Data Processing Agreement

What this covers

This agreement applies between Personade and you, the customer. You are the controller of the personal data in your workspace: the people on your lists and in your campaigns, the conversations they have with you, the LinkedIn account you connect, and, if you buy personalised video, the person who records. We are your processor.

It forms part of our Terms of Service and applies automatically from the moment you create a workspace. There is nothing for you to sign. If your legal or privacy team needs a copy, this page is it, and you are welcome to send them the link.

It does not cover the data we hold about you as our customer, such as your name, login and invoices. For that we are the controller and our privacy policy applies.

Words we use

• Personal data means information about a living person.
• Processing means anything done with it, including collecting, storing, sending and deleting.
• Controller means whoever decides why and how data is used. For the data in your workspace, that is you.
• Processor means whoever does the work on the controller's instructions. That is us.
• Subprocessor means a company we use to help us do it.
• Data protection law means the UK GDPR, the EU GDPR, and any other privacy law that applies to you or to us.

Who is responsible for what

You are the controller. You decide who goes on a list, what a sequence says, and when it runs. You are responsible for having a lawful basis to contact each person, for honouring their objections, and for the messages you send. Every message goes out from your own LinkedIn account and you are its sender. We cannot do any of that for you.

We are the processor. We use the data in your workspace only to run your campaigns, find and enrich your leads, sync your campaign conversations, and make the videos you order. We do not use it to train models, to build a product or a database of our own, to market to anyone, or for any purpose of our own. We do not sell personal data and we never will.

If we ever have to process your data for our own reasons, for example to comply with a law, we become a controller for that narrow purpose and we will tell you.

Your instructions

Connecting a LinkedIn account, importing a list, building a sequence, setting your limits and working hours, launching a campaign, writing a reply in the inbox, and, for video, sending us your recording and approving samples, are your instructions to us. Annex 1 records what those instructions cover. Anything outside it needs a written instruction from you, and we may decline it.

If we believe an instruction breaks data protection law, we will tell you, and we may pause rather than carry it out.

What we will not do

We will not use your lists or your conversations for anything except your workspace: not to train models, not to build our own database, not to contact anyone on them ourselves, and never to sell.

We will not read or store any part of your LinkedIn inbox beyond the conversations your campaigns started. We will not post, comment, or change anything on your profile. We will not raise your limits above the ceilings the product enforces, whoever asks.

For video, we will not use a voice model for anyone else's videos, we will only ever build one from a recording made with the speaker's written consent, and we delete it on request.

Confidentiality

Only the people who need access in order to run the service have it, and each of them is authenticated individually. Everyone with access is under a duty of confidence that continues after they leave.

We do not disclose your data to anyone else except as set out in Annex 3, or where the law requires it. Where the law requires it we will tell you, unless we are forbidden from doing so.

Security

We keep appropriate technical and organisational measures in place, listed in Annex 2. Security changes over time, so we may improve those measures, but we will not reduce the overall level of protection.

Subprocessors

You agree that we may use the subprocessors described in Annex 3. Each one is under a written contract with data protection terms at least as strict as these. If a subprocessor fails, that is our responsibility to you, not theirs.

If we want to add or replace one, we will update Annex 3 and tell customers at least 30 days beforehand. If you reasonably object on data protection grounds within those 30 days, we will try to find a way around it. If we cannot, you may cancel the affected part of the service and we will refund the unused portion of what you have paid.

When someone asks about their data

A person you contacted may ask to see their data, correct it, delete it, or object to it being used. Those requests belong to you, because you are the controller. The product gives you a do-not-contact list, a stop on reply, and per-lead deletion so you can act on them.

If one reaches us by mistake we will not answer it on your behalf. We will pass it to you without undue delay and help you answer it.

If someone asks us directly to take down a video page made about them, we will tell you, and we will take it down.

If something goes wrong

If we discover a personal data breach affecting your data, including any unauthorised use of a stored LinkedIn session, we will tell you without undue delay and in any case within 48 hours of becoming aware of it.

We will tell you what happened, which categories of data and roughly how many people are affected, the likely consequences, and what we are doing about it. If we do not have all of that at first, we will send what we have and follow up.

We will not notify your regulator or the affected people on your behalf. That decision is yours, and your own reporting deadline runs from when we tell you.

Deletion

LinkedIn session. Deleted when you disconnect the account, seven days after your subscription ends, or three days after a trial that was never paid for. The password and any verification code are deleted no later than thirty minutes after you enter them.

Everything else. Your lists, campaigns, conversations, recordings, videos and voice models are deleted when you delete your workspace from the app, and removed from backups as they roll over, within 30 days after that. You can delete individual leads and their conversations at any time. If you cancel but keep your account, the data stays so that resubscribing brings it back; ask us and we delete it sooner.

On request. If you ask us to delete some or all of it, or to send it back to you first, we will do that within 30 days of the request. A copy of your workspace data can be downloaded from the app at any time. We keep only what a law requires us to keep, and only for as long as that law requires.

Records and audits

We keep records of what we process for you and will make them available on request.

If your regulator requires an audit, or you have a genuine reason to believe these terms are not being met, we will cooperate with a reasonable audit. Once a year unless the law or an incident requires more, at reasonable notice, during working hours, and without disrupting other customers. Each side covers its own costs.

