Data Processing Addendum

1. Parties and scope

This Data Processing Addendum (“DPA”) is between you, the customer identified in the account that accepts it (“Customer”), and TODO — registered company name, company number TODO — company number, registered at TODO — registered address (“Processor”, “we”), which operates OrganicUsers.ai.

It applies to personal data we process on your instructions through the service — principally the contacts and prospects you upload or that we enrich for your outbound campaigns, the replies they send, and any personal data contained in the content you create. It does not apply to personal data for which we are the controller, such as your own account and billing data; that is covered by our Privacy Policy.

2. Roles

For the data described above, Customer is the controller and we are the processor. Where Customer is itself a processor for another controller, we are a sub-processor and Customer confirms it has the authority it needs to appoint us. Terms such as “personal data”, “processing”, “controller”, “processor” and “data subject” have the meaning given in the UK GDPR and the EU GDPR, as applicable (together, “Data Protection Law”).

3. Our obligations

• We process personal data only on Customer’s documented instructions — which include the instructions given through normal use of the service — and for no other purpose. We do not sell it and do not use it to train models.
• We tell Customer if an instruction appears to us to infringe Data Protection Law, and may pause that processing until it is resolved.
• We keep personal data confidential, and bind our staff and contractors who can access it to confidentiality.
• We limit access to staff who need it for a task, and keep a record of who has it.
• We implement the technical and organisational measures in section 9.
• We assist Customer, at Customer’s cost where the work is substantial, with data protection impact assessments and with consultations with supervisory authorities.

4. Customer’s obligations

• Customer determines what personal data enters the service and warrants it has a lawful basis for the processing it instructs, including for outbound contact with the prospects it uploads.
• Customer provides the notices and obtains the consents its own privacy law requires, and complies with the rules of the third-party platforms the service acts on — see the “Third-party platforms” section of our Terms.
• Customer must not upload special category personal data, children’s data, or payment card data to the service; it is not designed for them and we do not accept them as part of the processing described here.

5. Subprocessors

Customer gives us general authorisation to engage subprocessors. The current list is published at organicusers.ai/subprocessors and forms part of this DPA.

• We impose data protection obligations on each subprocessor that are no less protective than those in this DPA, and remain responsible to Customer for their performance.
• We give Customer at least 30 days’ notice, by email to the account’s administrative address, before a new subprocessor starts processing Customer’s personal data.
• Customer may object within those 30 days on reasonable data protection grounds. We will work in good faith to offer an alternative; if we cannot, Customer may terminate the affected part of the service and receive a pro-rata refund of fees paid for the unused remainder of the term.

6. International transfers

Where processing under this DPA involves transferring personal data outside the UK or the EEA, the parties rely on the European Commission’s Standard Contractual Clauses (Module Two, controller to processor, or Module Three where we act as a sub-processor) and, for UK transfers, the UK International Data Transfer Addendum to those clauses, each of which is incorporated into this DPA by reference and completed with the details in the Annex below. Where an adequacy decision covers a transfer, that is relied on instead.

7. Data subject requests

The service lets Customer access, export, correct and delete the personal data it holds in its account. If a data subject contacts us directly about data we process for Customer, we will not respond to the substance of the request; we will tell them to contact Customer and let Customer know, unless the law prevents us. Where Customer cannot satisfy a request through the service itself, we will assist within 10 business days of a request to privacy@organicusers.ai.

8. Personal data breaches

We notify Customer without undue delay, and in any event within 48 hours, of becoming aware of a personal data breach affecting personal data we process for Customer. The notice describes what we know of the nature of the breach, the categories and approximate number of records affected, the likely consequences, and the measures taken or proposed. We assist Customer with its own notification duties. Notifying Customer is not an admission of fault.

9. Security measures

• Encryption of personal data in transit (TLS 1.2 or above) and at rest, with OAuth tokens and provider credentials encrypted separately.
• Authentication through a managed identity provider, with multi-factor authentication available on customer accounts and required for staff access to production.
• Tenant isolation enforced in the application and in database security rules, so one customer’s data is not reachable from another’s account.
• Least-privilege access control for staff, reviewed periodically, with privileged actions audited.
• Managed, encrypted backups with a defined retention window, and restoration tested periodically.
• Dependency and vulnerability monitoring, and security review of changes before release.
• Logging and monitoring of application errors and administrative actions.

10. Audits

On request, and no more than once in any 12-month period unless a supervisory authority or a breach requires otherwise, we will provide the information reasonably needed to demonstrate compliance with this DPA — a completed security questionnaire, a description of our measures, and any third-party reports we hold. On-site or third-party audits are available where Data Protection Law requires them, at Customer’s cost, on 30 days’ notice and subject to confidentiality.

11. Deletion and return

On termination of the service, or on Customer’s earlier written request, we delete the personal data we process for Customer within the periods set out under “Data retention” in the Privacy Policy, and instruct our subprocessors to do the same. Before deletion Customer may export its data from the service. We may retain personal data where the law requires us to, and continue to protect it under this DPA for as long as we hold it.

12. Liability and precedence

Each party’s liability under this DPA is subject to the limitations and exclusions in the Terms of Service. If this DPA conflicts with the Terms, this DPA governs for the processing it covers; if it conflicts with the Standard Contractual Clauses, the Clauses govern. This DPA is governed by the law of England and Wales, except where the Clauses require otherwise.

13. How to accept this DPA

This DPA forms part of the Terms of Service and takes effect for your account when you start a paid subscription — there is nothing you need to sign for it to apply. If your procurement process needs a counter-signed copy, or your own DPA reviewed, email legal@organicusers.ai with your legal entity name, registered address and the signatory’s details, and we will return an executed copy.

Annex — details of processing

• Subject matter — provision of the OrganicUsers.ai organic growth service to Customer.
• Duration — the term of Customer’s subscription, plus the retention periods in section 11.
• Nature and purpose — storing, enriching, generating and sending content and outbound messages; monitoring public platforms for relevant discussions; analysing search and AI-answer performance; and reporting results back to Customer.
• Categories of data subject — Customer’s prospects and contacts, people who reply to Customer’s campaigns, and Customer’s own personnel who use the service.
• Types of personal data — name, business email address, job title, employer, company domain, public professional profile information, and the content of messages sent to and received from those people.
• Special category data — none. The service is not to be used to process it.
• Frequency of transfer — continuous, for as long as the service is in use.
• Subprocessors — as published at organicusers.ai/subprocessors.
• Competent supervisory authority — the authority of Customer’s establishment; for UK transfers, the Information Commissioner’s Office.