Data processing agreement

This agreement is part of the Terms of service between [Company Legal Name], [Registered Address] (the "processor") and the customer (the "controller"). It applies when the processor handles personal data on the controller's behalf. Effective date: [Effective Date].

1. Definitions

"Data protection law" means the GDPR, the UK GDPR and Data Protection Act 2018, the California Consumer Privacy Act as amended (CCPA) and any other law on personal data that applies. "Personal data", "process", "controller", "processor", "data subject" and "personal data breach" have the meanings in the GDPR. "Customer personal data" means personal data in the service that the processor handles for the controller, as described in Annex 1. "Sub-processor" means a third party that the processor uses to process customer personal data.

2. Roles and scope

2.1 The controller is the controller of customer personal data and the processor is its processor. The processor is a controller of the data about the controller's own users that it needs to run accounts, billing and security, as the Privacy policy says.

2.2 Annex 1 describes the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects.

3. Instructions

3.1 The processor processes customer personal data only on the controller's documented instructions. The terms, this agreement and the controller's use of the service's features are the instructions. Further instructions must be reasonable and in writing.

3.2 The processor tells the controller if it believes an instruction breaks data protection law. It may suspend the instruction until the controller confirms or changes it.

3.3 The processor does not process customer personal data for its own purposes, except as the law requires and except for the two purposes in 3.4, and does not sell it or share it for cross context behavioral advertising.

3.4 For two purposes the processor acts as a controller in its own right, on the basis of its legitimate interest in protecting LinkedIn accounts and the people they contact. First, the counting columns of the action record (type, status, times, provider reference, no message text) are kept for 24 months after the identity's last action (ACTION_LOG_RETENTION_MONTHS), and are counted across customers for the same LinkedIn identity, so that the limits protecting that account hold even when it is connected by more than one customer. Second, a platform wide do-not-contact list holds the people who asked not to be contacted, and applies to every customer. The processor uses this data for nothing else.

4. Controller duties

The controller is responsible for having a lawful basis for the processing, for giving data subjects the notice that Article 13 and 14 of the GDPR and the UK PECR require, for the accuracy and origin of imported lists, and for not importing special category data without telling the processor first. The controller must keep its do-not-contact list current.

5. Confidentiality

The processor makes sure that everyone it authorizes to process customer personal data is bound by a duty of confidentiality. Operators cannot read message bodies in the support view without a separate permission and an audited reason.

6. Security

The processor applies the technical and organizational measures in Annex 2 and keeps them at a level that fits the risk. It may update them if the protection does not get weaker.

7. Sub-processors

7.1 The controller gives general authorization for the sub-processors in the Sub-processors page.

7.2 The processor tells the controller at least [Sub-processor Notice Days] days before it adds or replaces a sub-processor, by email or in the app. The controller may object on reasonable data protection grounds within that period. The parties then work in good faith toward a solution. If there is none, the controller may end the affected service and receive a refund of fees paid for the unused period.

7.3 The processor has a written contract with each sub-processor that imposes duties no less protective than these, and remains liable for the sub-processor's performance.

8. Assistance

8.1 The processor assists the controller, with appropriate measures and taking into account the nature of the processing, in answering requests from data subjects. The service provides a lead erasure that deletes the lead, its conversations and messages and clears lead links on action records, a do-not-contact list that survives re-imports, and the controller's own access to its data. The processor passes on any request it receives directly and does not answer it without the controller's instruction, except to confirm that it has passed it on or to add the person to the do-not-contact list.

8.2 The processor assists with security, breach notification, data protection impact assessments and prior consultation under Articles 32 to 36 of the GDPR, taking into account the information it has. [Fee for assistance beyond standard features, if any.]

9. Personal data breach

The processor tells the controller of a personal data breach affecting customer personal data without undue delay [and in any event within [Breach Notice Hours] hours] after becoming aware of it. The notice describes the nature of the breach, the data and people affected where known, the likely consequences, and the measures taken. The processor keeps the controller informed as it learns more. The controller decides whether to notify the regulator and the data subjects.

10. Return and deletion

10.1 During the term the controller can delete leads, accounts and workspaces itself. Deleting a lead removes its conversations and messages. Deleting an account removes its stored sessions and clears message text from the action record. Deleting a workspace removes its data after the retention period in the privacy policy.

10.2 When the subscription ends, the processor purges the stored LinkedIn sessions 30 days later (SESSION_PURGE_AFTER_DAYS) and disconnects accounts still connected 30 days after that (DISCONNECT_AFTER_PURGE_DAYS). On the controller's written request, at any point, the processor deletes or returns the rest of the customer personal data, and deletes existing copies unless the law requires storage. The controller can export the data that the product offers an export for, and may ask support for a copy of the rest in a common format [Confirm export scope before launch].

10.3 Backups are encrypted and expire on a schedule of up to 30 days. Deleted data in a backup is not restored into live use, and a restore re-applies the do-not-contact lists first.

