Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between CMS Group, a sole proprietorship of Chaudhary Shivam Panwar, GSTIN 05EKTPP4834G1ZO, of 01, Teachers Colony, Sahaspur, Dehradun, Uttarakhand 248197, India, offering IdeaScore ("IdeaScore", "Processor"), and the customer organisation that has accepted the Terms of Service or signed an Order Form ("Customer", "Controller"), together the "Agreement". It applies automatically when the Customer accepts the Terms of Service. A Customer that needs a countersigned copy can ask at legal@ideascore.online.

It is published at /legal/dpa and is written to meet section 8(2) of the Digital Personal Data Protection Act, 2023 and Article 28 of the GDPR.

1. Definitions

1.1 Capitalised terms not defined here have the meaning given in the Terms of Service or the Privacy Policy.

1.2 In this DPA:

"Applicable Data Protection Law" means the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules made under it, as amended and notified from time to time ("DPDP Rules"); the Information Technology Act, 2000 and the rules under it, including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 for as long as they apply; and, where they apply to the Processing, the GDPR, the UK GDPR, the UK Data Protection Act 2018 and the Swiss Federal Act on Data Protection.
"Customer Personal Data" means personal data within Customer Data that IdeaScore Processes on the Customer's behalf in providing the Service.
"Processing" has the meaning given in Applicable Data Protection Law, and includes collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission, dissemination or otherwise making available, restriction, erasure and destruction. "Process" is read accordingly.
"Data Fiduciary", "Data Processor", "Data Principal", "Consent Manager" and "Board" have the meanings given in the DPDP Act; "controller", "processor", "data subject" and "supervisory authority" have the meanings given in the GDPR. A reference to the Controller includes the Data Fiduciary, and to the Processor includes the Data Processor.
"Personal Data Breach" means any unauthorised Processing of Customer Personal Data, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to it, that compromises its confidentiality, integrity or availability (including a "personal data breach" under the DPDP Act and the GDPR).
"Sub-processor" means a third party IdeaScore engages to Process Customer Personal Data.
"SCCs" means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914; the "UK Addendum" means the International Data Transfer Addendum issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.

2. Roles and Scope

2.1 For Customer Personal Data, the Customer is the Data Fiduciary (controller) and IdeaScore is the Data Processor (processor). Where the Customer itself acts as a processor for a third party, IdeaScore is its sub-processor and the Customer warrants that its instructions are authorised by that third party.

2.2 This DPA does not apply to personal data IdeaScore Processes as a Data Fiduciary for its own purposes (account administration, billing, security of the Service as a whole, support and marketing), which the Privacy Policy covers.

2.3 The subject matter, duration, nature and purpose of the Processing, the types of personal data and the categories of Data Principals are set out in Annex 1.

2.4 Self-hosted deployments. Where the Customer runs the Service on infrastructure it controls under a Self-Hosted Deployment (Terms of Service section 3.5), the Customer, or the host it chooses, holds the Customer Personal Data. IdeaScore is not a Processor of data it cannot access and has no Sub-processors for that data. IdeaScore is a Processor only for Customer Personal Data it can see because the Customer has given it access for support or maintenance, and only for that access: sections 3 to 9 and 11 then apply to that Processing, and Annex 2 and Annex 3 do not describe the Customer's hosting, which the Customer secures and for which it is responsible. The Customer may end the access at any time.

3. Customer's Obligations

3.1 The Customer is responsible for:

(a) having a lawful basis for the Processing, including obtaining any consent and giving any notice that Applicable Data Protection Law requires, before Customer Personal Data enters the Service;

(b) where a Data Principal is a child (under 18 under the DPDP Act, or under the age of digital consent under the GDPR), obtaining verifiable consent from the parent or lawful guardian as the DPDP Rules require, and not using the Service to track, behaviourally monitor or target advertising at children;

(c) the accuracy, quality and legality of Customer Personal Data, and the configuration of the Service (roles, access, retention settings, integrations it connects);

(d) answering Data Principals' requests and grievances about Customer Personal Data, with IdeaScore's help under clause 7; and

(e) its own decisions about Applicants, including those informed by IdeaScore AI.

3.2 The Customer's use of the Service, and the Service's configuration chosen by the Customer, are its complete instructions at the date of this DPA. Further instructions must be in writing, consistent with the Agreement and technically feasible.

