Data Processing Agreement

1. Roles and law

The customer is the controller of the personal data it processes with PERSO, and PERSO is its processor. Where the customer itself acts as processor for its own client, PERSO is its subprocessor and this agreement applies in the same way.

For the account, billing and website data of the customer's own users, PERSO is an independent controller. The Privacy Policy governs that data, not this agreement.

Data protection law means the GDPR, the FADP, the UK GDPR where it applies, and the national laws that apply to the processing. Terms such as personal data, processing, data subject and personal data breach have the meaning the GDPR gives them.

2. Subject, nature, purpose and duration

PERSO processes personal data only to provide the PERSO service: preparing and carrying out the customer's outreach by email and LinkedIn, writing drafts with AI for the customer to approve, detecting replies, finding and checking business contact details, and watching for changes at companies the customer follows. Annex 1 describes the data and the people concerned.

This agreement runs as long as PERSO processes personal data for the customer, which is the term of the Terms of Service and the time needed afterwards to return or delete the data under section 12.

3. The customer's instructions

PERSO processes personal data only on the customer's documented instructions, including on transfers to third countries. The instructions are this agreement, the Terms of Service, and the settings and actions of the customer's users in PERSO. Further instructions are given in writing or by email.

If the law requires PERSO to process data otherwise, PERSO tells the customer before doing so, unless the law forbids it. PERSO tells the customer without delay if it believes an instruction infringes data protection law, and may pause that instruction until it is confirmed or changed.

4. The customer's obligations

The customer decides whom it contacts and why, and is responsible for doing so lawfully: it has a legal basis for each processing, informs the people it contacts as Art. 13 and 14 GDPR require (PERSO can add a link to the customer's notice under the first email, see section 8), honours objections and requests at once, and keeps its own record of processing activities.

The customer obtains the personal data it brings to PERSO lawfully, and does not bring special categories of personal data (Art. 9 GDPR) or data about criminal convictions. The customer is responsible for the terms of the platforms it connects, as the Terms of Service set out.

5. Confidentiality

Everyone at PERSO with access to personal data is bound to confidentiality, receives the instructions and training their work requires, and has access only as far as their work needs it.

6. Security

PERSO takes the technical and organisational measures that Art. 32 GDPR requires, taking into account the state of the art, the cost, and the nature, scope and purposes of the processing and its risks to people. Annex 2 lists them. PERSO may improve them over time, but never below the level described there.

7. Personal data breaches

PERSO notifies the customer without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting the customer's data. The notice describes, as far as known: the nature of the breach, the categories and approximate number of people and records concerned, the likely consequences, the measures taken or proposed, and a contact for further information. Information not yet available follows in phases, without further delay.

PERSO supports the customer in notifying the supervisory authority and the people concerned where the customer must. A notice is not an admission of fault.

8. Helping the customer

PERSO helps the customer answer the requests of data subjects (access, rectification, erasure, restriction, portability and objection) with tools in the product: every message and step per person can be read, a person can be erased completely by an admin, and an objection is kept on a suppression list that survives the erasure. A request that reaches PERSO directly is forwarded to the customer without undue delay and not answered by PERSO itself.

PERSO provides the customer with the information it needs for data protection impact assessments, consultations of supervisory authorities, and requests from authorities or the customer's data protection officer. A template impact assessment and a template privacy notice for prospects are available at getperso.com. For assistance that goes clearly beyond the product's own functions, PERSO may charge a reasonable fee, and says so before any work starts.

9. Subprocessors

The customer gives PERSO general authorisation to use the subprocessors in Annex 3. Some are used for every customer, others only when the customer switches the feature on. PERSO binds each subprocessor in writing to data protection obligations no less protective than this agreement, and remains fully liable to the customer for their performance.

PERSO announces any new or replaced subprocessor by email to the customer's admins and on this page at least 30 days before it is used. The customer may object within 20 days, giving its reasons. The parties then look for a solution in good faith; if PERSO cannot avoid the change, the customer may end the agreement with effect from the change, and prepaid fees for the time after it are refunded.

Services the customer connects itself, such as its own CRM, mailbox provider or LinkedIn, are not PERSO's subprocessors. They process data under the customer's own agreements with them.

10. Transfers outside Switzerland and the EU

Switzerland and the EU recognise each other as adequate, so data moves between them without further safeguards. PERSO transfers personal data to other countries only with a safeguard under Chapter V GDPR and Art. 16 FADP: an adequacy decision, the provider's certification under the EU US and Swiss US Data Privacy Frameworks, or the EU standard contractual clauses (Commission Decision 2021/914, module 3 where PERSO is processor) with the amendments the Swiss Federal Data Protection and Information Commissioner requires. PERSO provides its transfer assessment on request.

