AutoLeadsData processing agreement
This agreement is part of the Terms of service and is accepted when subscribing. It governs the processing of personal data we carry out on behalf of the customer, in accordance with article 28 of Regulation (EU) 2016/679 (GDPR).
1. Parties and roles
Controller: the customer. Processor: [COMPANY NAME], tax ID [TAX ID].
2. Purpose and scope
Most prospecting data is processed and kept on the customer's computer, with no access on our side. This agreement covers only the processing that passes through our online services:
| Processing | Data | Data subjects | Duration |
|---|---|---|---|
| Analysis and writing with artificial intelligence | Text of public professional profiles, the customer's criteria, messages and replies | People searched for or contacted by the customer | Only during the request; not kept, except for the provider's technical log under its contract |
| Sync between the customer's computers (only if turned on) | End-to-end encrypted copy of the app's database; the processor does not have the key and cannot access its content | People searched for or contacted by the customer | While sync is on (last three versions); deleted when it is turned off or the account is closed |
| Exclusion list | LinkedIn profile address and reason | People who asked not to be contacted | While the service exists, to guarantee they are not contacted |
3. Obligations of the processor
- Process the data only according to the customer's documented instructions, which are those set up in the program and these terms.
- Guarantee the confidentiality of the people authorised to process it.
- Apply the security measures of article 32 GDPR.
- Not engage another processor without authorisation (see section 4).
- Help the customer honour data subjects' rights and meet its obligations on security, breach notification and impact assessments.
- Notify the customer of any security breach affecting its data without undue delay and, where possible, within 48 hours.
- When the service ends, delete the data we keep on behalf of the customer, unless the law requires otherwise.
- Make available to the customer the information needed to demonstrate compliance and allow reasonable audits, with 30 days' notice and at its cost.
4. Sub-processors
The customer gives general authorisation to the sub-processors in the providers table of the Privacy policy. We will give 30 days' notice of any new sub-processor; the customer may object on reasonable grounds and, if no solution is found, cancel the subscription without penalty.
5. International transfers
Transfers outside the European Economic Area will only take place with an adequacy decision or with European Commission standard contractual clauses and the necessary supplementary measures.
6. Obligations of the customer
- Have a valid legal basis to process the data of the people it searches for and contacts, and inform them (arts. 13 and 14 GDPR).
- Handle data subjects' requests and add to the exclusion list whoever asks for it.
- Not enter special categories of data (health, beliefs, etc.) in criteria or messages.