Data Processing Agreement

This agreement is between you, the customer (the controller), and LVDP, Klinkkouterstraat 59, 9040 Sint-Amandsberg, Belgium (company number BE 1008.270.260), which provides mySDR (the processor). It covers the personal data mySDR processes for you in your workspace, and meets Article 28 of the GDPR. It is part of the Terms of Service and applies as soon as you accept them. Where the two differ on personal data, this agreement wins.

It does not cover the data mySDR processes as a controller itself, such as your account and billing data. The Privacy Policy covers those.

• Purpose: providing mySDR: finding, enriching and storing leads and companies, running the signals you set up, sending the outreach you start, and showing the results.
• Data subjects: your prospects and leads, the people at the companies in your workspace, the people you message and who reply, and your own users.
• Data: name, job title, employer, location, professional profile URL, public posts and reactions, business email address and phone number, messages and replies, and the notes and fields you or your assistant add.
• Special categories: none. Do not put them in mySDR.
• Duration: for as long as your workspace exists, plus the deletion period in section 8.

You decide why and how the data is used. You make sure you have a legal basis for it, that you inform the people you contact as the GDPR requires, and that you honour their objections and opt-outs. Your instructions are these terms, your settings, and what you or your assistant ask mySDR to do.

• We process the data only on your documented instructions, unless the law requires otherwise; we then tell you first where allowed.
• We tell you if we believe an instruction breaks the GDPR.
• Everyone at mySDR with access to the data is bound by confidentiality.
• We help you, as far as we reasonably can, to answer requests from data subjects (access, correction, deletion, objection, portability), and with impact assessments and questions from a supervisory authority. A request that reaches us directly, we forward to you.

We protect the data with measures that fit the risk, including:

• encrypted connections (HTTPS/TLS) and encryption at rest by our hosting providers;
• separation of workspaces in the database (row level security);
• access for our staff only where needed to run or support the service;
• hashed API keys that you can revoke at any time, and logs of API use;
• a database hosted in the European Union, in Ireland, with backups.

You authorise us to use sub-processors to run mySDR, such as hosting, AI and data providers. We bind each one to data-protection terms at least as strict as these. The current list, with what each does and where it is located, is available on request at privacy@mysdr.app. We email workspace owners at least 30 days before we add a new sub-processor. If you object on reasonable grounds and we cannot solve it, you can end your subscription before the change and we refund the unused part of the paid period.

Some sub-processors process data outside the European Economic Area, for example in the United States. We only transfer data there with a valid safeguard under the GDPR: an adequacy decision (such as the EU-US Data Privacy Framework) or the European Commission's Standard Contractual Clauses.

• We notify you without undue delay, and within 48 hours, after we become aware of a personal data breach that affects your data, with what we know and what we are doing about it.
• When you delete your workspace or your account ends, we delete the personal data within 30 days, unless the law requires us to keep it. Before that, you can export your tables through the API.

On request we give you the information you need to show that we meet this agreement. If that is not enough, you can have an audit done once a year, at your cost, by an auditor bound by confidentiality, with 30 days notice and without disrupting the service.

The limits of liability in the Terms of Service apply to this agreement, except where the GDPR does not allow that. This agreement ends when the Terms of Service end, but its obligations on the data last as long as we hold it. Need a signed copy, or have a question about this agreement? Email privacy@mysdr.app.