Data Processing Agreement (DPA)
中文Effective date: 【TBD: publication date】
This Data Processing Agreement (this "Agreement") forms part of the service agreement between 【TBD: full legal entity name】 (the "Processor") and the customer (the "Controller"), and applies where the Processor processes personal data on the Controller's instructions 【Pending counsel: once the characterisation of the parties' roles (L-7) is confirmed, this paragraph may be restated as joint controllership or as a layered structure】.
1. Subject matter, nature and purpose of processing
In order to provide the prospecting workspace services to the Controller, the Processor processes the following categories of personal data on the Controller's instructions: business contact information imported by the Controller or obtained through the platform (name, job title, work email address, links to public professional profiles and similar business-context contact details); and outreach message content and delivery records. The categories of data subject are: employees of the target companies of the Controller. Seat Users' account information is processed by the Processor as an independent controller of that information and is governed by the Privacy Policy rather than this Agreement 【Pending counsel: the structure of this paragraph to be reviewed together with the role characterisation under L-7】. The duration of processing is the term of the service agreement plus the deletion transition period provided for in this Agreement.
2. Obligations of the Processor
The Processor undertakes that it will: (a) process personal data only on the documented instructions of the Controller (use of the platform's functionality constitutes such instructions), except where required otherwise by law, in which case the Processor will give prior notice to the extent permitted by law; (b) ensure that persons with access to personal data are bound by obligations of confidentiality; (c) implement technical and organisational measures appropriate to the risk, including: row-level tenant isolation in the database with a default-deny policy, envelope encryption of credentials (AES-256-GCM with a separate key per record), encryption in transit, least-privilege access and audit logging, and security gates in continuous integration (secret-leak scanning and privacy-field registration completeness checks); (d) assist the Controller in responding to data subject rights requests — the platform provides built-in provenance tracing, a deletion workflow (completed within 30 days, with confirmation of execution to the Controller), and a global unsubscribe suppression mechanism; (e) notify the Controller without undue delay after becoming aware of a personal data breach 【TBD: specific number of hours; our preference is no later than 72 hours】, and provide the information available to it in order to assist the Controller in meeting its own reporting obligations; (f) on termination of the services, delete or return all personal data at the Controller's election, save for data within the scope of a statutory retention obligation (such as the billing ledger) — such data will be de-identified and retained solely for the statutory purpose.
3. Subprocessors
The Controller authorises the Processor to engage subprocessors; the current list is published on the subprocessors page. Where the Processor adds or replaces a subprocessor it will publish the change on that page and notify the Controller 【TBD: number of days; our preference is 30 days】 in advance; the Controller may object on reasonable grounds within the notice period, and the parties will seek to resolve the matter by negotiation. The Processor requires each subprocessor to accept data protection obligations appropriate to the data it accesses, and remains responsible for its subprocessors' performance; the actual status of each subprocessor's data protection agreement is stated accurately on the subprocessors page.
4. Cross-border transfers
The primary storage location for personal data is Singapore; some subprocessors are located in the United States and the European Union. Where a cross-border transfer of data subject to the GDPR is involved, the parties agree that the EU Standard Contractual Clauses (SCCs) apply as the transfer mechanism and are deemed incorporated into this Agreement 【Pending counsel: choice of SCC module and whether a separately executed instrument is required, to be determined after the role characterisation under L-7】; where an outbound transfer of personal information from mainland China is involved, the applicable outbound compliance route will be followed 【Pending counsel: L-5】.
5. Audit
The Processor will, on the Controller's request, make available the information necessary to demonstrate compliance with this Agreement. The Controller may initiate one audit (including through an appointed third party) in any twelve-month period, on reasonable prior written notice and in a manner that avoids disrupting the Processor's normal operations; the Processor may satisfy an audit request by providing a current third-party audit report or certification 【TBD: the certifications we are able to provide, to be stated accurately at launch】.
6. Liability and general
Liability under this Agreement is subject to the allocation and caps set out in the service agreement. Where this Agreement conflicts with the service agreement, this Agreement prevails in respect of personal data protection matters. Matters not addressed in this Agreement are governed by the general terms of the service agreement.
Note
Data is fully isolated between the platform's customers (tenants), and the Processor does not reuse any Controller's personal data for another Controller. Every business contact record carries source, basis and retention markers, which can be provided together with an export.