Data processing terms.

The processing covered

The organiser is the controller and Strategy O'Clock is its processor for hosted workshop personal data. If the organiser is itself a processor, it must have the controller's authority to appoint us as a subprocessor and pass on lawful instructions. Our independent use of operational data is described in the privacy notice.

The subject matter is hosting a collaborative workshop. Processing includes receiving, storing, organising, transmitting and displaying room content, calculating results, generating requested exports and deleting active room records. Its purpose is to deliver the organiser's selected exercises and shared discussion.

Data may include browser identifiers, group membership, answers, opinions, votes and incidental identifiers in room titles, item text, decisions or owner labels. Data subjects are participants and people mentioned in workshop content. The service is not intended for confidential material, personal case files, special category or criminal offence data. The restrictions in the terms of use apply.

Processing continues while the room is active, until the host closes it or its scheduled removal 48 hours after creation, followed by the deletion arrangements below. Any separately agreed lawful retention applies only for its stated purpose.

Instructions and organiser responsibilities

The organiser instructs us to provide the room through the controls it uses, including sharing content with anyone who obtains its room code and generating exports. Before reveal, the service hides participants' current-round vote values; during blind collection it can hide other participants' item text. The reveal step is part of the workshop flow and does not make visible content confidential. Further instructions must be documented, including by email, and stay within the agreed service unless we agree otherwise.

We will process workshop personal data only on documented lawful instructions, including instructions concerning transfers, unless applicable law requires otherwise. We will inform the organiser of that legal requirement before processing unless the law prohibits this. We will tell the organiser promptly if we consider an instruction infringes applicable data protection law, and may pause the affected processing while it is resolved.

The organiser retains control of the purpose and lawful basis, gives participants the necessary information, limits the data it submits and handles its obligations to individuals. It may give lawful instructions, request assistance and end processing by closing the room or contacting us.

Confidentiality and security

We will ensure that people we authorise to process workshop personal data are bound by confidentiality duties. We will implement and maintain technical and organisational measures appropriate to the risk, as required by Article 32 of the UK GDPR, and review their effectiveness. This includes access controls, secure transmission, restricted operational access and the room deletion lifecycle.

The service uses a browser identifier and secret token to authorise participant actions, and host controls for room management. A room code is the shared access credential for reading room content. These measures do not prevent an invited participant from copying answers or sharing the code. The organiser must assess whether this access model suits its workshop before submitting personal data. Contact us for information needed for that assessment; these terms are not a certification or an independent security audit.

Cloudflare and changes to subprocessors

The organiser authorises Cloudflare as our current hosting and shared-room subprocessor. We will engage subprocessors under written terms that impose equivalent data protection obligations for the processing they perform, and remain responsible to the organiser for their performance of those obligations.

Cloudflare's published Data Processing Addendum, version 6.4 effective 3 April 2026, describes its obligations and onward processing arrangements. Its subprocessor list describes providers used by Cloudflare. Firebase is not active in the current service.

We will give advance notice of an intended addition or replacement of our subprocessors and a reasonable opportunity to object on data protection grounds before the change affects the organiser's data. As rooms do not require an account or email address, notices will appear on this page and in the service before the change; organisers may also contact us to request direct notice. We will consider an objection in good faith. If we cannot resolve it, the organiser may stop the affected use and request return or deletion before the change.

Rights requests and incidents

Taking account of the nature of the processing, we will assist the organiser through appropriate technical and organisational measures, insofar as possible, to respond to individuals' rights requests. We will promptly pass on requests about workshop data where we can identify the organiser, and will not answer on its behalf without instructions unless the law requires it.

We will notify the organiser without undue delay after becoming aware of a personal data breach affecting its workshop data. We will provide available information about the breach, likely consequences and measures taken or proposed, with further information as it becomes available. We will cooperate in containment and investigation. Because rooms have no required contact details, organisers should provide a contact if they need direct incident communications; we will otherwise use available means to reach affected organisers.

Taking account of the processing and information available to us, we will assist the organiser with security obligations, breach notifications to regulators and affected people, data protection impact assessments and prior consultation with regulators under Articles 32 to 36.

Return and deletion

At the organiser's choice, we will return or delete workshop personal data at the end of the service, and delete existing copies unless applicable law requires retention. The organiser can take the available exports while the room is active or contact us about return before closing it. Closing or scheduled expiry removes active room records; it does not erase copies already downloaded by participants.

Provider logs, backups and recovery copies have separate lifecycles. Where immediate deletion of a residual copy is not possible, we will require it to be protected from further use except legally required retention or recovery, and deleted through the applicable provider lifecycle. If recovery restores room data, the deletion instruction continues to apply. We have not published a verified maximum retention period for provider copies. Ask for the applicable details before submitting data if you need a fixed deletion deadline. Any legally required retained data remains protected and limited to that legal purpose.

International transfers

We will make any restricted international transfer of workshop personal data only on documented instructions and with the safeguards required by applicable data protection law. Cloudflare's published terms describe its transfer mechanisms, including standard contractual clauses and the UK Addendum where applicable. Those published mechanisms do not by themselves establish that a particular account arrangement or transfer assessment is complete. We will provide available information about the applicable arrangements on request.

Information and audits

We will make available the information necessary to demonstrate our compliance with Article 28, and allow and contribute to audits and inspections by the organiser or an independent auditor it appoints. Contact us to agree a reasonable process, scope and timing that protect other users' data and service security. We may start with relevant records and provider reports, but this does not remove statutory audit or inspection rights.

Neither party is relieved of its own obligations or liability under applicable data protection law by these terms. For the requirements behind processor contracts, see the ICO's guidance on processor contract terms.

Send instructions, objections, assistance requests or audit enquiries to privacy@strategyoclock.com. Include enough room context to identify the request, without sending the secret token stored in your browser.

Last updated 16 October 2026. Version 2026-10-16.