3.3 The Customer must not instruct IdeaScore to Process government identity numbers or financial account or card numbers, unless the Agreement expressly allows it. The Customer may collect special or sensitive categories of personal data (for example information about health, disability, caste or family income) only through questions it chooses to include in its own forms, for a purpose it has decided, and subject to clause 3.1(a). The Customer can mark any question it adds to its own forms as sensitive in the Service's form builder. Where such a question is marked as sensitive in the Service, IdeaScore Processes the answers as set out under "Sensitive data" in Annex 1; any other question is Processed as ordinary application content.

4. IdeaScore's Obligations

IdeaScore will:

(a) Process Customer Personal Data only on the Customer's documented instructions, including for transfers outside India and outside the European Economic Area, unless the law to which IdeaScore is subject requires otherwise; in that case it will tell the Customer before Processing, unless the law prohibits that on important grounds of public interest;

(b) tell the Customer promptly if, in its opinion, an instruction infringes Applicable Data Protection Law (without being obliged to give legal advice);

(c) not sell Customer Personal Data, not use it for advertising, not combine it with other data for its own purposes, and not use it to train or improve any artificial-intelligence model, its own or a third party's;

(d) ensure that everyone authorised to Process Customer Personal Data is bound by confidentiality and Processes it only as needed to provide the Service;

(e) implement and maintain the technical and organisational measures in Annex 2, appropriate to the risk, as section 8(5) of the DPDP Act and Article 32 of the GDPR require;

(f) keep a record of Processing activities carried out for the Customer where Applicable Data Protection Law requires it; and

(g) not access Customer Personal Data except to provide the Service, to give support the Customer asks for, to prevent or fix a security, technical or abuse problem, or as the law requires. Support access to an organisation through the Service's "View as" function is read-only, limited to 60 minutes, requires a stated reason, cannot reach security settings, billing, user management, API keys, exports or any download, and is recorded in the Customer's own audit log, including each document it opens.

5. Sub-processors

5.1 The Customer gives general authorisation for IdeaScore to engage Sub-processors. The current list, with each Sub-processor's purpose, the data it handles and its location, is at /legal/subprocessors (Annex 3).

5.2 IdeaScore will give at least 30 days' notice before a new Sub-processor starts Processing Customer Personal Data, by updating the list and emailing the Customer's owner (or a subscriber to the list's notifications). In an emergency (for example to keep the Service running or secure), the notice may be shorter, and IdeaScore will explain why.

5.3 The Customer may object to a new Sub-processor on reasonable grounds relating to data protection within the notice period by writing to legal@ideascore.online. The parties will discuss the objection in good faith. If IdeaScore cannot offer a reasonable alternative, the Customer may terminate the affected part of the Service by notice before the change takes effect and receive a pro-rata refund of prepaid fees for the unused part of the Subscription Term, as its sole remedy for the objection.

5.4 IdeaScore will impose on each Sub-processor, by written contract, data-protection obligations that give at least the same level of protection as this DPA, and remains responsible to the Customer for each Sub-processor's performance.

5.5 Services the Customer chooses to connect (for example Zapier, Make, Slack, Microsoft Teams, Google or Microsoft sign-in for its Users, or its own systems through the API and webhooks) receive data on the Customer's instruction and are not IdeaScore's Sub-processors. Where an organisation uses its own AI engine key, the provider of that key is the Customer's provider, not a IdeaScore Sub-processor.

6. Transfers Outside India

6.1 Customer Personal Data is stored in Mumbai, India (database) and the Asia-Pacific region (uploaded files, export files and encrypted backups), and processed in Singapore (application) and Tokyo, Japan (email), and each request passes through the location of Cloudflare's network nearest to the visitor. IdeaScore and its Sub-processors may therefore Process Customer Personal Data outside India, in the locations listed in Annex 3, except in a country or territory the Central Government has restricted by notification under section 16 of the DPDP Act.

6.2 IdeaScore AI Processes application text outside India; no India-only Processing is offered. The Service shows the Customer the processing region, and does not run IdeaScore AI until an owner or administrator of the Customer has accepted Processing outside India once in the Service. That acceptance is an instruction under clause 4(a).

