Data processing agreement

This data processing agreement (“DPA”) is between the organization that uses our hosted Lead Tracker service (the “customer”, acting as controller) and SC LIFE CHANGERS SRL, Int. Gheorghe Simionescu nr. 19, Sector 1, Bucharest, Romania (“we”, acting as processor).

It is part of our terms of service and applies whenever we process personal data in the customer’s workspace (“customer personal data”) to provide the service. Accepting the terms accepts this DPA. It meets Article 28 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”); terms such as “personal data”, “processing” and “personal data breach” have the meaning the GDPR gives them.

Personal data about the customer’s own users (their accounts) is covered by our privacy policy, where we act as controller.

• Subject matter and purpose: hosting and running Lead Tracker for the customer, so the customer can manage its leads, contacts, companies and deals.
• Nature of the processing: collecting (including through the customer’s forms and API), storing, organizing, retrieving, displaying, exporting, backing up and deleting data.
• Duration: for as long as the customer uses the service, and until the data is deleted under section 10.
• Data subjects: the customer’s leads, contacts and their colleagues, people who fill in the customer’s capture forms, and the customer’s users as they appear in workspace records.
• Types of personal data: names, email addresses, phone numbers, job titles, employer and company details, deal information, notes, logged calls, emails and meetings, tasks, consent and lawful-basis records, and audit history.
• Special categories: none are intended. The customer must not store special categories of personal data or data about children in Lead Tracker.

We process customer personal data only on the customer’s documented instructions, including for transfers outside the European Economic Area, unless EU or Member State law requires otherwise (in which case we’ll tell the customer first, unless that law forbids it). The customer’s instructions are these terms and this DPA, and what the customer’s users do and configure in the service. Other instructions must be agreed in writing.

We’ll tell the customer straight away if we believe an instruction breaks data protection law.

Only people who need access to run the service can access customer personal data, and only as far as needed. They are bound by confidentiality obligations.

We take the technical and organizational measures in Annex 2 to protect customer personal data, appropriate to the risk (Article 32 GDPR). We may improve them over time, but won’t lower the overall level of protection.

The customer gives us general authorization to use sub-processors. The current ones are listed in Annex 1 and in our privacy policy.

• We’ll email workspace owners at least 30 days before adding or replacing a sub-processor that handles customer personal data. The customer can object on reasonable data protection grounds within that time; if we can’t resolve the objection, the customer may stop using the service and have its data deleted.
• Each sub-processor is bound by a written contract with data protection obligations that are no less protective than this DPA. We remain responsible to the customer for their performance.

Where customer personal data is transferred outside the European Economic Area, we make sure the transfer is covered by an adequacy decision (such as the EU–US Data Privacy Framework, for certified recipients) or by the EU Standard Contractual Clauses, with additional measures where needed.

• Data subject requests. The service has tools for them: per-person export, correction, erasure, consent withdrawal, do-not-contact and retention rules. If they aren’t enough, we’ll help further on request. Requests we receive directly about customer personal data are passed to the customer without undue delay; we won’t answer them ourselves unless the customer asks us to.
• Other obligations. Taking into account the nature of the processing and the information we have, we’ll help the customer with security, breach notification, data protection impact assessments and prior consultation (Articles 32 to 36 GDPR).

We’ll notify the customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting customer personal data. The notice goes to the workspace owners by email and includes what we know at the time: what happened, the categories and approximate number of people and records concerned, the likely consequences, and what we have done or propose to do. We’ll add details as we learn them.

The customer can export its data at any time. When the customer deletes its organization or stops using the service, we delete customer personal data within 30 days, unless the law requires us to keep it. Copies in backups are deleted when the backups expire, at most 30 days later, and are not used in the meantime except to restore the service.

We’ll make available the information needed to show that we meet this DPA, and allow for and contribute to audits, including inspections, by the customer or an auditor it mandates. Requests go to eugen@lifechangers.co. Audits need at least 30 days’ notice, happen during business hours, at most once a year (unless a supervisory authority requires it or after a personal data breach), at the customer’s cost, and must protect the confidentiality of other customers’ data and of our security measures. The software is open source, so its code can be reviewed at any time.

The customer is responsible for having a lawful basis for the processing, for giving the people concerned the information the law requires, for the lawfulness of its instructions, and for how its users use the service.

Each party’s liability under this DPA is subject to the exclusions in the terms of service, except where the law does not allow excluding or limiting it. This DPA lasts as long as we process customer personal data. If it conflicts with the terms of service, this DPA wins on data protection.

We may update this DPA to reflect changes in the law or the service, with at least 30 days’ notice by email to workspace owners. Changes never reduce the protection it gives customer personal data, unless the law requires it.

• Encryption: all traffic uses HTTPS (TLS) with HSTS; the database and backups are encrypted at rest by our database provider.
• Separation between customers: access rules are enforced inside the database (row-level security) on every query, so one organization can’t read or change another’s data. Records can only reference records of the same organization.
• Access control: role-based permissions (owner, admin, member, viewer), invitation-only access to a workspace, and an option to limit members to their own leads. Exports and erasure are restricted to admins.
• Credentials and secrets: passwords are stored as salted hashes; invite tokens and API keys are random and stored hashed; privileged keys stay on the server and are used only for a few narrow operations.
• Abuse protection: rate limits on sign-in, public forms, the API and the voice assistant; spam protection on forms; body size limits.
• Application security: output escaping, a strict content security policy and security headers, validation of all input, and protection against CSV formula injection in exports.
• Logging: an audit log of record changes and security events (role changes, invitations, API keys, exports, imports and erasures), visible to the customer’s admins.
• Resilience: daily database backups held by our database provider.
• Development: automated tests that replay cross-organization and privilege-escalation attacks on every change, dependency vulnerability checks, and security reviews.
• Operations: multi-factor authentication on our administrative accounts for the database, hosting and domain; access limited to the people who need it.