Data processing agreement

Effective [date of publication]

This agreement is part of the terms of service between [company legal name] (the “processor”, “we”) and the customer that holds a Buyerhint workspace (the “customer”). It applies whenever we process personal data on the customer's behalf (“customer personal data”). Terms such as controller, processor, personal data breach and supervisory authority have the meaning the GDPR gives them. No signature is needed; customers who want a signed copy can ask [privacy contact email].

1. Roles

The customer is the controller of customer personal data and we are its processor. If the customer is itself a processor for someone else, we are its subprocessor and it confirms that its controller has authorized this agreement. Under the California Consumer Privacy Act we are the customer's service provider. For data we handle as a controller, such as account and billing data and the opt-out list, our privacy policy applies instead.

2. Instructions

We process customer personal data only on the customer's documented instructions, unless the law requires otherwise, in which case we tell the customer first unless the law forbids it. The instructions are these terms and what the customer sets up in the product. They include two standing instructions the customer gives by using Buyerhint:

• delete each prospect record 12 months after the last public activity recorded for it;
• when a person opts out through any customer or through us, delete their records in every workspace and keep a one-way hash of the identifier so they aren't added again.

We tell the customer at once if we think an instruction breaks data protection law.

3. Confidentiality

Everyone we allow to process customer personal data is bound to keep it confidential.

4. Security

We maintain the technical and organizational measures in Annex 2 and keep them appropriate to the risk. We may improve them, but won't lower the overall level of protection.

5. Subprocessors

The customer gives general authorization for the subprocessors in Annex 3. We will announce a new or replacement subprocessor on this page and by email at least 30 days before it receives customer personal data. The customer may object on reasonable data protection grounds within that time; if we can't address the objection, the customer may end the affected service and we will refund the prepaid fees for the unused period. Each subprocessor is bound by a written contract with data protection obligations no less protective than these, and we remain responsible for its work.

6. Requests from people

We carry out opt-outs and deletion requests as section 2 describes. We pass any other request about customer personal data to the customer within five business days and don't answer it ourselves unless the customer asks us to. The product lets the customer find, correct, export and delete records, and we help further where the customer reasonably needs it.

7. Further assistance

Taking into account what we know about the processing, we help the customer meet its obligations on security, breach notification, data protection impact assessments and prior consultation with supervisory authorities.

8. Personal data breaches

We notify the customer without undue delay, and in any case within 48 hours, after becoming aware of a breach affecting customer personal data. The notice describes the nature of the breach, the categories and approximate number of people and records concerned, the likely consequences, and what we have done or propose to do, with more detail as we learn it.

9. Deletion at the end

When the agreement ends the customer can export its data for 30 days. After that we delete customer personal data, and it leaves our backups within a further 30 days, unless the law requires us to keep it.

10. Audits

We make available the information needed to show we meet this agreement: this page, a summary of our security measures, and answers to one reasonable security questionnaire a year. If that isn't enough, or a supervisory authority requires it, the customer may audit us, or have an independent auditor bound by confidentiality do so, with 30 days' notice, during business hours and at the customer's cost.

11. International transfers

Where customer personal data is transferred from the European Economic Area to a country without an adequacy decision, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 apply and are part of this agreement: Module 2 when the customer is a controller, Module 3 when it is a processor. For them:

• the optional docking clause (clause 7) applies;
• for clause 9, option 2 (general written authorization) applies, with the 30-day notice in section 5;
• the optional wording in clause 11 does not apply;
• for clause 13, the competent supervisory authority is that of the member state where the customer is established, or, if it isn't established in the EU, where its representative is;
• for clauses 17 and 18, the clauses are governed by the law of Ireland and disputes go to the courts of Ireland;
• Annexes I, II and III of the clauses are Annexes 1, 2 and 3 below.

For transfers from the United Kingdom, the International Data Transfer Addendum issued by the Information Commissioner (version B1.0) applies, with its tables completed by this agreement and the clauses above; neither party may end it under its section 19. For transfers from Switzerland, the clauses apply with the Federal Data Protection and Information Commissioner as the competent authority and references to the GDPR read as references to the Swiss Federal Act on Data Protection.

12. California

As the customer's service provider, we:

• process personal information only to provide Buyerhint to the customer, the business purpose of this agreement;
• don't sell or share it, and don't retain, use or disclose it outside our direct business relationship with the customer;
• don't combine it with personal information from other sources, except as the CCPA allows;
• give it the level of privacy protection the CCPA requires, and tell the customer if we can no longer do so;
• let the customer take reasonable steps to stop and remedy any unauthorized use.

13. Liability and precedence

Each party's liability under this agreement is subject to the limits in the terms of service, as far as the law allows. If this agreement conflicts with the terms, this agreement wins on data protection; if it conflicts with the Standard Contractual Clauses, the clauses win.

Annex 1. Description of the processing

Annex 2. Security measures

• Encryption of all traffic with TLS, and of stored data at rest by our database provider.
• Each customer's data is separated by row-level security policies enforced in the database.
• Mailbox access tokens are encrypted with AES-256-GCM before they are stored; server keys never reach the browser.
• Opt-out identifiers are stored only as SHA-256 hashes; network addresses used against abuse are stored only as hashes.
• Automatic deletion jobs enforce the retention periods.
• Production access is limited to staff who need it, protected by multi-factor authentication, and staff actions on customer data are logged.
• Rate limits on public endpoints, and verification of signed webhooks.
• Daily backups by our database provider; dependency versions are locked and updated for security fixes.
• A breach response process that meets the timelines in section 8.

Annex 3. Subprocessors

Services the customer connects itself, such as its Google or Microsoft mailbox, X account, HubSpot or Slack, act on the customer's own account and aren't our subprocessors.