Data processing summary

Template copy. This page summarises the data processing terms that would normally sit in a full Data Processing Addendum (DPA), signed as part of a customer’s order form. It was prepared during the design phase, has not been reviewed by a qualified data protection adviser or lawyer, and must not be published or relied on until it has been. It is a summary only and is not itself a signed legal agreement.

Roles

When your organisation uploads prospect and lead data into LeadClue, your organisation is the controller of that data, and CodesClue is the processor, acting only on your documented instructions as set out in our terms of service and configured through the Service.

Where CodesClue processes your own account and billing data to operate and improve the Service generally, CodesClue acts as controller for that limited purpose, as described in our privacy policy.

Scope and duration

This summary applies for as long as your organisation has an active subscription to the Service, and continues to apply to any residual processing needed to complete deletion or return of data after termination, as described below.

Processing is limited to what is necessary to provide the Service: ingesting uploaded or connected prospect records, scoring them against your configured Ideal Customer Profile, generating a priority queue, drafting outreach messages, and recording replies and outcomes.

Categories of data subjects and personal data

• Data subjects: prospects and business contacts that your organisation uploads or connects (typically business professionals), and users within your organisation who access the Service.
• Personal data: name, job title, employer, business contact details, publicly available professional information, engagement and reply history, and any other fields your organisation chooses to upload or connect. We do not require special category data and ask that you do not upload it .

Sub-processors

We use a limited number of sub-processors to provide infrastructure such as hosting, storage, email delivery and analytics . Each sub-processor is bound by a written agreement that imposes data protection obligations equivalent to those in this summary. We will notify account administrators of any intended change to our sub-processors, and give a reasonable opportunity to object on legitimate data protection grounds before the change takes effect.

Security measures

We apply technical and organisational measures appropriate to the risk, including:

• encryption of data in transit;
• access controls and authentication for staff and systems, on a least-privilege basis;
• logging and monitoring of access to production systems;
• separation of customer data by account, so one customer’s uploaded data is never mixed into another’s scoring or messaging; and
• regular review of these measures as the Service evolves .

Further detail is available to customers on request at security@codesclue.com.

Sub-processing terms

Any sub-processor we engage is contractually required to protect personal data to a standard equivalent to this summary, including confidentiality obligations, security measures and cooperation on data subject requests and breach notification. We remain responsible for each sub-processor’s performance of its obligations.

Data subject requests

If we receive a request from a data subject relating to prospect data uploaded by your organisation (for example, an access, correction or erasure request), we will pass it to you promptly and will not respond directly unless required by law, because your organisation is the controller of that data and best placed to respond. We will provide reasonable assistance to help you respond, using the features of the Service and, where needed, direct support.

Breach notification

If we become aware of a personal data breach affecting Customer Data, we will notify the affected account’s administrator without undue delay, and in any case within the timeframe required by applicable law, together with the information reasonably available to us about the nature of the breach, its likely consequences, and the measures taken or proposed to address it.

Deletion and return

On termination of your subscription, and at your written request, we will delete or return Customer Data within a reasonable period , except to the extent we are required to retain it by law. Backups are rotated out and overwritten on our normal backup cycle rather than deleted on demand, but are not used for any purpose other than disaster recovery in the meantime.

Audit rights

On reasonable notice, and no more than once per year unless required by a regulator or following a security incident, we will make available the information reasonably necessary to demonstrate compliance with this summary, and will allow for an audit, including inspections, conducted by you or an independent auditor mandated by you, subject to reasonable confidentiality and scheduling conditions .

For a signed Data Processing Addendum or further detail, contact privacy@codesclue.com.