10.4 As 3.4 says, the processor keeps without customer content only what it needs to protect accounts and to meet its legal duties: the counting columns of the action record (type, status, times, provider reference), which are kept for 24 months after the identity's last action (ACTION_LOG_RETENTION_MONTHS), and billing records.

11. Audits

The processor gives the controller the information needed to show compliance with Article 28 and allows audits, including inspections, by the controller or an auditor it names, no more than once a year unless a breach or a regulator requires otherwise, on [Audit Notice Days] days' notice, during working hours, under confidentiality and without access to other customers' data. The processor may offer a current third party report or a completed questionnaire first. The controller bears the cost of an audit.

12. International transfers

12.1 The controller authorizes the processor to transfer customer personal data to the sub-processors and locations in the Sub-processors page.

12.2 Where data protection law requires a transfer mechanism, the parties enter into the standard contractual clauses in Annex 3 and, for transfers subject to the UK GDPR, the UK addendum in Annex 4. If a country has an adequacy decision for the recipient, that applies instead.

13. California

For customer personal data that is personal information under the CCPA, the processor is the controller's service provider. It will not sell or share the personal information, will not retain, use or disclose it for any purpose other than the business purposes in this agreement and the terms or outside the direct relationship with the controller, and will not combine it with personal information from other sources except as the CCPA allows. It will comply with the CCPA and give the same level of privacy protection, will tell the controller if it can no longer meet its duties, and allows the controller to take reasonable steps to stop and fix unauthorized use. The controller may monitor compliance through the audit right above. The processor certifies that it understands these restrictions.

14. Liability and order of precedence

Each party's liability under this agreement is subject to the limits in the terms, [except as the standard contractual clauses require]. If this agreement conflicts with the terms, this agreement applies to customer personal data. If it conflicts with the standard contractual clauses, the clauses apply. Governing law is [Governing Law], and the standard contractual clauses follow Annex 3.

Annex 1. Details of the processing

Annex 2. Technical and organizational measures

• Sealed sessions. LinkedIn session cookies are encrypted in the user's browser to the worker's public key. The web and admin applications hold only public keys and cannot open them. Only the worker holds the private keys, set on the worker alone. Cookie values are never logged, never put in error reports or job payloads, never returned by an API and never shown in the admin console.
• Tenant separation. Every record belongs to a workspace and is reached only through code that scopes to it. Cross tenant access by operators is a separate, audited path. Customer screens read through named read models. Tests check that one organization cannot read or change another's data.
• Access control. Every server action and API route authenticates, authorizes against a named permission and calls a core operation. Sensitive permissions, such as reading message bodies in the support view and deleting data, are separate and not in default roles.
• Operator security. The admin console is a separate deployment with its own secret. Every operator must use multi factor authentication. Administrative changes are audited in the same transaction.
• Minimization. Only an allowlist of cookies is read. Message text and its hash are cleared 30 days after an action finishes. Credentials are not stored in the first release.
• IP separation. Each account uses its own fixed IP address. The service never falls back to a direct connection from the worker host. IP provider credentials are held as secrets in the worker environment.
• Secrets. Secrets are kept in platform secret stores, not in the code. Dependency updates are reviewed.
• Transport and application security. TLS in transit, security headers, protections against cross site request forgery, a strict origin allow list for the extension API, rate limits on sign in, pairing and extension endpoints, signature verified payment webhooks, and checks on outbound webhook addresses.
• Backups and recovery. Backups are encrypted and kept apart from the encryption keys. Restores are rehearsed, and a restore re-applies do-not-contact lists first.
• Logging. Cookies, tokens, passwords and message bodies are never logged. Errors go to an error tracker that scrubs them.
• Incidents. The processor follows a written incident plan, including key rotation and a purge of stored sessions after a key compromise, and tells customers without undue delay.
• Personnel. Staff are bound by confidentiality and get the access their role needs. [Counsel and the company to add personnel measures such as training and background checks if they apply.]

Annex 3. Standard contractual clauses (outline)

The parties adopt the standard contractual clauses in Commission Implementing Decision (EU) 2021/914 for transfers to countries without an adequacy decision, completed as follows. Counsel inserts the full text.

Annex I.A, list of parties. Data exporter: the controller, with name, address, contact person, role and signature date taken from its order. Data importer: [Company Legal Name], [Registered Address], contact [Data Protection Contact], role processor.

Annex I.B, description of transfer. The categories of data subjects, types of personal data, frequency, nature, purpose and retention in Annex 1 above. Special categories: none intended. Onward transfers: to the sub-processors listed on the Sub-processors page, for the purposes shown there.

Annex I.C, competent supervisory authority. [Supervisory Authority].

Annex II, technical and organizational measures. Annex 2 above.

Annex III, list of sub-processors. The Sub-processors page as it stands at the date of signing.

Annex 4. UK addendum (outline)

For transfers subject to the UK GDPR, the parties adopt the International Data Transfer Addendum to the EU standard contractual clauses issued by the Information Commissioner's Office, in force from 21 March 2022, completed as follows. Counsel inserts the full text.

[Switzerland: counsel to decide whether a Swiss addendum, adapting references to the supervisory authority and to Swiss law, is needed.]