6.3 GDPR transfers. To the extent the Customer (or its controller) is subject to the GDPR and Customer Personal Data is transferred to IdeaScore in India, or onward to a Sub-processor in a country without an adequacy decision (see clause 6.1 and Annex 3 for the locations):

(a) the SCCs are incorporated by reference: Module Two (controller to processor) where the Customer is a controller, and Module Three (processor to processor) where the Customer is a processor, with the Customer as "data exporter" and IdeaScore as "data importer";

(b) clause 7 (docking clause) applies; in clause 9(a), Option 2 (general written authorisation) applies with the notice period in clause 5.2 of this DPA; the optional language in clause 11 does not apply; in clauses 17 and 18 the law and courts are those of Ireland, unless the Customer is established in another EU Member State whose law allows third-party beneficiary rights, in which case that Member State;

(c) Annex I of the SCCs is completed by Annex 1 of this DPA, Annex II by Annex 2, and Annex III by Annex 3; the competent supervisory authority is the one determined under clause 13 of the SCCs;

(d) for transfers subject to the UK GDPR, the UK Addendum applies, with Tables 1 to 3 completed from this DPA and, in Table 4, either party may end it as allowed by section 19 of the Addendum; for transfers subject to the Swiss Federal Act on Data Protection, the SCCs apply with the Federal Data Protection and Information Commissioner as the competent authority and references to the GDPR read as references to that Act; and

(e) if the SCCs and this DPA conflict, the SCCs prevail.

7. Assistance

7.1 Data Principal requests. Taking into account the nature of the Processing, IdeaScore will help the Customer, by appropriate technical and organisational measures, to answer requests to exercise rights under Applicable Data Protection Law (access, correction, completion, updating, erasure, nomination, grievance, restriction, portability, objection). The Service provides tools for this, including the applicant data-request queue (access copies and anonymisation, due within 30 days), anonymisation of whole programmes, programme retention policies, and a full organisation export. If IdeaScore receives a request directly, it will pass it to the Customer without undue delay and will not answer it itself except to tell the requester to contact the Customer, unless the Customer authorises otherwise.

7.2 Other assistance. IdeaScore will give reasonable help with data-protection impact assessments, prior consultations with authorities, and the Customer's obligations as a Significant Data Fiduciary if it is notified as one, so far as the help relates to the Service and the information is available to IdeaScore. Help that goes beyond the Service's tools and published documentation may be charged at reasonable rates agreed in advance.

8. Personal Data Breaches

8.1 IdeaScore will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data, by email to the Customer's owner and any security contact the Customer gives.

8.2 The notice will describe, as far as then known: the nature of the breach, including the categories and approximate number of Data Principals and records concerned; its likely consequences; the measures taken or proposed to deal with it and reduce its effects; and a contact point. Information not available at first will follow in phases without undue delay.

8.3 IdeaScore will take reasonable steps to contain, investigate and remedy the breach, and will help the Customer to inform the Board and affected Data Principals as section 8(6) of the DPDP Act and the DPDP Rules require, and supervisory authorities and data subjects under Articles 33 and 34 of the GDPR. IdeaScore will report cyber security incidents to CERT-In where the CERT-In directions under section 70B of the Information Technology Act, 2000 require it.

8.4 Notifying a breach is not an admission of fault or liability.

9. Deletion and Return

9.1 During the Subscription Term, the Customer can export and delete Customer Personal Data through the Service at any time, including a full organisation export as a ZIP file.

9.2 When the Subscription Term ends, IdeaScore will make Customer Personal Data available for export as set out in the Terms of Service (section 12) and then delete it from the live Service, unless the law requires IdeaScore to keep it. On the Customer's written request, IdeaScore will delete it sooner and confirm the deletion in writing.

9.3 Customer Personal Data in encrypted backups is deleted when those backups expire: daily backups after about 30 days and monthly backups after about 12 months (and in any case within 40 and 400 days respectively). Until then, backups are kept encrypted, are not used for any other purpose, and are restored only to recover from an incident.

9.4 Under section 8(7) of the DPDP Act, if a Data Principal withdraws consent or the specified purpose is no longer served, the Customer is responsible for instructing erasure; IdeaScore will carry out that instruction through the Service's tools or on request.

10. Audits and Information

10.1 IdeaScore will make available to the Customer the information reasonably necessary to demonstrate compliance with this DPA, including this DPA's annexes, the Security page, and written answers to a reasonable security questionnaire once a year.

