Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Searchedly ("Processor", "we") and the Customer ("Controller", "you"). It applies when we process personal data in Customer Data on your behalf. You accept it when you accept the Terms; if you need a countersigned copy, email legal@searchedly.com.

1. Definitions

"Data Protection Laws" means all privacy laws that apply to the processing, including the EU GDPR, the UK GDPR and Data Protection Act 2018, the Swiss FADP, and US state privacy laws such as the California Consumer Privacy Act (CCPA). "Personal data", "processing", "controller", "processor", "data subject" and "supervisory authority" have the meanings in those laws. "Personal Data Breach" means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data we process for you.

2. Roles and instructions

• You are the controller (or a processor acting for your own controller); we are your processor (or subprocessor).
• We process personal data only on your documented instructions: these Terms, this DPA, and how you configure and use the service. We'll tell you if we believe an instruction breaks Data Protection Laws.
• The details of processing are in Annex 1.

3. Our people

Everyone at Searchedly who can access personal data is bound by confidentiality, receives security training, and has access only when their work needs it.

4. Security

We implement and maintain the technical and organizational measures in Annex 2, appropriate to the risk. We may update them as long as the overall level of protection doesn't decrease.

5. Subprocessors

• You authorize us to use the subprocessors listed on our Subprocessors page.
• We'll give at least 30 days' notice of a new subprocessor by email to organization Owners and on that page. You may object on reasonable data protection grounds within that period. We'll try to resolve the objection; if we can't, you may terminate the affected service and receive a prorated refund of prepaid fees.
• We impose data protection terms on each subprocessor that protect your data at least as well as this DPA, and we remain responsible for their performance.

6. Helping you

Taking into account the nature of the processing, we'll help you:

• respond to data subject requests (most can be handled in the product; we'll forward requests we receive directly to you and won't respond to them ourselves unless you ask);
• carry out data protection impact assessments and consult supervisory authorities;
• meet your security obligations.

7. Personal Data Breaches

We'll notify you without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting your data. We'll provide what we know about its nature, likely consequences, and the measures taken or proposed, and update you as we learn more. Notifying you isn't an admission of fault.

8. Deletion and return

You can export your data at any time while your account is active and for 30 days after it ends. We then delete personal data within 60 days, and it rolls out of encrypted backups within a further 35 days, unless the law requires us to keep it.

9. Audits

We'll make available the information needed to demonstrate compliance with this DPA, including our security documentation and third-party reports once available. If that isn't enough, you may audit us (or appoint an independent auditor bound by confidentiality) once a year, with 30 days' notice, during business hours, at your cost, in a way that doesn't compromise other customers' data or our security.

10. International transfers

Where personal data is transferred from the EEA, UK or Switzerland to a country without an adequacy decision, the parties agree to the European Commission's Standard Contractual Clauses (Decision 2021/914), Module 2 (controller to processor) or Module 3 (processor to processor) as applicable, which are incorporated by reference, with: optional clause 7 (docking) included; option 2 (general authorization) in clause 9 with the notice period in section 5; the optional language in clause 11 omitted; clauses 17 and 18 governed by Irish law and Irish courts; and Annexes completed with this DPA's Annexes. For UK transfers, the UK International Data Transfer Addendum applies; for Swiss transfers, the Clauses apply with references adapted to the Swiss FADP.

11. US state privacy laws

To the extent the CCPA or similar laws apply, we act as your service provider (or processor). We won't sell or share personal data; retain, use or disclose it outside our direct business relationship with you or for any purpose other than providing the service; or combine it with personal data from other sources except as those laws allow. We'll tell you if we can no longer meet these obligations.

12. General

Liability under this DPA is subject to the limits in the Terms, except where the law doesn't allow it. If this DPA conflicts with the Terms, this DPA wins for data protection matters; the Standard Contractual Clauses win over both.

Annex 1 — Details of processing

Annex 2 — Technical and organizational measures

• Encryption. All traffic uses TLS (HTTPS only, with HSTS). Stored secrets and connector credentials get an additional layer of AES-256-GCM encryption with keys separated per organization.
• Tenant isolation. Database row-level security keeps each organization's data separate, tested automatically on every change.
• Access control. Role-based permissions in the product; single sign-on and two-step verification through our identity provider; least-privilege staff access, reviewed regularly; every staff action recorded.
• Audit logging. A tamper-evident, append-only audit log of security-relevant actions for each organization.
• Secure development. Code review, automated tests, dependency, secret and static-analysis scanning on every change; protection against server-side request forgery for outbound requests.
• Availability. Managed hosting with automated backups, rate limiting, per-organization limits, monitoring and alerting.
• Data minimization. Personal data removed from error reports; documented retention periods enforced by automated deletion.
• Incident response. A documented incident response plan with defined roles and notification timelines.
• Vendors. Subprocessors reviewed for security before use and bound by data protection terms.

Annex 3 — Subprocessors

See Subprocessors.