Data processing agreement

1. Scope and roles

This agreement covers personal data you put into GenTool or have GenTool hold for you: your members' account details, people you import from your own lists or signups, your provider keys, your product facts, ICP, offer and tone rules, your drafts, receipts and never-contact list ("customer data"). For customer data we process on your documented instructions as your processor under Article 28 GDPR and Article 28 UK GDPR, and as your service provider under the California Consumer Privacy Act (section 1798.140(ag) and regulation 7051).

For the research step, in which our code and models decide which public pages to open, what to extract and which lookups to make on the companies you name or we suggest, each of us is an independent controller: we for the research, the 18-month retention rule and objections made to us; you for your use of the result and for sending. Section 8 sets out each side's duties for that step.

2. Subject matter, duration, nature and purpose

Processing of customer data to provide the GenTool service described in the terms, for the duration of the contract and the purge period that follows it. Data subjects: your members and users; people you import or who sign up with you; business contacts at the companies you research. Categories: name, role, work e-mail address, LinkedIn profile URL where shown by the employer, company and domain, evidence excerpts with their source, drafts, receipts and queue states, your members' identifiers and the audit log of their actions. No special categories are processed; you may not import any.

3. Instructions

Your instructions are the terms, this agreement, your settings and the actions you and your members take through the dashboard, the connector and the API. We process customer data only on them, unless EU or German law requires otherwise, in which case we tell you before processing where the law allows. We tell you if we think an instruction infringes data protection law.

4. Confidentiality and persons under our authority

Only persons bound by confidentiality act on customer data, and only as far as their task requires. Access to production data is by named least-privilege roles and is logged.

5. Security measures

The technical and organisational measures are those on the security page, which forms part of this agreement: envelope encryption of stored keys, row-level tenancy with organisation-scoped transactions, an append-only audit log, untrusted handling of fetched text, no stored platform credentials, least-privilege database roles, secrets only through the platform's secret store, and the retention rules. We may improve measures; we do not lower the level of protection during the contract without your consent.

6. Sub-processors

You authorise the sub-processors listed on the security page and in the privacy notice (Cloudflare, Supabase, Clerk, Stripe, OpenAI, Hunter), each bound by a contract with data protection terms no less protective than these. We announce an addition or replacement on the security page and by e-mail to workspace admins at least 30 days before it takes effect. If you object on reasonable data protection grounds and we cannot offer an alternative, you may terminate the contract with effect from the date the change takes effect, and we refund the unused part of a prepaid period. Providers you connect with your own key (Anthropic, Google, an OpenAI-compatible endpoint, Attio) are your own processors, not our sub-processors.

7. Assistance, rights requests, breaches

We help you answer data subjects by means of the export, the never-contact list and the account page's evidence trail, and we forward to you any request about customer data that reaches us. We assist with your data protection impact assessments and consultations as far as the information is ours to give. We notify you of a personal data breach affecting customer data without undue delay and within 48 hours of becoming aware, with what we know, and we keep you informed.

8. The research step: independent controllers

We publish and keep current a notice for the people we research (/privacy/prospects, English and German), answer their requests including the source of each item, erase and record objections across every workspace that holds the person, purge records untouched for 18 months, never pool, sell or license research results and never use one customer's results for another. You use research results only for your own business-to-business outreach, comply with the sending laws of your market and the recipient's (terms, section 4), record objections and opt-outs in your never-contact list within ten business days, point data subjects who ask to our notice, and do not export research results into a database for resale or into a system that would send automatically.

9. CCPA service-provider terms

For customer data that is personal information of California residents, we: process it only for the business purpose of providing GenTool to you; do not sell or share it; do not retain, use or disclose it outside our direct business relationship with you or for any purpose other than the one specified; do not combine it with personal information received from another person or collected from our own interactions, except as the regulations permit; comply with the CCPA and provide the same level of protection it requires; notify you if we can no longer meet these obligations; and allow you to take reasonable steps to stop and remediate unauthorised use. We certify that we understand these restrictions.

10. International transfers

Customer data is stored in the United States and processed by the sub-processors in section 6 as described in the privacy notice. Transfers out of the EEA and the UK rest on the EU-US Data Privacy Framework and its UK extension where the recipient is certified, otherwise on the EU Standard Contractual Clauses (Decision 2021/914, module two or three as applicable) and the UK International Data Transfer Addendum, which are incorporated by reference with us as data importer where we are the recipient. If a transfer mechanism ceases to be valid, we move to a valid one or, where we cannot, tell you so that you may terminate.

11. Audit

Once a year, and after a breach, you may ask for the information needed to show compliance with this agreement: this page, the security page, the processor list, our records of processing and sub-processor contracts in summary. Where that is not sufficient, you may audit remotely on 30 days' notice, during business hours, at your cost, without access to other customers' data.

12. Return and deletion

You can export customer data at any time (terms, section 8). On deletion of your workspace we purge all customer data seven days after the request, every table included; copies in sub-processors' backups expire with their retention. We keep what EU or German law requires us to keep (billing records) and the never-contact list entries that record objections, since deleting them would defeat the objection.

13. Precedence

This agreement prevails over the terms where they conflict on the processing of personal data. Changes follow the terms' change procedure. German law applies.