Data processing agreement

This Data Processing Agreement ("DPA") forms part of the terms of service between Mr PNA Greenall, trading as MagpieCRM, of 35a Highbury Corner, London N5 1RA ("MagpieCRM", "we"), and the customer named in the account ("Customer", "you") for MagpieCRM Cloud (the "Service").

1. Roles

1.1 For personal data you put into, or obtain through, the Service ("Customer Personal Data"), you are the controller and we are your processor.

1.2 This includes people you find with prospect search. Whether and how you contact them, and your lawful basis for it, are your decisions as controller. The Service helps you meet your obligations (see Annex 2), but doesn't make those decisions for you.

1.3 For data about you as our customer (account holders, billing), we are a controller under our own privacy notice; this DPA doesn't cover that.

2. Instructions

2.1 We process Customer Personal Data only on your documented instructions: this agreement, your use and configuration of the Service, and any other instructions you give in writing that we agree are consistent with it.

2.2 We tell you if we believe an instruction breaks data protection law, unless the law forbids us to.

2.3 We don't sell Customer Personal Data or use it for our own purposes, other than as described in 2.4. Search results are not stored or shared between customers. There are two exceptions. One is the list of people who have opted out, kept as keyed hashes, so that someone who objects is respected in every customer's workspace. The other is our shared database of business contacts: unless you switch contributing off, a copy of each contact you save from prospect search with a verified work email address is passed to us under the Contributor Terms. We hold that copy as an independent controller, so this DPA doesn't cover it.

2.4 To run the Service, we keep and share between customers' workspaces two kinds of company-level information. The first is whether a company's mail server accepts every address, found by checking made-up addresses, never real ones. The second is a company's email format (such as first.last). Your workspace works out a company's format from addresses you already hold there and from how earlier emails to them fared (clicks and bounces), and may send us that format with a count of the addresses that follow it, never names or addresses. We only share a format with other customers for companies of 10 or more people, and once it's backed by at least three addresses from at least two customers, so that it can't be linked to any one person. We are responsible for this as a controller, under our privacy policy. You can have your workspace left out of it by emailing pele@magpiecrm.com.

3. Confidentiality

Everyone we authorise to process Customer Personal Data is bound by confidentiality.

4. Security

We keep the technical and organisational measures in Annex 2, and may improve them, but won't reduce the overall level of protection.

5. Personal data breaches

We tell you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data, with the information you need to meet your own notification duties, and help you respond.

6. Sub-processors

6.1 You authorise the sub-processors on our sub-processor list.

6.2 We tell you about any new or replacement sub-processor at least 30 days before it starts processing Customer Personal Data. If you object on reasonable data protection grounds, we'll discuss it in good faith; if we can't resolve it, you may end the affected part of the Service and get a refund of any prepaid fees for the rest of the period.

6.3 We put data protection terms on each sub-processor that are no less protective than this DPA, and we remain responsible to you for them.

7. International transfers

We only transfer Customer Personal Data outside the UK and EEA with a valid safeguard (an adequacy decision, the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses), as shown on the sub-processor list.

8. Helping you

8.1 Data subject requests. The Service lets you find, export, correct and delete contacts, stops unsubscribed contacts receiving campaigns, and keeps a suppression list so people who opt out aren't found or saved again through prospect search. We pass on any request we receive directly, and help with requests you can't handle yourself. Contact us at pele@magpiecrm.com.

8.2 Assessments. We give reasonable help with data protection impact assessments and consultations with a supervisory authority, as far as they concern the Service.

9. Deletion and return

9.1 You can export your data at any time during the subscription.

9.2 When the Service ends, we delete Customer Personal Data from the live Service within 30 days, unless the law requires us to keep it. Our hosting provider's daily backups are overwritten as they go, so any copy in them is gone within 10 days after that.

10. Audits

We make available the information needed to show we meet this DPA, and allow and contribute to audits by you or an auditor you appoint, with reasonable notice, at most once a year unless there's been a breach or a regulator requires it, and subject to confidentiality.

11. Liability and precedence

Each party's liability under this DPA is subject to the limits in the main agreement. If this DPA and the main agreement conflict about personal data, this DPA wins.

Annex 1: Details of processing

Annex 2: Security measures

• Separation: each customer runs their own copy of the app in its own container, with its own data folder and its own encryption keys; no customer's data is stored with another's. The one exception is inbox warmup: every warming sender is held in a single account of ours at the warmup pool, and we keep customers apart there: each customer's senders are only acted on and reported for that customer, under an identifier that doesn't name them. The pool is made up of the warmup provider's other customers' mailboxes and its own, so a customer's senders may exchange warmup with another of our customers' senders.
• Inbox warmup: off unless the Customer switches it on for a sender and agrees to its terms. The sender's inbox login passes through our servers to the warmup pool and isn't kept by us; the pool's login to our mail server can only send as that sender, and only so much a day. A sender's warmup stops when the Customer stops it or disconnects its inbox, while their workspace is suspended or its sending is paused, and when its warmup bounces or draws complaints.
• Encryption: HTTPS for all traffic; saved credentials encrypted at rest (AES-256-GCM).
• Access: customers sign in through our identity provider, with multi-factor authentication available, and enter their workspace with a one-time link; workspace sessions use HttpOnly cookies and end on the server at sign-out. Our own server access is by SSH key only, and our admin area sits behind a separate identity-checking gateway.
• Sending: email goes out only from domains the Customer has verified with DKIM and shown they own. Bounces mark the contact as bounced and spam complaints unsubscribe them automatically.
• Abuse monitoring: we watch each customer's sending volume, bounce and complaint rates, as counts only, never the content of their email, and pause sending that puts other customers' delivery at risk.
• Minimisation: prospect search results aren't stored; only the fields needed (name, job title, seniority, company, domain, country, profile URL) are kept when the Customer saves a contact. Profile lookups are held in memory for at most 24 hours. Logs record counts and outcomes, not names or email addresses.
• Opt-outs: unsubscribed contacts don't receive campaigns, and a suppression list, kept as keyed hashes, stops people who opted out being shown, revealed or saved from prospect search again. Every reveal and save is recorded in a disclosure log (as hashes) so the Customer can show where a contact came from.
• Verification: only addresses that are likely to exist are checked, under rate limits per mail provider and per company; no email is sent to the person during verification. Where a company's mail server accepts every address, nothing there can be verified: an address worked out from the company's established format is handed over only if the Customer turns that on, is marked as unconfirmed, and campaigns send such addresses in a first batch and hold back the rest if more than 2% of that batch bounces.
• Resilience: daily backups by our hosting provider, kept off the server for 10 days; monitoring and alerts for the verification servers.
• Suppliers: sub-processors are chosen for their security and bound by written data protection terms.