Data processing agreement

This agreement is part of the terms between [Company name] (“processor”) and the customer (“controller”). It applies when you send Reachlist personal data of your own: email addresses to verify, names and domains to look up, or a list to enrich.

What Reachlist returns from its sources is not covered here: for that data we are each an independent controller, as the privacy notice describes.

1. The processing

• Subject: running the tools you call on the data you send.
• Data: names, work emails, company domains and LinkedIn URLs of business contacts.
• Duration: as long as you use Reachlist; answers are kept at most 30 days.

2. Our duties

• We process the data only on your instructions, which are your calls to the tools.
• People who handle it are bound to confidentiality.
• We protect it with appropriate measures: encrypted connections, keys stored as hashes, access limited to the people who run the service, short retention.
• We use the sub-processors listed in the privacy notice, under the same duties, and tell you before we add one.
• We help you answer requests from the people concerned and meet your duties on security, breaches and impact assessments.
• We tell you without undue delay, and within 48 hours, after we learn of a breach affecting your data.
• When you close your account we delete your data, unless the law makes us keep it.
• We give you the information needed to show these duties are met, and allow reasonable audits at your cost, once a year.

3. Transfers

Transfers outside the European Economic Area rely on the European Commission's standard contractual clauses (module 2 or 3), which are made part of this agreement by reference.

4. Signing

This agreement applies to every customer as it stands. If you need a signed copy, write to privacy@reachlist.app.