Sending data outside the UK and EU

Our application servers and database are in the United Kingdom. Some of our subprocessors are outside the UK and the EEA, including in the United States. Annex 3 says which categories that applies to.

Where we transfer your data out of the UK or the EEA, we rely on the European Commission's Standard Contractual Clauses and, for UK data, the UK International Data Transfer Addendum, or on the recipient's certification under an adequacy decision. Those clauses are incorporated into this agreement, with Personade acting as data exporter or importer as the case requires, and this agreement supplying the details their annexes call for.

Liability

Each side's liability under this agreement is subject to the limits in our Terms of Service.

How long this lasts

This agreement applies for as long as we process personal data for you. The obligations that should outlive it do, including confidentiality and deletion.

If documents disagree

If this agreement and our Terms of Service conflict on anything about personal data, this agreement wins.

Annex 1. What we process

Why: to run your outreach campaigns from your LinkedIn account, to find and enrich the people you want to reach, to show you the conversations that result, and, where ordered, to produce and deliver a personalised video for each person on a list. All on your instruction.

Whose data: the people on your lists and in your campaigns; the owner of each LinkedIn account you connect; and, for video, the person who records.

About the people you reach:

• What you import: name, headline, position, company, location, LinkedIn profile URL, photo, and any CSV columns or fields you add.
• Their public LinkedIn profile, read from your account when a step opens it: about, experience, education, skills, follower and connection counts, and recent posts where a step interacts with one. Their company's LinkedIn page, read once per company.
• Contact details LinkedIn shows you once connected: email, phone, websites and other fields in their contact info section.
• Email addresses found or guessed through Find email, stored separately and labelled as such.
• Conversations your campaigns started: messages in both directions, timestamps and attachments. Nothing from the rest of your inbox.
• Campaign history: step reached, invited, accepted and replied dates, tags, your notes, and do-not-contact status.
• Where you use Suggested leads: up to 25 public profiles returned by a lead-search vendor for the buyer profile you approved.

About the LinkedIn account you connect: its email address; its password and any verification code, for at most thirty minutes; the signed-in session cookies, encrypted; the login for the fixed residential address assigned to it, encrypted; the screen, language, operating system and time zone of the computer you connected from; and the account's name, headline and photo.

For personalised video: the recording made by the person on camera; the voice model built from it with their written consent, and the consent record (time, wording, and where available IP address); the per-person script and the rendered video and page; and watch analytics for each page (opened, played, how far, button clicked). No viewer IP address, browser or location is stored.

What we do not handle: your email inbox, your CRM, and the parts of your LinkedIn inbox that have nothing to do with your campaigns. We do not send email on your behalf.

Special category data: none is required, and your lists should not contain any. Contact info read from LinkedIn can include a birthday if the person published one; we store what LinkedIn shows and you should not use it. The voice model is the speaker's personal data, created with their consent, used only for your videos, and never used to identify anyone.

How long: for the life of your workspace, then as set out above under Deletion.

Annex 2. Security measures

• Encryption in transit using TLS on every connection.
• Encryption at rest for the database and for stored files and video.
• LinkedIn session cookies, proxy logins and every third-party token are additionally encrypted with AES-256-GCM under a key held only on our servers, and are never included in anything sent to a browser.
• LinkedIn passwords and verification codes are held only for the sign in and are erased no later than thirty minutes after entry.
• Each connected LinkedIn account runs through one fixed residential address, always the same one, that no other Personade account uses at the same time, in a browser session that is isolated per account.
• Only conversations with campaign leads are written to storage; other inbox content is discarded in memory.
• Access to production data is limited to the people who need it, and is authenticated individually.
• Rendered videos are served from unguessable URLs, excluded from search engines, and are deleted with the rest of your data.
• Changes to production are reviewed before release.
• Backups are encrypted and are covered by the deletion terms above.
• Everyone working on Personade is under written confidentiality obligations.

We do not currently hold SOC 2 or ISO 27001 certification. We would rather say so plainly than imply otherwise, and we will update this page if that changes.

Annex 3. Subprocessors

We use a small number of subprocessors to run the service, covering:

• application hosting (United Kingdom)
• the servers that run the LinkedIn browser sessions (United Kingdom)
• database (United Kingdom)
• file, attachment and video storage
• residential proxy addresses, through which your LinkedIn account's traffic passes; the provider sees the traffic, not your stored data
• a lead-search vendor, which receives the buyer profile you approve and returns public LinkedIn profiles; it never receives your lists or conversations
• an AI model provider, which receives your company's homepage text to draft your buyer profile and, for video, a lead's first name, company and role to write and check the spoken line
• voice model creation and speech synthesis, which receive the recording and the words each video speaks; and video rendering, which receives the footage and the finished video (video engagements only)
• transactional email, which receives your own email address for alerts and digests and never anything about your leads
• billing, which receives nothing about your leads
• product analytics, which receives events about how you use the app and never the content of a lead, a message or a video

Some of these are in the United States. No subprocessor receives more about a person on your list than is listed in Annex 1, and the vendors that handle speech and rendering receive only the fields the script speaks.

The current named list, including each one's role and location, is available on request. Email privacy@personade.com and we will send it. We provide it to customers and to their data protection advisers, and we ask that it is not published.

Each subprocessor is under a written contract with data protection terms at least as strict as these. If we add or replace one, we will tell customers at least 30 days beforehand, and you have the right to object as set out above.