10.2 If that information is not enough to demonstrate compliance, or a supervisory authority or the Board requires it, the Customer may audit IdeaScore's compliance (itself or through an independent auditor bound by confidentiality) no more than once in any 12 months, on at least 30 days' written notice, during business hours, without access to other customers' data and without disrupting the Service. Each party bears its own costs, unless the audit reveals a material breach of this DPA by IdeaScore.

10.3 Audits of Sub-processors are carried out through the reports and certifications those Sub-processors make available.

11. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms of Service, except where Applicable Data Protection Law or the SCCs do not allow those limits to apply to a data subject's rights.

12. Duration and Precedence

12.1 This DPA lasts as long as IdeaScore Processes Customer Personal Data for the Customer, and ends automatically once all of it has been deleted under clause 9.

12.2 If this DPA and the Terms of Service conflict about the Processing of Customer Personal Data, this DPA prevails; the SCCs prevail over both where they apply.

12.3 IdeaScore may update this DPA to reflect changes in Applicable Data Protection Law or the Service, on the notice set out in the Terms of Service, provided an update does not lower the overall protection of Customer Personal Data.

12.4 This DPA is governed by the law that governs the Terms of Service, except where the SCCs require otherwise.

Annex 1: Details of the Processing

Parties. Data exporter / Data Fiduciary: the Customer, as identified in its account or Order Form; contact: the Customer's owner. Data importer / Data Processor: CMS Group, 01, Teachers Colony, Sahaspur, Dehradun, Uttarakhand 248197, India; contact: privacy@ideascore.online. Activities: provision of the IdeaScore Service.

Subject matter. Hosting and operating the IdeaScore platform for managing applications to, and evaluation of, the Customer's programmes (for example innovation challenges, incubation and accelerator intakes, grants, fellowships, hackathons and competitions).

Duration. The Subscription Term, plus the post-termination period in clause 9.

Nature and purpose. Collection, storage, organisation, display, search, analysis, transmission (including email), export, backup, deletion and anonymisation of Customer Personal Data, in order to: receive applications through forms; manage teams; assign and record evaluations; run rounds, interviews, pitch days and decisions; issue letters, results and certificates; send programme emails; produce reports; run IdeaScore AI when the Customer uses it; deliver data to integrations the Customer connects; secure, support and back up the Service.

Categories of Data Principals (data subjects).

Applicants and their team members, including students who may be under 18 where a Customer's programme admits them.
The Customer's Users: owners, administrators, programme staff, evaluators, jurors, mentors and interview panellists.
Referees: people an Applicant names to write a reference, who submit it through a single-use link the Service emails to them, without an account.
Contact persons of organisations that apply to a Customer's programme (for example implementing agencies in a CSR programme), and the trustees, directors, auditors, signatories and others named in the documents those organisations upload.
Other people named in Customer Data, such as advisers or contacts.

Types of personal data.

Identity and contact: name, email, phone, institution or organisation, role, department, city or country, profile photo.
Application content: answers to the Customer's form, uploaded files (for example pitch decks), links (for example pitch videos), team composition, and any other information the Customer's form asks for.
References: each referee's name, email address and role (given by the Applicant), the referee's answers, letter and declaration, and the request's status and dates.
Applying organisations: name, type and year of registration, registration numbers (for example CSR-1, 12A and 80G), project and budget details, and uploaded documents such as registration acknowledgements, audited accounts and utilisation certificates; for funded projects, instalment plans, records of releases with a payment reference (no bank account details) and impact reports.
Conference papers: authors' and co-authors' names, affiliations, email addresses and ORCID iDs, the conflicts of interest the authors declare, the presenting author's biography, the manuscript, the decision and the decision letter; in a conference reviewed double-blind or single-blind, reviewers receive them without the authors' names, affiliations or contact details, within the limits stated in the Privacy Policy section 4.1.
Award nominations: the nominator's, nominee's and endorser's names, contact details and answers; the jury does not see the nominator's name, contact details or answers about themselves, or any email address or phone number on the nomination.
Evaluation content: scores, comments, rubric answers, conflict-of-interest declarations, decisions, notes, letters, honorarium records (amounts and payment references).
Communications: emails sent through the Service, announcements, support tickets.
Account and security: sign-in and session records, IP addresses, browser and device details (including the time zone a User's browser reports), audit-log entries, two-step sign-in data.
IdeaScore AI data: evaluation results and rationales, text extracted from decks, application digests, chats, tuning and memory.

