Legal

Data Processing Agreement

Version 1.0, 23 October 2026. This Data Processing Agreement (DPA) is part of the Sotto Terms of service. It applies automatically to every organization that uses Sotto, with no separate signature.

1. Parties, scope and order of precedence

Controller: the customer organization that accepted the Sotto Terms of service (“Customer”).
Processor: Disrupt Collective s.r.o., Kmochova 135/40, 614 00 Brno, Czech Republic, IČ 23420693, VAT CZ23420693 (“Sotto”, “we”).
Scope: this DPA covers personal data that Sotto processes on the Customer’s behalf while providing the Sotto service. That is the content of the Customer’s libraries and portals, and the data of the people the Customer invites.
Not covered:
- Data Sotto processes as its own controller, such as account billing, the sotto.zone website and beta requests. Those are governed by the Privacy Policy.
- Files that stay in the Customer’s own folders and cloud drives (Dropbox, Google Drive, OneDrive, SharePoint). The Customer’s agreement with that provider governs them.
Precedence: if this DPA and the Terms disagree on personal data, this DPA prevails. Where the Standard Contractual Clauses apply, they prevail over both.

2. Definitions and roles

Terms such as personal data, processing, controller, processor, data subject and personal data breach have the meaning given in the GDPR (Regulation (EU) 2016/679).

Customer Personal Data: personal data in the Customer’s Sotto account. It includes asset metadata, comments, ratings, names and emails of invited people, and activity records such as views and downloads.
Subprocessor: a third party Sotto engages to process Customer Personal Data (Annex 2).
Roles: the Customer is the controller and decides what goes into Sotto and who gets access. Sotto is the processor and acts only on the Customer’s documented instructions. Where the Customer is itself a processor, for example an agency running a library for its own client, Sotto acts as its subprocessor. The Customer is responsible for having the authority to give these instructions.
Instructions: the Terms, this DPA, and the Customer’s use and configuration of the service are the Customer’s complete instructions. If Sotto believes an instruction breaks data protection law, it will tell the Customer without delay.

3. Processor obligations

Sotto will:

Process Customer Personal Data only on the Customer’s documented instructions, unless EU or Czech law requires otherwise. In that case Sotto tells the Customer first, unless the law forbids it.
Make sure everyone who can access Customer Personal Data is bound by confidentiality.
Take the security measures in Annex 3 (Art. 32 GDPR).
Use subprocessors only as set out in section 4.
Help the Customer answer data subject requests (access, rectification, erasure, restriction, portability, objection), mainly through the product’s own features.
Help the Customer with security, breach notification, data protection impact assessments and prior consultation (Art. 32–36 GDPR), taking into account the nature of the processing and the information Sotto has.
Return or delete Customer Personal Data when the service ends, as set out in section 7.
Make available the information needed to show compliance with Art. 28 GDPR, and allow audits as set out in section 6.

Sotto does not sell Customer Personal Data. It does not use it to train AI models, for advertising, or for any purpose other than providing the service.

4. Subprocessors

The Customer gives general authorization for the subprocessors listed in Annex 2.

Same obligations: Sotto binds each subprocessor to data protection obligations no less protective than this DPA, and remains responsible to the Customer for their performance.
Changes: Sotto announces new or replacement subprocessors at least 30 days in advance, by email to organization admins and on this page.
Objection: the Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve it, the Customer may terminate the affected service and receive a pro-rata refund of prepaid fees.
Customer-chosen services are not subprocessors: this covers the Customer’s own cloud drives and sign-in providers (Microsoft, Google, GitHub). The Customer connects them, and their own terms apply.

5. International transfers

Sotto keeps the Customer’s database and stored files in the EU: the database in Ireland, the files in Cloudflare’s EU storage. Some subprocessors are US companies, and their global networks may process data outside the EEA.

Any such transfer relies on either:

the EU–US Data Privacy Framework, where the subprocessor is certified; or
the European Commission’s Standard Contractual Clauses (Module 3, processor to processor) with that subprocessor, plus supplementary measures where needed.

On request, Sotto provides a copy of the relevant transfer safeguards.

6. Security, breaches, assistance and audits

Security: Sotto maintains the technical and organisational measures in Annex 3 and may improve them over time, as long as protection is not reduced.
Breach notification: Sotto notifies the Customer without undue delay and within 48 hours of becoming aware of a personal data breach affecting Customer Personal Data. The Customer then has time to meet its own 72-hour deadline. The notice describes what happened, the data and people likely affected, the likely consequences, and the measures taken or proposed. Sotto adds details as they become known.
Data subject requests: if a data subject contacts Sotto directly about Customer Personal Data, Sotto passes the request to the Customer and does not answer it itself, unless the Customer instructs otherwise.
Audits: Sotto answers reasonable written security questionnaires once a year, and when a breach or a supervisory authority requires it.
- An on-site or third-party audit takes 30 days’ notice, happens during business hours and is bound by confidentiality.
- The Customer bears its own costs, and Sotto’s reasonable costs beyond one questionnaire a year.

