This data processing agreement ("DPA") is part of the terms of service between you and LocalSpect ("LocalSpect", "we", "us"). You accept it when you accept the terms. There's nothing to sign. If you need a countersigned copy, write to [email protected].
The short version
- It covers personal data you put into LocalSpect. For that data, you decide what happens to it and we process it for you.
- It doesn't cover the businesses and people LocalSpect finds, or your account details. We're responsible for those ourselves, as our privacy policy explains.
- We use a short list of named providers, tell you before adding one, and let you object.
- We tell you about a breach within 72 hours.
- Transfers out of the EU, UK or Switzerland use the official standard contractual clauses, included here by reference.
1. Roles and scope
- Customer Personal Data means personal data contained in what you put into the Service: your markets, questions, agents, lists, notes and messages to the assistant ("Your Content", as the terms define it).
- For Customer Personal Data, you are the controller and we are your processor. If you are yourself a processor for someone else, we are your subprocessor, and you'll make sure your controller has authorized our processing.
- This DPA doesn't cover your account and billing details, or the business information and work information about people that LocalSpect collects and returns in results. We decide how that data is processed and are its controller, as the privacy policy explains.
2. Details of the processing
| Subject matter and purpose | Providing the Service to you under the terms |
|---|---|
| Nature of processing | Storing, organizing, analyzing (including with AI), retrieving, displaying, exporting and deleting |
| Duration | As long as you use the Service, then until deleted under section 10 |
| Categories of data subjects | People you mention or record in Your Content, such as your prospects, customers, contacts and colleagues |
| Categories of personal data | Names, job titles, business contact details, and other details you choose to include |
| Special category data | None. The terms don't allow you to put it into the Service. |
| Frequency of transfer | Continuous, while you use the Service |
3. Your instructions
- We process Customer Personal Data only on your instructions: to provide and maintain the Service, as you direct through your use of it, as set out in the terms, and as you tell us in writing and we accept. We don't sell it, and we don't let AI providers train their models on it.
- If the law requires us to process it in another way, we'll tell you first unless the law forbids it. If we think an instruction breaks data protection law, we'll tell you.
- You're responsible for having a lawful basis for the personal data you put into the Service, and for giving people any notices and getting any consents the law requires.
4. Confidentiality and security
- Everyone at LocalSpect who can access Customer Personal Data is bound by confidentiality, and only has access where they need it to run the Service.
- We take appropriate technical and organizational measures to protect it. These include encryption of traffic with TLS, hashed passwords, access to production systems limited to the people who run the Service, and written data protection terms with every provider.
5. Providers (subprocessors)
- You authorize us to use our current providers. The list is available on request from [email protected].
- Before we add or replace a provider that will process Customer Personal Data, we email account owners at least 10 days in advance. If we must act faster to keep the Service secure or running, we tell you as soon as we reasonably can.
- You may object on reasonable data protection grounds within those 10 days. We'll try to address your concern. If we can't, you may end the affected plan, and we refund the unused part of what you prepaid.
- Each provider is bound by written terms that protect Customer Personal Data at least as well as this DPA. We remain responsible for our providers' processing.
6. International transfers
- You authorize us and our providers to process Customer Personal Data outside your country as needed to provide the Service, with the safeguards data protection law requires.
- From the EU/EEA to a country without an EU adequacy decision: the European Commission's standard contractual clauses (Implementing Decision 2021/914) apply and are included by reference, Module Two where you are a controller and Module Three where you are a processor. Clause 7 (docking) doesn't apply. Under Clause 9, Option 2 (general authorization) applies with 10 days' notice. The optional wording in Clause 11 doesn't apply. Under Clauses 17 and 18, the law and courts of Ireland apply. The details in Annex I are in section 2, Annex II is section 4, and Annex III is the list of providers available on request.
- From the UK: the UK Information Commissioner's International Data Transfer Addendum applies alongside those clauses.
- From Switzerland: the same clauses apply, read with the Swiss Federal Act on Data Protection in place of the GDPR where required, with the Swiss Federal Data Protection and Information Commissioner as the supervisory authority.
- If LocalSpect is certified under the EU–US Data Privacy Framework, we may rely on that instead.
7. Security incidents
If we become aware of a breach affecting Customer Personal Data, we'll notify you without undue delay and no later than 72 hours after becoming aware of it. We'll give you the information you reasonably need as it becomes known, and promptly take reasonable steps to contain and investigate it. Notifying you isn't an admission of fault.
8. Requests and assistance
- If a person asks us directly to exercise their rights over Customer Personal Data, we'll pass the request to you and won't answer it ourselves unless you ask us to or the law requires it. The Service lets you find, correct, export and delete the data yourself, and we'll help where you can't.
- If an authority or court asks us for Customer Personal Data, we'll tell you first where the law allows, and only disclose what's legally required.
- Where the law requires, we'll reasonably help you with data protection impact assessments, transfer assessments and consultations with authorities.
9. Information and audits
We'll give you the information reasonably needed to show we comply with this DPA, including answers to reasonable security questionnaires, once a year or after a security incident. If that isn't enough to meet a legal requirement, you may audit our compliance, at your cost, with 30 days' written notice, during business hours, in a way that protects other customers' data and our confidential information.
10. Deletion
- While you use the Service, you can delete Customer Personal Data yourself at any time.
- When the terms end, we delete Customer Personal Data within 30 days, unless the law requires us to keep it. If you ask before then, we'll first give you a copy through the export features. Copies in backups are deleted as the backups roll over, and stay protected until then.
- If you ask, we'll confirm the deletion in writing.
11. Liability
Each side's liability under this DPA is subject to the limits in the terms. Those limits don't reduce anyone's liability to individuals for their data protection rights, or liability under the standard contractual clauses where the clauses forbid it.
12. Order of documents and term
- If documents conflict, this order applies: the standard contractual clauses or UK Addendum, then this DPA, then the terms.
- This DPA applies for as long as we process Customer Personal Data for you, including after the terms end.
13. Contact
LocalSpect, a Wyoming company. Email [email protected].
This DPA is based in part on the Common Paper Data Processing Agreement Standard Terms Version 1.1, free to use under CC BY 4.0.