Sensitive data. IdeaScore does not itself ask for special or sensitive categories of personal data. A Customer's form may ask for them where the Customer decides they are needed, for example a scholarship's questions on family income, category or caste, disability or health, and the certificates that prove them. The Customer, as Data Fiduciary (controller), decides whether to ask for them and is responsible for the lawful basis and notice (clauses 3.1(a) and 3.3). Where a question is marked as sensitive in the Service (the scholarship template marks its income, category and disability questions, and the certificates for them, in this way, and the Customer can mark any other question it adds to its own forms), the following restrictions apply to its answers:

(a) Visibility. They are shown only to the Customer's owners and administrators, to Users the Customer gives the eligibility-checking permission for that programme, and to the Applicant who gave them (the lead Applicant of a team application). They are not shown to evaluators who score, in blind review, in the committee's shortlist (except to Users with that permission), or in exports or live spreadsheet links made or last changed by Users without that permission, and they are not copied onto the team record created when an application is approved. A User with an open conflict of interest recorded against an Applicant cannot open that Applicant's certificates, except the Customer's owner where no other User without a conflict can check eligibility for that programme; the owner must then confirm, and the opening is recorded in the Customer's audit log.

(b) IdeaScore AI. They are excluded from what IdeaScore AI receives for scoring, summaries, chat and its other helpers, with one exception: a User with the eligibility-checking permission may ask IdeaScore AI to explain which of the programme's published eligibility rules an application meets, and IdeaScore AI then receives only the answers those rules check, without the Applicant's name or contact details.

(c) Retention and deletion. For Applicants who receive an award, they are deleted automatically 12 months after the award ends (the end of the scholarship year the Customer records, moved on by one year for each further year of a multi-year award); for the others, 90 days after the results (the results date the Customer records, or the date it confirms the awards). Where the Customer has not recorded those dates, the periods run from the programme's end date (12 months for each award year, or 90 days); for a programme with no end date, from its form's closing date plus 12 months; and for a programme with neither, from 24 months after the last activity on its applications. On that basis, an application still waiting for a decision is kept until it is decided, but not beyond 24 months after the last activity on the programme's applications or the date above, whichever is later, and nothing is deleted until 30 days after the Service first checked the programme's applications for deletion. Deletion removes the answers, any copy of them, and the documents uploaded for them, including documents the Applicant replaced. Referee letters for the same application are deleted on the same schedule, but never before that 30-day period has passed: the referee's name, email address, role, answers, letter and declaration are removed, the emails sent to the referee are redacted, and the request's status and dates are kept. The Customer can delete them sooner in the Service: in a scholarship programme for one Applicant, for everyone or for everyone not given an award (the last also deletes those Applicants' referee letters), and in any programme with the anonymisation tools in clause 7.1. Deletion waits while a programme is under a legal hold.

(d) Changes to the form. Only a User with the eligibility-checking permission can remove a question marked as sensitive or turn its mark off. The answers to a question removed from the form keep the restrictions in (a) to (c). When the mark is turned off, the answers in applications made before that keep the restrictions in (a) to (c); answers in applications made after it fall outside those restrictions.

Government identity numbers and financial account or card numbers remain subject to clause 3.3.

Frequency. Continuous, for the Subscription Term.

Retention. As the Customer configures, and as set out in clause 9 and the Privacy Policy section 8; for answers marked as sensitive and for referee letters, as set out under "Sensitive data" above.

Locations. Stored in Mumbai, India (database) and the Asia-Pacific region (uploaded files, export files and encrypted backups); processed in Singapore (application) and Tokyo, Japan (email); requests pass through the location of Cloudflare's network nearest to the visitor; IdeaScore AI processes outside India, once the Customer has accepted that in the Service (clause 6.2). Details are in Annex 3.

Sub-processor Processing. As listed in Annex 3, for the same nature, purpose and duration.

Annex 2: Technical and Organisational Measures

These measures describe what the Service does today. IdeaScore may change them provided the overall level of protection does not decrease.

1. Encryption

All traffic to the Service uses HTTPS (TLS). Browsers are told by HSTS never to fall back to an unencrypted connection.
The database and object-storage providers encrypt data at rest on their disks.
Nightly backups are encrypted with AES-256-GCM before they leave the server, with integrity checks against a manifest before upload and again before any restore. There is no unencrypted backup mode. The backup key is held separately from the backups.
Authenticator secrets for two-step sign-in are encrypted at rest with a server-side key; recovery codes, invitation tokens and API key secrets are stored only as hashes.

