Data Processing Addendum

1. Roles and scope

The customer is the controller (or business) and we are its processor (or service provider) for Customer Content. We process it only to provide the Service and as the customer instructs through the product and the Terms. The subject matter, duration, nature and purpose are the provision of the Service for the term; the data subjects are the customer’s contacts, prospects and users; the categories are professional identification and contact details, role information, notes and communications content.

2. Our obligations

• Process personal data only on documented instructions, unless required by law (and tell the customer if so, where permitted).
• Ensure personnel are bound by confidentiality.
• Implement appropriate technical and organizational measures, including those on our security page: encryption in transit and for contact values at rest, workspace isolation, access controls and audit logging, multi-factor authentication for staff, and rate and volume limits.
• Assist the customer, taking into account the nature of processing, in responding to data-subject requests, security obligations, breach notifications, and data protection impact assessments.
• Notify the customer without undue delay (and within 72 hours where feasible) after becoming aware of a personal data breach affecting Customer Content.
• At the customer’s choice, delete or return Customer Content on termination (see the Terms), except where law requires retention.
• Make available information necessary to demonstrate compliance and allow reasonable audits (usually by questionnaire and our security documentation; on-site audits only where required by law and on reasonable notice and confidentiality).

3. Subprocessors

The customer gives general authorization for the subprocessors listed on our Subprocessors page. We will give at least 30 days’ notice of additions or replacements; the customer may object on reasonable data-protection grounds, and if we cannot resolve it either party may terminate the affected service. We remain responsible for our subprocessors and bind them to equivalent obligations.

4. International transfers

Where personal data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, the parties agree to the Standard Contractual Clauses (Module Two: controller to processor, and Module Three where applicable), the UK International Data Transfer Addendum, and the Swiss amendments, each incorporated by reference, with our measures serving as Annex II, the subprocessor list as Annex III, and the customer’s supervisory authority as the competent authority.

5. CCPA/CPRA

We act as a service provider. We do not sell or share personal information, retain, use or disclose it outside the direct business relationship or for purposes other than those in the Terms, or combine it with personal information from other sources except as the law permits. We will notify the customer if we can no longer meet our obligations, and the customer may take reasonable steps to stop and remediate unauthorized use.

6. Liability and term

Each party’s liability under this DPA is subject to the limitations in the Terms. This DPA lasts as long as we process Customer Content.

7. Executing this DPA

By accepting the Terms the customer accepts this DPA. If you need a signed copy, contact us through the privacy request form at /remove.