7. End of service: return and deletion

When a subscription ends, the Customer has 30 days to export its data or reactivate. Sotto then deletes Customer Personal Data from live systems, and from backups within a further 30 days.

Day 0, subscription ends: the organization becomes read-only for its admins. Admins can download published files and export metadata (assets, tags, collections, comments, ratings). The Customer’s own folders and cloud drives are untouched throughout.
By day 30: Sotto deletes the organization’s database records, the files and previews it stores for delivery (Cloudflare R2), and its streamed videos (Cloudflare Stream).
By day 60: the deleted data has also expired from backups and logs. Database backups are kept for 7 days.

On request, Sotto confirms the deletion in writing. Sotto keeps only what law requires it to retain, such as invoices, and protects it under this DPA until it is deleted. The Customer can ask for earlier deletion at any time.

8. Liability, term and governing law

Liability: the limitation in the Terms (point 10) also applies to this DPA. It does not limit either party’s liability to data subjects under Art. 82 GDPR, or where the law forbids a limitation.
Term: this DPA runs as long as Sotto processes Customer Personal Data. The obligations in section 7 survive until deletion is complete.
Changes: Sotto may update this DPA to reflect changes in law or subprocessors, giving 30 days’ notice. Changes never reduce the level of protection.
Governing law: Czech law; courts in Brno. The supervisory authority is the Úřad pro ochranu osobních údajů (www.uoou.cz).

Annex 1: Description of processing

Item	Description
Subject matter	Hosting, organising, searching and delivering the Customer’s media library and client portals
Purpose	Providing the Sotto service under the Terms, including support and security
Duration	The subscription term plus the deletion periods in section 7
Data subjects	The Customer’s staff and editors; the Customer’s clients and their staff invited as members or viewers; people who open shared links; people shown or named in the Customer’s assets
Categories of data	Name, email address, profile picture, role and organization membership; sign-in records; comments, ratings, approvals and follows; views, downloads and audit records with timestamps and IP addresses; file names, tags and metadata; the content of published images, videos and documents
Special categories	None intended. The Customer decides what its assets contain and must not upload special-category data without a legal basis
Processing operations	Storage, indexing, thumbnail and video generation, search, display, sharing, notification emails, backup and deletion

Annex 2: Subprocessors

Subprocessor	What it does for Sotto	Data	Location
Supabase Inc.	Database, sign-in and server functions	All account and library metadata	EU (Ireland)
Cloudflare, Inc.	File storage (R2), video streaming (Stream), delivery network and access gate	Published files, previews, videos; request data	Storage in the EU; global delivery network
Vercel Inc.	Hosting of the web portal (app.sotto.zone and client portal domains)	Request data passing through; no stored library data	Global network
Resend (Plus Five Five, Inc.)	Transactional email: sign-in links, invitations, update notifications	Recipient name and email, email content	US
OpenAI, L.L.C.	Only for AI features the Customer switches on: suggested names and tags	Thumbnails (never originals) and the client’s tag vocabulary	US; engaged only when such features ship

Error reports stay in Sotto’s own database; no external error-tracking service is involved.

Annex 3: Technical and organisational measures

Access control in the database: row-level security on the server decides what each signed-in person can see, by organization, client and access level (public, guest, member, editor). Browser code is never the security boundary.
Gated file delivery: non-public files are served through a gate that checks the viewer’s level on every request. Protected videos play only through signed, expiring links.
Encryption: TLS for all traffic. Data at rest is encrypted by the hosting providers (Supabase, Cloudflare).
Authentication: email magic links, or sign-in with Microsoft, Google or GitHub. No passwords are stored by Sotto.
Least privilege: customer admins assign roles. Sotto staff access production data only to provide support or fix incidents.
Credentials on the customer’s machine: cloud-drive tokens for publishing stay in the operating system’s keychain on the publishing computer, not on Sotto servers.
Logging: errors and security-relevant events are recorded in Sotto’s own database. Per-organization audit logging is being added before the public launch.
Backups: daily managed database backups, kept for 7 days and stored by Supabase in the EU.
Testing: automated tests of isolation between organizations come with the organization model (version 0.5). An external multi-tenant security review is required before the open beta (version 0.9).
People: everyone with production access is bound by confidentiality.

Document history

Version	Date	Change
1.0	23 October 2026	First published version