2. Access control

Each Customer's records are held in a separate database, not mixed with another Customer's.
Role-based access inside each organisation (owner, administrator, evaluator and other roles, with custom roles where enabled); evaluators and Applicants do not see IdeaScore AI scores or rationales.
Passwords are stored only as bcrypt hashes; new passwords are checked for strength, for personal data, and against a list of known breached passwords using a k-anonymity range query (only the first five characters of a SHA-1 hash leave the server).
Two-step sign-in (authenticator app, with ten single-use recovery codes); an organisation can require it for owners and administrators, with a grace period.
Google and Microsoft sign-in (where the Customer enables them) use OAuth 2.0 / OpenID Connect with state, nonce and PKCE, and only sign in people who already have an account.
Sessions are held in secure, http-only cookies; sessions last 7 days and can be extended to at most 30 days; Users can see their sessions and sign out other devices.
Account lock-out after 10 failed sign-ins for 15 minutes.
IdeaScore staff access to an organisation for support is read-only, time-limited (at most 60 minutes), requires a reason and is recorded in the Customer's audit log.
API keys are scoped by area and permission, can be rotated and revoked, and are stored only as hashes; test keys see sample data only.

3. Logging and monitoring

An audit log for each organisation records changes, sign-ins, exports and downloads, with the actor, time, IP address and device. Customers see IP addresses masked and devices summarised; the Customer can set an audit retention period.
Sign-in history (successful and failed) for each User, kept 180 days.
Request identifiers link server logs to audit entries; email addresses are masked in server logs and email bodies are not logged.
Browser error reports with secrets stripped, kept 90 days.

4. Availability and resilience

Nightly encrypted backups of every organisation's database to a separate storage bucket with its own access credentials: 30 daily copies and 12 monthly copies are kept, with storage lifecycle rules as a safety net. A failed backup is retried and raises an alert.
Backups are tested by verifying archives against their manifests; restore drills are part of operations.
Background jobs are protected by locks so that they do not run twice.

5. Input and abuse protection

Rate limits on sign-in, two-step verification, password reset, applicant sign-in links, public form events, trial requests, imports and the API (60 requests a minute per API key, bursts of 120, and an organisation-wide ceiling).
Request validation, size limits on uploads (15 MB a file by default, and daily limits on how much each organisation, each signed-in applicant, and signed-out visitors from one network or to one programme's form can upload) and on events, and outbound requests to chat integrations limited to HTTPS and the vendors' own hosts.
Payment webhooks are verified by signature before they are processed, and replays are refused.

6. Data minimisation and privacy by design

IdeaScore AI receives only the content needed for a request (form answers, extracted decks, rubric and instructions), never evaluator names or Applicant email addresses or phone numbers; Customer Data is never used to train models.
Answers to questions marked as sensitive are shown only to owners, administrators and Users with the eligibility-checking permission, are not copied onto team records, are left out of IdeaScore AI except for the eligibility explanation described in Annex 1, and are deleted on the schedule described there, with referee letters. Removing a question marked as sensitive, or its mark, needs the eligibility-checking permission; the answers to a removed question keep their protections, and so do the answers given in applications made before a mark was removed. Live spreadsheet links that carry such answers are shown, changed and renewed only by Users with that permission, and stop giving the answers when the User who made or last changed the link loses it.
In a conference reviewed double-blind or single-blind, reviewers receive papers without the authors' names in the written answers and a masked copy of each manuscript, within the limits stated in the Privacy Policy section 4.1. The manuscript must be a file uploaded to the Service, not a link; the supplementary-material link and any manuscript that cannot be masked are withheld from reviewers.
Application-form analytics store no IP addresses and honour Do Not Track and Global Privacy Control.
Retention tools: programme retention policies with anonymisation, applicant data requests, automatic deletion of chats after 12 months, exports deleted after 24 hours.

7. Organisational measures

Confidentiality obligations for everyone with access to Customer Personal Data; access on a need-to-know basis.
Secrets and keys held in the hosting environment, never in the database or source code; production builds ship without source maps or development tools.
Sub-processors chosen for their security practices and bound by written data-protection terms.
A documented process for handling security incidents and vulnerability reports (see the Security page).

Annex 3: Sub-processors

The list of Sub-processors in force from time to time is published at /legal/subprocessors and is incorporated into this DPA by reference.