GDPR Compliance

Our subprocessors are listed in Section 5. Changes are recorded in the subprocessor change log.

ScoutDNS ("we," "us," or "our") is committed to protecting the privacy and security of all personal data processed by our DNS security platform. We recognize that GDPR compliance is an ongoing responsibility and continually adapt our practices to align with evolving regulations. We do not sell or transfer detailed customer use or log data for any purpose to any party. This policy outlines the measures we have implemented to fulfill our obligations as a processor and sub-processor and to support our customers, who act as data controllers, in meeting their GDPR responsibilities.

1. Purpose

The purpose of this GDPR Compliance Policy is to ensure that ScoutDNS, when acting as a processor or sub-processor, complies with the General Data Protection Regulation (GDPR). We outline below the specific measures we take to protect personal data and respect the rights of data subjects.

2. Scope

This policy applies to all personal data processed by ScoutDNS on behalf of our customers (the data controllers). It also governs any internal business operations where personal data may be involved.

3. Responsibilities

• ScoutDNS: Responsible for ensuring GDPR compliance for any personal data we process.
• Privacy contact: ScoutDNS maintains a designated point of contact responsible for overseeing and advising on our data protection and GDPR compliance efforts. You can reach this contact through our contact page.
• Employees: All ScoutDNS employees must comply with this policy and receive regular training on GDPR requirements.

4. Data Processing

• Purpose and Instructions: We process personal data solely for purposes defined by our customers in their capacity as data controllers and only in accordance with their instructions.
• Technical & Organizational Measures: We maintain appropriate security measures to protect personal data against unauthorized or unlawful processing, accidental loss, destruction, or damage.
• Accuracy & Updates: We make reasonable efforts to ensure that personal data is accurate and up-to-date.
• Data Subject Rights: We assist data controllers in providing data subjects with the right to access, correct, and delete their personal data upon request.
• Breach Notification: We promptly notify affected customers of any data breach involving their personal data.
• Data Retention & Disposal: Upon termination or expiration of a contract, we either return or securely delete personal data in accordance with the customer's instructions.

5. Subprocessors

• Selection & Due Diligence: ScoutDNS may act as a subprocessor, or use subprocessors, to handle personal data on behalf of our customers. We only engage subprocessors who offer sufficient guarantees of their ability to meet GDPR requirements.
• Data Processing Agreements: We enter into GDPR-compliant data processing agreements with all subprocessors and ensure they adhere to this policy and applicable regulations.

Subprocessors of Customer Data (ScoutDNS Platform)

These subprocessors process personal data from the ScoutDNS platform on behalf of our customers and are covered by the ScoutDNS Data Processing Agreement. We give at least 14 days' notice before adding or replacing a subprocessor in this table.

Website, Billing, and Business Operations Vendors

These vendors support the ScoutDNS website, billing, and our own sales and scheduling operations. They process data ScoutDNS controls about website visitors, customers' billing contacts, and business contacts, as described in our Privacy Policy. They do not process customer data from the ScoutDNS platform and are not subprocessors under the ScoutDNS Data Processing Agreement.

Data Minimization

Each subprocessor receives only the minimum personal data required for its function. ScoutDNS does not authorize subprocessors to use customer data for their own purposes.

Security & Agreements

ScoutDNS maintains written data-processing agreements and performs due diligence on all subprocessors to ensure adequate security and GDPR alignment.

Changes to Subprocessors

We give at least 14 days' notice before adding or replacing a subprocessor of customer data. Each change is published in our subprocessor change log and in our subprocessor update feed. Customers who have signed our Data Processing Agreement also receive this notice by email. Changes to website, billing, and business vendors are recorded when they take effect. To request email notification of changes, contact us.

6. Data Transfers

• Data Residency and Processing Locations: DNS log records from our European resolvers, including those in the European Union and the United Kingdom, are stored at rest and replicated across data centers in the EU and the UK. When those logs are viewed or queried, the relevant records are processed transiently in memory by application servers located in the United States and are not retained by those servers. Ancillary operational data, such as service access logs and error diagnostics, may be processed and retained in the United States. Exports or diagnostics that a customer chooses to send to ScoutDNS support may be stored temporarily in the United States and are deleted when no longer needed for support. We retain personal data only as long as necessary to fulfill our legal obligations or those of our customers as data controllers.
• Transfer Safeguards: Where personal data is processed in or transferred to the United States or another jurisdiction without a European Commission or UK adequacy decision, we implement appropriate safeguards, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, to ensure the transfer complies with GDPR obligations. ScoutDNS also participates in the EU-U.S. Data Privacy Framework and the UK Extension to the EU-U.S. DPF; our certification and the commitments it carries are described in our Privacy Policy.

7. Data Subject Rights

• Rights Requests: Data subjects can exercise their rights (access, correction, deletion) by contacting the data controller.
• Controller Assistance: We promptly assist data controllers in addressing data subject requests, including providing necessary documentation or data in a timely manner.
• Direct Contact: If a data subject experiences issues working through their controller, they may contact ScoutDNS directly for assistance.

8. Data Breaches

• Procedures & Detection: ScoutDNS has implemented procedures to detect, report, and investigate any personal data breaches.
• Notification: We notify our customers (the data controllers) of any personal data breach without undue delay and provide relevant details to help them fulfill their own breach notification obligations.
• Investigation & Prevention: We cooperate fully with our customers to determine the root cause of a breach and implement corrective measures to reduce future risks.

9. Training and Awareness

ScoutDNS provides regular GDPR training to all employees. We ensure employees are aware of their responsibilities under both this policy and the GDPR, and we hold them accountable for following best practices and security protocols.

10. Policy Review

This GDPR Compliance Policy is reviewed regularly and updated as needed to remain effective and compliant with GDPR requirements. For any questions about this policy or ScoutDNS's GDPR practices, please contact us through our contact us form.