Data Processing Addendum
Draft: some company details are still being finalised and this document is awaiting legal review.
This addendum is part of the Terms of Service and applies whenever Varilead processes personal data in your lead lists for you. In it, “you” are the customer and “we” are [Company legal name]. It applies automatically; there's nothing to sign.
1. Roles
For personal data in your lead lists (“customer personal data”), you decide why and how it's used and we process it on your behalf. Under US state privacy laws, we act as your service provider or processor.
2. What we process
- People: owners, staff and other contacts at the businesses in your lead lists.
- Data: names, business email addresses, phone numbers, business addresses, website findings and screenshots, and your notes and drafts about them.
- Purpose: providing Varilead to you: finding and checking websites, finding contact details, drafting outreach and tracking it.
- Duration: while you use Varilead, then as described in section 8.
3. Our commitments
- We process customer personal data only to provide Varilead to you and as the law requires.
- We don't sell or share it, don't use it for any purpose outside our contract with you, and don't combine it with data from other customers or sources, except as the law allows a service provider to.
- We make sure people who can access it are bound to keep it confidential.
- We'll tell you if we believe an instruction from you breaks the law, or if we can no longer meet these terms.
4. Security
We protect customer personal data with measures suited to the risk, including encryption in transit, keeping each customer's data separate and accessible only to their account, hashed passwords, encrypted secrets, least-privilege access to production systems, logging, and backups.
5. Subprocessors
You authorise us to use the subprocessors listed on the Subprocessors page, each under written terms that protect the data at least as well as this addendum. We'll update that page at least 14 days before adding or replacing a subprocessor. If you object on reasonable data protection grounds, tell us at privacy@varilead.com; if we can't resolve it, you may close your account. We remain responsible for our subprocessors.
6. Helping with requests
You can export, correct and delete customer personal data yourself in Varilead. If a person contacts us directly about data in your lead lists, we'll handle it as described in our Privacy Policy, which includes removing an email address from all accounts when its owner confirms the request.
7. Security incidents
If we become aware of a breach affecting customer personal data, we'll notify you without undue delay, and within 72 hours where we can, with the information you need to meet your own obligations.
8. Deletion
When you delete leads or your account, we delete the related customer personal data from live systems promptly, and from backups within 30 days. Leads with no activity for 24 months are deleted automatically.
9. Information and audits
On reasonable request, no more than once a year, we'll give you the information you need to show compliance with this addendum.
10. Order of precedence
If this addendum and the Terms of Service conflict about customer personal data, this addendum applies. The Terms' limits of liability apply to this addendum.