Strata Data Processing Addendum

Version

2026-10-03-draft

Effective

2026-10-03

Provider

Racelogic Limited (company no. 02743719)

Download PDF

1. Scope and parties

1. This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Racelogic Limited (“Racelogic”, the processor) and the business customer that has accepted them (“Customer”, the controller). It applies automatically to every business customer and needs no signature. A countersigned copy is available on request from legal@strata.stream.

2. It applies to personal data that Racelogic processes on the Customer’s behalf in providing Strata (“Customer Personal Data”), as described in Annex I. It does not apply to personal data Racelogic processes as a controller, such as account and billing data, which the Privacy Policy covers.

3. “Data Protection Law” means the UK GDPR, the Data Protection Act 2018, the EU GDPR (Regulation (EU) 2016/679) and any national law implementing or supplementing them, as they apply to the processing. Terms such as controller, processor, personal data, personal data breach and data subject have the meanings given in Data Protection Law.

4. If this DPA conflicts with the Terms of Service, this DPA prevails as to the processing of Customer Personal Data.

2. Racelogic’s obligations

Racelogic will:

1. Instructions. Process Customer Personal Data only on the Customer’s documented instructions, including with regard to international transfers, unless required to do otherwise by UK or EU law, in which case Racelogic will inform the Customer before processing unless that law forbids it. The Terms of Service, this DPA, and the Customer’s use and configuration of Strata (for example its destinations, recording setting and retention period) are the Customer’s complete instructions. Racelogic will tell the Customer if it believes an instruction infringes Data Protection Law.

2. Confidentiality. Ensure that every person it authorises to process Customer Personal Data is under a duty of confidentiality.

3. Security. Implement the technical and organisational measures in Annex II, and keep them appropriate to the risk. Racelogic may change them, provided the overall level of protection is not reduced.

4. Sub-processors. Engage sub-processors only as set out in section 3.

5. Data subject requests. Taking into account the nature of the processing, assist the Customer by appropriate technical and organisational measures to respond to requests from data subjects. Strata’s self-service export and deletion tools are the primary means of assistance. Racelogic will pass to the Customer, without responding itself, any request it receives that relates to Customer Personal Data.

6. Assistance. Assist the Customer, taking into account the information available to Racelogic, with its obligations on security, personal data breach notification, data protection impact assessments and prior consultation with supervisory authorities.

7. Personal data breaches. Notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, and the measures taken or proposed. Racelogic will provide further information as it becomes available. Notice is sent to the organisation’s admins by email.

8. Deletion and return. At the end of the provision of Strata, or when the Customer deletes its organisation, delete Customer Personal Data, unless UK or EU law requires it to be kept. Before then, the Customer can download its recordings and export its organisation’s data from the dashboard at any time. Deleted data remains in encrypted backups until they are overwritten, within 35 days.

9. Audits. Make available to the Customer the information necessary to demonstrate compliance with Article 28, and allow for and contribute to audits, including inspections, by the Customer or an auditor it mandates. The Customer will first ask for the information in writing; if an audit is still needed, it will give at least 30 days’ notice, carry it out during business hours without disrupting Racelogic’s operations, bind its auditor to confidentiality, and bear its own costs.

3. Sub-processors

1. The Customer gives Racelogic general authorisation to engage sub-processors. The current list is in Annex III and at Sub-processors.

2. Racelogic will give at least 30 days’ notice of any intended addition or replacement, by updating Sub-processors and emailing the organisation’s admins. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate its subscription and receive a refund of fees prepaid for the period after termination.

3. Racelogic will impose on each sub-processor, by written contract, data protection obligations that offer at least the same protection as this DPA, and remains liable to the Customer for each sub-processor’s performance of them.

4. International transfers

1. Racelogic is in the United Kingdom, and processes Customer Personal Data in the UK and the European Economic Area. Where a transfer of Customer Personal Data to a sub-processor outside the UK and EEA is not covered by adequacy regulations or an adequacy decision, Racelogic will make it under an appropriate safeguard: the EU–US Data Privacy Framework (and its UK Extension) where the recipient is certified, or otherwise the EU Standard Contractual Clauses with the UK Addendum, or the UK International Data Transfer Agreement.

2. Where the Customer is in the EEA, the transfer of Customer Personal Data from the Customer to Racelogic in the UK relies on the European Commission’s adequacy decision for the UK. [To be completed: counsel to confirm the fallback (EU SCCs Module 2) should that decision lapse]

5. The Customer’s obligations

1. The Customer is responsible for having a lawful basis for the processing it instructs, for giving any notices and obtaining any consents required (for example from people who appear in its footage), and for the accuracy of its instructions.

2. The Customer is responsible for choosing the recording setting and retention period appropriate to its purposes.

6. Liability and duration

1. Each party’s liability under this DPA is subject to the limitations in the Terms of Service, except where Data Protection Law does not allow it.

2. This DPA lasts for as long as Racelogic processes Customer Personal Data.

Annex I — Details of the processing

Annex II — Technical and organisational measures

Annex III — Sub-processors

Racelogic uses the following sub-processors. The “Footage” column shows which of them may process Customer Personal Data in footage and run data. The current list is always at Sub-processors.