Data Processing Agreement

1. Parties and scope

This Data Processing Agreement supplements the Privly Terms of Service between MASTERPIECE Technologies Inc. (Privly) and the customer identified in the workspace account. It covers personal data Privly processes on the customer’s behalf to provide the service (Customer Data).

The customer acts as controller, or as a processor authorized by its controller; Privly acts as processor or subprocessor for that Customer Data. Each party must comply with the data protection laws applicable to its role. For account administration, billing, security, and Privly’s own customer communications, the Privacy Policy describes Privly’s separate responsibilities.

2. Processing details

• Purpose and operations: store, organize, qualify, retrieve, and delete workspace data; find and verify professional email addresses on request; export selected contacts and perform related CRM record matching and company linking; prepare messages; and perform the discovery, integrations, and outreach actions the customer configures or approves.
• People concerned: workspace members, customers, prospects, professional contacts, and individuals appearing in the customer’s selected source evidence.
• Data types: names, professional profiles and LinkedIn URLs, job titles, company names, business contact details including enriched work-email addresses and verification timestamps, source evidence, messages, replies, notes, campaign records, CRM account and record identifiers, connection credentials, export outcomes, and related usage records.
• Duration: while providing the customer’s service and completing the return or deletion obligations below. Processing occurs as users and configured workflows use the service.
• The service is not intended for sensitive personal data or children’s data. The customer must not instruct Privly to process these without a separate written agreement.

3. Instructions and customer responsibilities

Privly will process Customer Data only on documented instructions, including the customer’s workspace settings and approved actions, unless legally required otherwise. Privly will notify the customer of that legal requirement unless prohibited, and immediately inform the customer if an instruction appears to violate applicable data protection law.

The customer is responsible for lawful collection, required notices and permissions, accurate instructions, and responding to individuals. Privly will not use Customer Data for its own advertising or sell it.

A user-requested email lookup or CRM export is a processing instruction, not evidence that the affected individual consented to marketing. The customer is responsible for the lawful basis for enrichment and export, authority to use the destination CRM, and compliance with applicable outreach and recipient-choice requirements.

4. Confidentiality and security

Privly will restrict access to authorized people bound by confidentiality and maintain measures appropriate to the processing risk. These include encrypted transport, protected credentials, workspace access controls, and operational logging, as described in the Security Overview.

5. Service providers

The customer gives general written authorization for subprocessors needed for hosting, integrations, discovery, work-email enrichment, AI, and communications. Privly will provide their identities, functions, and processing locations on request, give advance notice of additions or replacements, and allow reasonable objections on data protection grounds before the change affects Customer Data.

Privly will impose equivalent applicable processing obligations on these providers and remain responsible to the customer for their performance. If an objection cannot be resolved, the parties will agree an alternative or end the affected processing.

Findymail performs the requested work-email lookup using the supplied professional profile URL. HubSpot is a customer-connected destination that receives selected contact data and returns information needed for matching, company linking, and export results. The customer’s separate agreement with HubSpot governs processing in that CRM; this agreement continues to govern Privly’s handling of Customer Data during the export.

6. Requests, incidents, and assistance

Taking account of the processing and available information, Privly will assist the customer with individual rights requests, security obligations, breach notifications, impact assessments, and regulatory consultation. Privly will notify the customer without undue delay after becoming aware of a Customer Data breach and provide available information and updates to support the response.

7. International processing

Customer Data may be processed where Privly and its authorized providers operate. Before a restricted international transfer, the parties must establish a valid transfer mechanism and any required supplementary protections. This agreement does not itself execute standard contractual clauses or guarantee a particular hosting region.

8. Return, deletion, and review

At the end of the service, Privly will return or delete Customer Data at the customer’s choice and delete remaining copies unless retention is legally required. Any retained data remains protected and limited to that purpose. The customer can request assistance through [email protected].

Return and deletion instructions can include enriched emails, lookup records, CRM credentials, and export records held by Privly. Disconnecting a CRM is not a deletion request for previously exported contacts. The customer must manage copies in its destination CRM and other systems, with Privly’s assistance where required by this agreement or applicable law.

Privly will make information needed to demonstrate compliance available and allow and contribute to customer or appointed-auditor audits, including inspections, with safeguards for security and other customers’ data.

9. Relationship to other terms

This agreement takes precedence over conflicting Terms of Service for processing Customer Data. Neither agreement limits individuals’ statutory rights or either party’s responsibilities under applicable data protection law. Send processing questions or instructions to [email protected].