In short
- You are the controller of the personal data in your Workspace. We are the processor and process it only on your instructions.
- This data processing agreement forms part of the Terms of service automatically. No signature is needed; you can ask for a signed copy at privacy@useblake.ai.
- We announce a new subprocessor 30 days in advance, and you can object.
- We notify you of a personal data breach without undue delay and at the latest within 48 hours of discovery.
- During early access your data is kept in an environment that Subduxion manages itself. Where data can leave the EU, for example for administration and logs, we say so and name the safeguard that applies.
- After the end you can still export your data for 30 days. After that we delete it.
Definitions#
In this data processing agreement, the following capitalised terms mean:
- GDPR: Regulation (EU) 2016/679, the General Data Protection Regulation;
- Subduxion: Subduxion B.V., High Tech Campus 5, 5656 AE Eindhoven, the Netherlands, Chamber of Commerce number 98353780, which makes Blake; in this text also 'we' and 'us';
- Terms of service: Subduxion's terms for the use of Blake, published as Terms of service;
- Customer: the organisation that has accepted the Terms of service and uses Blake; in this text also 'you';
- User: a person who has access to the Workspace on behalf of the Customer;
- Workspace: the Customer's environment in Blake, in which its Users manage requests, drawings, 3D models, calculations and quotes;
- Customer Data: all data that the Customer or its Users place in the Workspace or create in it, including requests, drawings, 3D models, calculations, quotes, confirmations and corrections;
- Personal Data: Customer Data that is personal data within the meaning of article 4(1) GDPR;
- Subprocessor: a third party we engage that processes Personal Data for the Customer;
- Breach: a personal data breach within the meaning of article 4(12) GDPR that affects Personal Data.
Terms such as processing, controller, processor and data subject have the meaning given in the GDPR. Other capitalised terms have the meaning given in the Terms of service.
Application#
This data processing agreement forms part of the Terms of service automatically and applies as soon as you accept the Terms of service. No signature is needed. If you want a signed copy for your own records, ask for one at privacy@useblake.ai.
If the Terms of service and this data processing agreement conflict on the processing of Personal Data, this data processing agreement prevails. If the Dutch and English texts differ, the Dutch text prevails. Governing law and disputes follow the article on them in the Terms of service.
Send questions about this data processing agreement to privacy@useblake.ai. Previous versions are on the Changes page.
Roles of the parties#
For the Personal Data in your Workspace, you are the controller and we are the processor. You decide why and how it is processed, and you take care of a legal basis and of informing data subjects.
You remain the owner of your drawings, 3D models, requests and workshop data and keep all rights in them. You also make sure you have the right to upload your own customers' drawings and models, for example under their non-disclosure agreements.
For the account data of Users, for securing Blake and tracking errors, and only for paid self-serve plans for billing, we are a controller ourselves. Our Privacy statement governs that processing, not this data processing agreement.
Subject and duration#
This data processing agreement covers the Personal Data in your Workspace that we process to provide Blake to you. The types of data and data subjects are listed in Annex I.
Processing lasts as long as the Terms of service apply, and after that until the Customer Data has been returned or deleted as described in the article Return and deletion.
Nature and purpose of the processing#
We process Personal Data for one purpose: providing Blake to you. A request comes in as a forwarded email or an upload; drawings (PDF) and 3D models (STEP) are read into a proposal of the drawing's requirements; Blake prepares a calculation with the cost price per operation; you export your quotes as PDF, CSV or JSON. Blake prepares, your people decide: they check, correct and confirm, and you remain responsible for your prices and quotes.
We do not process Personal Data for our own purposes. We receive only the licence needed to provide Blake to you.
Drawings and models are mostly business data and often trade secrets, not personal data. The confidentiality obligations in the Terms of service cover all of your Customer Data. This data processing agreement also governs the Personal Data they contain, such as names in a title block.
We do not use your drawings, 3D models or workshop data to train AI models, unless you give separate written consent.
Customer's instructions#
We process Personal Data only on your documented instructions. Those instructions are the Terms of service, this data processing agreement and the choices you make in the Workspace, such as turning on the drawing reader. You give any other instructions in writing.
If the law of the EU or of a member state requires us to process the data in another way, we tell you in advance, unless that law prohibits it.
If we believe an instruction infringes the GDPR or other data protection rules, we tell you at once. We may suspend that processing until you change or confirm the instruction.
Confidentiality of personnel#
Everyone at Subduxion who can see Personal Data is bound to confidentiality, by contract or by law. Only staff who need that access for their work receive it.
Security measures#
We take appropriate technical and organisational measures, as article 32 GDPR requires. These are the measures that apply today:
- connections are encrypted with TLS, including those to the database;
- data is stored encrypted at the hosting provider;
- access is scoped per organisation: every record belongs to one organisation, and Blake shows it only in that organisation's workspace;
- within the Workspace, access is role-based: owner, admin, member and read-only;
- during early access we do not offer a restore period; for the online service we make backups of the database, and we will state a fixed restore period only once restore has been tested in that environment;
- you report vulnerabilities to security@useblake.ai or through /.well-known/security.txt on this website.
