves the Installation, the member's account is deleted, or the Customer removes the member. Leaving removes the profile, preferences, contact relationship, sessions, roles and grants in the Installation |
| Writing, versions and collaboration | Authorship and contributor credits, version history with who made each version, working comments and collaboration events; presence during live editing is not stored | Members, contributors credited | As part of Customer Content. Published works and credits remain under the published name after a contributor's account is deleted, because they are also other people's record |
| Editorial review | Submissions, manuscripts, review invitations and reviews, decisions, acknowledgements, editors' internal notes; under blind review, reviewers' identities are not shown to authors | Submitters, reviewers, editors | As part of Customer Content |
| Comments, annotations and reactions | Text of the comment or annotation, author, time | Commenters | As part of Customer Content. When a person deletes their account, their comments remain without author and their reactions are removed |
| Newsletters and notifications | Email address, subscription date, language, the page where the person subscribed, subscription status; delivery records of the email provider; whether a message was opened and which links were followed, to measure reach. Members receive newsletters and publication email by default and can switch them off at any time in their settings or with the link in every message | Subscribers, contacts, members | Contact records until the person unsubscribes and the Customer removes the record, or the Customer deletes it; delivery records at the email provider: details are available on request (legal@lera.link) |
| AI Features | Text and images of Pieces sent to a model for the task the person asked for (translation, SEO suggestions, feature image, and proposals of a composition assistant that makes proposals only, where it is enabled for the Installation), and published text for the knowledge layer; never Restricted Pieces | Persons in content, contributors credited | Proposals and accepted output: as part of Customer Content. Providers: no training; limited retention for abuse detection where their terms provide it, as stated in the Subprocessors and Recipients register |
| Search index | Numerical representations (embeddings) of the text of Pieces, which can relate to persons named in them; never Restricted Pieces; not for Installations under the EU only AI Policy | Persons in content | Until the Piece is deleted, restricted or the Installation is removed from the index, and in any case at the end of the Customer Agreement under clause 12 |
| Knowledge layer, where the Customer enables it | Names of people that published text is about, links to public reference records, machine-written descriptions of them in the Installation's context, and corrections by people | Persons in content | As part of Customer Content. A removal request takes the description out in every language and leaves a mark that every automatic process honours. What the public reference service Wikidata answered for a name is kept for 30 days at platform level, so that it is not asked again |
| Source lookups | Search terms an author enters; no account information | Persons named in search terms | Search terms are used for the lookup only. The reference the author chooses is saved as part of Customer Content |
| Exports | Export packages of the Installation (content, people or both) and personal data packages that an individual asks for | All categories | Installation export packages: 7 days. Personal data packages: 7 days, then the file is deleted |
| Backup and restore | A logical backup of the whole database every night | All categories in the database | 30 days |
| Reading statistics | Anonymous counts of reading; designed not to contain personal data | Readers | Up to 3 months, then only totals |
| Support and incident handling | The Customer Personal Data needed to answer a support request or handle an incident | As needed | For as long as the request or incident is open; correspondence for the term of the Customer Agreement |
| Maintenance operations (restore rehearsals, platform moves, the masked staging copy of SSStudio's own Hub) | Backup data processed in memory on the runner during the operation. Only the masked copy of the Hub, which holds no other installation's rows, is kept, for one day, to load it into staging | All categories in the database | For the duration of the operation; the masked Hub copy one day |
D. Processing outside the European Union
| Processing | Location and safeguard |
|---|---|
| Request handling | Cloudflare's global network, usually the data centre nearest the person making the request. Data at rest stays in the European Union. |
| Temporary caches of configuration and public pages | Cloudflare's global network, for a short period. |
| Search index | Not held in the European Union. Not used for Installations under the EU only AI Policy. |
| Reading statistics | Not held in the European Union. Anonymous. |
| AI processing | Depends on the AI Policy: Cloudflare Workers AI on Cloudflare's network, OpenAI (translation, SEO suggestions, concept descriptions) and Google Gemini API, paid tier (images), which process outside the European Union. Under the No external AI policy, only Cloudflare models are used. |
| Email delivery | Sent from the Ireland region of a provider established in the United States. |
| Maintenance operations | GitHub Actions runners operated by GitHub (Microsoft), which may be outside the European Union: restore rehearsals, platform moves and the masked staging copy of SSStudio's own Hub. |
| Earlier copies | Copies held outside the European Union before 3 November 2026 are kept unwritten until 3 December 2026 and then deleted. |
Details of the transfer basis for each Subprocessor (clause 11.3) are available on request (legal@lera.link).
E. Data for which SSStudio is controller (for information)
These data are outside this DPA (clause 2.2) and are listed here so that the Customer has a complete picture. Their retention follows the Data Retention Schedule.
| Data | Retention |
|---|---|
| Sign-in codes | 1 day |
| Passkey challenges | 1 day |
| Used or expired passkey enrollment links | 30 days |
| Revoked passkeys | 90 days after revocation |
| Ended sessions | 30 days |
| Rate-limit counters (with a keyed hash of the IP address) | Deleted 7 days after their counting window ends |
| Audit record and record of accepted documents | Retained under legal hold, for the life of the account and after its deletion, as evidence |
| Invoices | 7 years (Dutch tax law) |
Annex 2 — Technical and Organisational Measures
The technical and organisational measures that SSStudio takes under article 32 GDPR are set out in the LeraLink document Technical and Organisational Measures, in the version in force. That document forms part of this DPA as Annex 2.
Annex 3 — Subprocessors and Recipients
The Subprocessors that SSStudio engages, and the recipients that are not Subprocessors, are listed in the LeraLink register Subprocessors and Recipients, in the version in force. That register forms part of this DPA as Annex 3. Changes to it follow clause 7.