Data processing agreement

• Data Protection Law: the UK GDPR, the Data Protection Act 2018, and any other law about personal data that applies in the UK, as amended or replaced from time to time.
• Controller, processor, data subject, personal data, personal data breach and processing have the meanings Data Protection Law gives them.
• Customer Personal Data: the personal data in your Customer Data that we process for you, described in Annex 1.
• Sub-processor: another processor we engage to process Customer Personal Data, listed in Annex 3.
• Restricted transfer: a transfer of Customer Personal Data outside the UK that Chapter V of the UK GDPR restricts.

4.1 We'll process Customer Personal Data only on your documented instructions, including about restricted transfers. Your instructions are:

• the terms of service and this agreement;
• how you and your Authorised Users set up and use the Service, including what your Sources send and delete;
• any other written instructions we agree with you.

4.2 If UK law requires us to process Customer Personal Data in another way, we'll tell you before we do, unless that law forbids telling you on important grounds of public interest.

4.3 We'll tell you straight away if we think an instruction infringes Data Protection Law. We don't have to follow an instruction that we reasonably believe does.

6.1 We take the technical and organisational measures Article 32 of the UK GDPR requires, to keep Customer Personal Data secure. Annex 2 describes them.

6.2 We review them regularly and may change them as technology and risks change, but never in a way that lowers the overall level of protection.

8.1 Taking into account the nature of the processing, we'll help you, as far as we can by appropriate technical and organisational measures, to respond to people exercising their rights under Data Protection Law, such as access, correction, erasure and objection.

8.2 Much of this help is built into the Service: you can find a person and all their records, see how their records were matched, record an erasure request and follow it until every record has been deleted in its Source, and be warned if an erased person reappears.

8.3 If a person contacts us directly about Customer Personal Data, we'll pass their request to you promptly and won't respond to it ourselves unless you ask us to.

10.1 We'll tell you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.

10.2 We'll give you what we know, and the rest as we learn it, including:

• what happened, the categories and approximate numbers of people and records affected;
• the likely consequences;
• what we've done or propose to do about it, including to reduce any harm;
• who you can contact for more information.

10.3 We'll take reasonable steps to contain the breach and to stop it happening again. It's for you, as controller, to decide whether to tell the Information Commissioner's Office or the people affected, and we'll help you do so.

12.1 While the agreement lasts, you can delete Customer Personal Data at any time: when a Source deletes a record, the Service removes that record's personal details. It keeps the record's IDs (including its ID in your system), its links, and the decisions and audit history about it (which name the Authorised Users involved and include any notes they wrote) until your account is deleted.

12.2 Customer Personal Data comes from your own systems, so you already hold it. What the Service adds is the identity map: which records belong to the same person. You can take the identity map at any time through the identity map feed, and see everything else, including decisions and notes, in the Service, while the agreement lasts and while your account is read-only after it ends. If you'd like a copy of anything else, such as the audit history, ask us before your account is deleted, and we'll provide it in a common file format.

12.3 When the agreement ends, we'll delete Customer Personal Data within the times clause 12 of the terms of service sets out, unless UK law requires us to keep it. Deleted data can remain in backups for up to37 days after deletion from the live database, while those backups expire. When we've deleted your account, we'll confirm it in writing if you ask.

14.1 We store and process the customer records held in the app in Microsoft Azure's UK South region. Sign-in directory data and any Customer Personal Data included in support emails are handled in the locations described in Annex 3. Transfers outside the UK must meet clause 14.2.

14.2 A sub-processor may make a restricted transfer only as Annex 3 describes, and only with a safeguard Chapter V of the UK GDPR allows, such as UK adequacy regulations, the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.

The limits on liability in clause 18 of the terms of service apply to this agreement. They don't limit the rights people have under Data Protection Law.

• Subject matter: providing the Service: matching your customer records and keeping your identity map.
• Purpose: to recognise which of your records belong to the same person across your systems, give each person a permanent ID, and let your Authorised Users review and use the results, on your instructions.
• Nature of the processing: receiving records from your Sources through the API and as full snapshots, and from CSV files your admins upload (kept in private storage in the UK South region only until they've been imported, and anything left behind deleted within two days); storing them; standardising names, dates, phone numbers, emails and addresses; comparing and scoring records and linking those that match; grouping them into people; showing them to your Authorised Users for review; recording their decisions; providing the identity map feed, which holds IDs only; removing personal details when a Source deletes a record; and tracking erasure requests.
• Duration: the life of the agreement, plus the time clause 12 needs to delete the data.

Categories of data subjects

• Your customers, prospects, contacts and anyone else whose records your Sources send.
• Your Authorised Users.

Types of personal data

• From your records: title; first and last names, including suffixes such as Jr and Sr; email address; phone numbers; date of birth; address lines and postcode; the record's ID in your system, and which Source sent it.
• Created by the Service from your records: standardised versions of those details and keys for finding likely matches; the evidence for each comparison and its score; quality flags, such as an email that looks like a placeholder or a phone number shared by many records; counts of how often each first name, last name, email address and phone number appears in your records; links between records; person IDs; and records of which person IDs replaced which.
• Erasure records: for each erasure request, the person ID, the date received, any note your Authorised User adds, and keyed one-way codes (HMAC-SHA256, using a key kept for your account) made from the person's email addresses, phone numbers, and name with date of birth, used only to spot the person if they're sent again. They're kept until the request is withdrawn or your account is deleted.
• About your Authorised Users: name, email address, sign-in identifier, role, when they last signed in, and the decisions, notes and changes they make, kept in the audit history.
• In support correspondence: any Customer Personal Data you include in a support message or attachment, used only to handle your request.
• In technical logs: Authorised Users' email addresses (for example when a sign-in is refused) and record IDs, kept for 30 days.

Special category data

None. The Service isn't designed for it, and clause 6.3 of the terms of service rules it out unless we agree otherwise in writing.

How long data is kept

• A record's personal details: until a Source deletes it, or your account is deleted.
• IDs, links, decisions and audit history: until your account is deleted.
• A Sandbox you remove: 30 days after you remove it.
• Backups: kept to support your Plan's restore window (7 or 30 days). Copies can remain for up to 7 extra days as Azure's backup cycle completes. No long-term backups are included.
• Technical logs: 30 days.
• Customer Personal Data in support correspondence: while needed to handle the request, and no later than the deletion times in clause 12 when the agreement ends. Our own account and billing records are covered separately by the privacy notice.

• Microsoft (Microsoft Ireland Operations Limited): Microsoft Azure, which hosts the Service, its database, storage and logs, in the UK South region; and Microsoft Entra External ID, which signs in Authorised Users and holds their names and email addresses, in Europe. Transfers outside the UK are subject to the safeguards in Microsoft's data protection terms, including the EU Standard Contractual Clauses and the UK International Data Transfer Addendum.
• IONOS: email delivery and storage, including Customer Personal Data you choose to include in support correspondence. Its data processing termsprovide for processing in the UK or European Economic Area, with legal safeguards required for any necessary transfers elsewhere. The customer records held in the app remain in Azure.

Our payment provider, Stripe, handles only our own billing details for your organisation, not Customer Personal Data.