Should the recognition of Switzerland by the EU lapse, or where the customer is in a country that does not recognise Switzerland, the standard contractual clauses are incorporated into this agreement between the customer and PERSO: module 2 where the customer is controller, module 3 where it is processor; the docking clause (clause 7) applies; under clause 9, option 2 applies with the notice period of section 9; the optional wording in clause 11 does not apply; under clauses 17 and 18, the law and courts are those of the EU member state in which the customer is established; Annexes 1 to 3 of this agreement complete the clauses' annexes. For transfers under UK law, the UK International Data Transfer Addendum applies in the same way.

11. No use for PERSO's own purposes

PERSO does not use the customer's personal data for its own purposes. It does not sell it, share it with other customers, or use it to train AI models, and what PERSO learns from a customer's edits and replies stays in that customer's workspace.

Two things are not personal data and are used across customers: anonymous usage statistics, and the email format of a company's domain (for example first.last), which PERSO keeps once the addresses of at least five different people agree, without any name, address or reference to the customer it came from.

12. Retention and deletion

During the agreement the customer sets how long people who never replied are kept (36 months by default, measured from when they were added or their last reply), and PERSO deletes them automatically once a day when the period has passed. The customer can erase any person at any time.

When the agreement ends, the customer can export its data for 30 days. PERSO then deletes all personal data, including at its subprocessors, unless the law requires it to be kept. Backups are overwritten in their normal cycle, at the latest after 30 days. On request PERSO confirms the deletion in writing.

13. Information and audits

PERSO makes available the information needed to show that it meets this agreement, first in writing, for example by answering a security questionnaire. Where that is not enough, the customer may audit PERSO, itself or through an independent auditor bound to confidentiality who does not work for a competitor, once a year with 30 days notice, during business hours, at its own cost, and without access to other customers' data or to anything that would weaken PERSO's security. After a personal data breach, or when an authority requires it, an audit is possible at any time.

14. Liability

Each party is liable to data subjects as Art. 82 GDPR provides. Between the parties, the liability rules and limits of the Terms of Service apply, as far as data protection law allows. PERSO is not liable for claims that result from following the customer's instructions.

15. Final provisions

If a provision is invalid, the rest remains in force, and the invalid provision is replaced by the valid one closest to what the parties intended. In a conflict with the Terms of Service, this agreement prevails. The law and courts of the Terms of Service apply.

Annex 1. Description of the processing

People concerned: the customer's prospects and contacts at other companies, the customer's own customers where they are contacted, and the customer's users.

Data: name, job title, employer and previous employers, business email address and phone number, LinkedIn profile data, public LinkedIn posts and activity, location at city or country level, the content of emails, LinkedIn messages and replies, notes and records from the CRM the customer connects, and the customer's users' account and usage data. No special categories of personal data.

Sources: the customer, the CRM and mailbox the customer connects, LinkedIn through the customer's own account, public sources on the web, and the email finding providers in Annex 3.

Processing: collecting, storing, reading, comparing, writing drafts with AI, sending from the customer's accounts after approval or as the customer has set up, detecting replies, and deleting. Continuous, for the term of the agreement.

Supervisory authority: for the customer, the authority competent for it; for PERSO, the Swiss Federal Data Protection and Information Commissioner (FDPIC).

Annex 2. Technical and organisational measures

Where data lives: the application runs in Frankfurt, Germany and the database in Frankfurt, Germany. Data is encrypted in transit (TLS) and at rest by the database provider; credentials of connected accounts are additionally encrypted by PERSO with a separate key.

Separation: every customer's data carries its workspace, every query is limited to it, and automated tests check for leaks between workspaces on every change.

Access: users sign in with a password stored only as a hash, or with Google or Microsoft; repeated failed sign ins are limited; email addresses are confirmed; admins and members have different rights. PERSO staff access production data only where running or supporting the service requires it, through accounts protected by multi factor authentication.

Integrity and availability: point in time recovery at the database provider; separate test databases, so development never uses production data; every change to the code is versioned and tested before it is deployed; the scheduled work logs each run.

Minimisation and deletion: only what a draft needs is sent to the AI provider; messages are approved by a person unless the customer chooses otherwise; objections are kept on a suppression list; people are erased on request and automatically after the retention period.

Organisation: a documented process for handling personal data breaches, a record of processing activities, and a review of these measures at least once a year.

Annex 3. Subprocessors

The table in section 9 is Annex 3. The current version of this page is the current list.