More detail is on the Security page. We do not hold certifications such as SOC 2 or ISO 27001 and have no penetration-test report. We answer security questions directly.
Subprocessors#
You give us general authorisation to engage Subprocessors. The current list, with what each Subprocessor does, which data it sees and where, is on the Subprocessors page.
We sign a written agreement with every Subprocessor that contains at least the same data protection obligations as this data processing agreement. We remain liable to you for a Subprocessor as we are for ourselves.
We announce a new or replacement Subprocessor 30 days before it starts processing Personal Data. You receive these notices if you sign up at privacy@useblake.ai. Within those 30 days you can object in writing, on grounds related to data protection. We then look for a solution with you. If none is found, you can terminate the affected service before the change takes effect.
Transfers outside the EEA#
Part of the processing runs through providers that are established outside the EEA or have systems there. Below is where each part takes place; which providers these are is on the Subprocessors page.
- During early access, the application and database run on an environment that Subduxion manages itself. That environment's storage is encrypted.
- The online service with fixed hosting locations will follow.
- Uploaded files are kept in private storage at our hosting provider.
- When the drawing reader is on, image crops of drawings of at most 2 MiB go to a compute provider in the EU. That provider's administration and logs are in the US.
- During early access, no error reports or usage data go to an outside service.
- Emails from the Workspace, such as sign-in links and notifications, are sent through our email service in the EU.
The drawing reader is optional and is off until an owner or admin turns it on. More on this is on the Your drawings and AI page.
Some of our providers are American. Where Personal Data leaves the EEA or can be accessed from outside it, the safeguard is the European Commission's Standard Contractual Clauses (SCCs).
Assistance to the Customer#
We help you with data-subject requests and with your obligations under articles 32 to 36 GDPR, as far as is reasonably possible given our role.
If a data subject contacts us directly with a request about Personal Data in your Workspace, we forward the request to you without undue delay. We do not answer it ourselves, unless you ask us to or the law requires it.
If you carry out a data protection impact assessment (DPIA) or a prior consultation with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), we give you the information we hold about the processing. If the help goes beyond that, we may charge reasonable costs, which we agree with you in advance.
Personal data breaches#
We notify you of a Breach without undue delay and at the latest within 48 hours of discovery. We notify the owner of your Workspace. As far as we know at that moment, the notice states:
- what happened, which types of data and data subjects are affected, and approximately how many;
- the likely consequences;
- the measures we have taken or propose to address the Breach and limit its consequences;
- whom you can contact for more information.
We send information we receive later as a follow-up. You decide whether the Breach is reported to the Dutch Data Protection Authority and to data subjects; we help you with that. Report a suspected security incident to us at security@useblake.ai.
Audits#
You can ask us for all information needed to show that we comply with this data processing agreement. Ask at privacy@useblake.ai; we answer your questions in writing.
If that information is not enough, you may have an audit carried out, including on site, by yourself or by an independent auditor. The following applies:
- at most once in any 12 months, unless there has been a Breach;
- you give at least 10 business days' written notice of the audit;
- during business hours and without disrupting the service for other customers;
- the auditor is bound to confidentiality;
- the costs of the audit are yours, unless the audit shows a material breach by Subduxion.
Return and deletion#
After the Terms of service end, you can still export your Customer Data, or ask us to return it, for 30 days. After that we delete it, at the latest 30 days after the export period ends.
We keep database backups for 7 days. Deleted data therefore also disappears from the backups 7 days after deletion.
If the law requires us to keep data longer, we use it only for that purpose, keep it confidential and delete it as soon as the obligation ends. On request we confirm the deletion in writing.
Liability#
Liability under this data processing agreement follows the article Liability in the Terms of service, including the cap set out there.
This does not affect mandatory law, nor the rights of data subjects under the GDPR, including the right to compensation under article 82 GDPR.
Annex I: details of the processing#
This annex describes which Personal Data we process in a manufacturing shop's Workspace, and whose.
| Type of data | What it is | Data subjects |
|---|---|---|
| Users | Names and work emails of Users, their role in the Workspace and their sign-in data | The Customer's staff |
| Requests | Contact details of your customers in forwarded emails and uploads, such as name, email address, company and the content of the message | Contacts at the Customer's customers |
| Drawings and 3D models | PDF drawings and STEP models, with the names on them, for example in the title block | Contacts at the Customer's customers, the Customer's staff |
| Calculations and quotes | Calculations, quotes, confirmations and corrections, with the names of contacts and Users that appear in them | The Customer's staff, contacts at the Customer's customers |
| Characteristic | Description |
|---|---|
| Subject | Personal Data in the Customer's Workspace |
| Nature | Storing, reading drawings and models into a proposal, preparing calculations, exporting quotes, securing and deleting |
| Purpose | Providing Blake to the Customer |
| Duration | As long as the Terms of service apply, then until return or deletion |
| Special categories of personal data | None; Blake is not intended for them and the Customer does not place them in the Workspace |
Annex II: security measures#
The technical and organisational measures are those in the article Security measures, with the explanation on the Security page.
Annex III: subprocessors#
The Subprocessors are those on the Subprocessors page. That list forms part of this data processing agreement; changes follow the article Subprocessors.