Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between GAMMA IT SOLUTIONS SRL (“we”) and a Business User (“you”). Terms not defined here have their meaning in the Terms or the GDPR (Regulation (EU) 2016/679). “Customer Personal Data” is personal data you or your members upload or submit to the Service, and the results of processing it on your instructions. For it, you are the controller (or a processor for your own controller) and we are your processor.

This DPA does not cover account, billing and technical data, for which we are an independent controller, nor Data Scout’s index of business contact details published on company websites, which we hold as controller under our Privacy Policy. A record you save or export from the index becomes Customer Personal Data.

We process Customer Personal Data only on your documented instructions — the Terms, this DPA and your use of the Service (uploading, enriching, verifying, exporting, syncing to an integration you connect) — or where the law requires it, telling you first unless the law forbids it. We tell you if an instruction appears to infringe the law. We do not sell Customer Personal Data, add it to our index or train models on it.

Data: names, email addresses, phone numbers, job titles, company names, profile links, verification and enrichment results, and notes you attach. Data subjects: your prospects, customers, suppliers and business contacts. Nature: storage, enrichment, verification, retrieval, export and transmission, for the duration of the Terms. Do not submit special categories of data (GDPR Art. 9) or criminal-conviction data (Art. 10).

Everyone we authorise to process Customer Personal Data is bound by confidentiality. Our measures under GDPR Art. 32 include tenant isolation in the database (row-level security) and the application, encryption in transit, hashed passwords and API keys, encrypted integration credentials, role-based access, an audit log, and nightly off-site backups encrypted at rest by their provider. We may change them if the overall protection does not decrease.

You authorise the sub-processors on our Sub-processors page. Each is bound by equivalent data protection terms, and we remain responsible for them. We announce a change 30 days ahead there and by email to organization owners; if you object on reasonable data protection grounds and we cannot resolve it, you may terminate the affected subscription with a refund of prepaid fees for the unused period.

The Republic of Moldova has no EU adequacy decision. Where you are subject to the GDPR (or its UK or Swiss equivalent), the Standard Contractual Clauses of Commission Implementing Decision (EU) 2021/914 are incorporated by reference — Module Two where you are a controller, Module Three where you are a processor — with you as exporter, us as importer, this DPA completing their annexes, and the law and courts of the EU Member State where you are established. Onward transfers rely on an adequacy decision, the EU–US Data Privacy Framework or Standard Contractual Clauses, as listed on the Sub-processors page.

The Service lets you find, correct, export and delete Customer Personal Data yourself; a data subject’s request that reaches us is passed to you without undue delay. We notify you of a personal data breach affecting Customer Personal Data without undue delay and within 48 hours of becoming aware of it, with what is known then, and help with your own notifications. We provide the information needed to demonstrate compliance with Art. 28 and answer reasonable security questionnaires; where that is not enough, an independent auditor bound by confidentiality may audit us once a year, on 30 days’ notice, at your cost.

Export Customer Personal Data before closing an account. For 30 days after the Terms end we can restore a closed organization on request; then we delete the data unless the law requires otherwise, and backup copies expire on the schedule in the Privacy Policy. Liability follows the Terms for Business Users, except where data protection law does not allow the limit. This DPA prevails over the Terms on Customer Personal Data, and the Standard Contractual Clauses prevail over both. Notices: [email protected].