Data Processing Agreement

The Processor processes personal data on behalf of the Controller to provide the Salesling service described in the Terms. The nature, purpose, data types and data subjects are set out in Annex 1. This DPA lasts as long as the Processor processes personal data for the Controller.

The Processor processes personal data only on the Controller’s documented instructions. The Terms, this DPA, and the Controller’s configuration of the service (ICP rules, autonomy level, Daily Budget, connected mailboxes and integrations, approvals) are the Controller’s complete instructions. The Processor will inform the Controller if it believes an instruction infringes data protection law, and is not obliged to follow it. If EU or member-state law requires other processing, the Processor will inform the Controller beforehand unless the law prohibits it.

The Controller is responsible for the lawfulness of the processing, including having a legal basis for contacting each Prospect and Lead, providing the information required by Art. 13/14 GDPR, and honoring objections. The Controller decides whom the service may contact.

The Processor ensures that everyone authorized to process the personal data is bound by confidentiality obligations and receives access only as far as needed for their task.

The Processor implements the technical and organisational measures in Annex 2, appropriate to the risk under Art. 32 GDPR. It may update them as technology evolves, provided the overall level of protection does not decrease.

• The Controller gives general authorization for the Processor to engage sub-processors. The current list is on the sub-processors page (Annex 3).
• The Processor will notify the Controller of any intended addition or replacement at least 30 days in advance by email to workspace owners and by updating that page. The Controller may object on reasonable data-protection grounds within that period; if the parties cannot resolve the objection, the Controller may terminate the affected service and receive a pro-rata refund of prepaid fees.
• The Processor imposes data-protection obligations on each sub-processor that are no less protective than this DPA, and remains liable for its sub-processors.
• Services the Controller connects itself (e.g. Google Workspace, Microsoft 365, HubSpot, Slack) are the Controller’s own providers, not sub-processors of the Processor.

The primary data store is in Frankfurt, Germany. The Processor is established in the United States, and some sub-processors process data there. For transfers from the EEA, the parties agree to the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 — Module 2 (controller to processor) and, where the Controller is itself a processor, Module 3 — which are incorporated by reference. For those Clauses: the optional docking clause (7) applies; option 2 (general authorization, 30 days) of clause 9 applies; the optional language in clause 11 does not; clauses 17 and 18 select the law and courts of Ireland; Annexes I and II are Annexes 1 and 2 of this DPA; the competent supervisory authority is that of the Controller’s EU establishment. For the UK and Switzerland, the UK Addendum and the Swiss adjustments apply respectively. Onward transfers to sub-processors rely on the Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.

The Processor assists the Controller in answering data-subject requests. Owners and admins can export or erase a person’s data themselves in Settings → Privacy; erasure also adds the address to the suppression list. If a data subject contacts the Processor directly, the Processor forwards the request to the Controller without answering it itself. The Processor also assists, taking into account the information available to it, with security, breach notification, data-protection impact assessments and prior consultation (Art. 32–36 GDPR).

The Processor notifies the Controller without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the Controller’s data. The notice describes the nature of the breach, the categories and approximate number of data subjects and records concerned, likely consequences, and measures taken or proposed, and is supplemented as more becomes known.

The Controller can export its workspace at any time. When the workspace is deleted — on the Controller’s request, or 60 days after an unconverted trial ends with notice at least seven days before — the Processor deletes the personal data, leaving only a record that the workspace existed. Exceptions: data the law requires the Processor to retain (e.g. invoices), and backups, which are overwritten in their regular cycle and are not restored except for disaster recovery.

The Processor makes available the information needed to demonstrate compliance with Art. 28 GDPR, including this DPA, its security measures, and its sub-processors’ certifications. The Controller may audit compliance — itself or through an independent auditor bound by confidentiality — once a year with 30 days’ notice, during business hours and without disrupting the service, or at any time after a breach or at a supervisory authority’s request. Each party bears its own costs.

Liability under this DPA is governed by the Terms. If this DPA and the Terms conflict, this DPA prevails for data protection matters; the Standard Contractual Clauses prevail over both.

Nature and purpose

Researching business Prospects matching the Controller’s ideal-customer profile; drafting, sending (from the Controller’s mailboxes) and following up on outreach; receiving and answering Leads’ inquiries via email, web form and chat widget; qualifying Leads; booking meetings; syncing to the Controller’s CRM; escalating to the Controller’s team; usage metering and reporting.

Data subjects

Prospects (business contacts at target companies); Leads (people who contact the Controller or reply to outreach); meeting attendees; the Controller’s users.

Personal data

Name, business email address, job title, company, country; publicly available information about the person’s company and role; message contents and metadata (dates, thread identifiers); qualification notes; meeting details; opt-out and suppression records; for chat widget visitors, a random session identifier and a hashed IP address for rate limiting.

Special categories

None intended. The Controller must not upload special-category data; data subjects may disclose it in messages unprompted.

Frequency

Continuous, for the duration of the Terms.

Retention

For the life of the workspace, subject to erasure requests and section 10. Suppression records are kept as long as needed to honor the opt-out.

• Data residency: primary database, authentication and file storage hosted in Frankfurt, Germany.
• Tenant isolation: every customer table is protected by database row-level security keyed to the workspace; isolation is verified by an automated adversarial two-tenant test suite.
• Least privilege: users can only write the settings they are meant to change (column-level grants); billing, trial and usage state, audit records and lead history are writable by the system only. OAuth tokens and integration secrets are held in tables no app user can read.
• Encryption: TLS for all traffic in transit; encryption at rest by the database provider.
• Authentication: passwordless magic-link or Google sign-in; no passwords stored. Webhooks are signed (HMAC-SHA256) and replay-protected.
• Accountability: an append-only audit log records approvals, configuration changes, data-subject requests and security events; it cannot be altered by users.
• Human control: autonomy levels, an approval queue, a calibration phase for new outreach, a single kill switch, and human takeover of any conversation.
• Outreach safeguards: AI disclosure and an opt-out link added in code to every message; automatic suppression of opted-out people and domains; bounce-rate kill switch; Daily Budget and per-mailbox warm-up limits; Hand-send only for Germany, Austria and Switzerland.
• AI safety: inbound messages are screened for prompt injection; outputs pass a guard before sending; model providers do not train on the data.
• Abuse and availability: rate limits on public endpoints, usage ceilings, managed backups by the database provider.
• Data-subject rights: self-service export and erasure per person, and export and deletion per workspace.
• Organisation: access to production limited to named personnel with multi-factor authentication; confidentiality obligations for everyone with access; sub-processors selected for their security certifications.

See the sub-processors page, which is part of this DPA.