This Data Processing Addendum ("DPA") forms part of the Terms of Service between the customer ("Customer", the controller or business) and TJR Universe LLC, doing business as FollowArc ("FollowArc", the processor or service provider), and applies whenever FollowArc processes personal data on the Customer's behalf under the Terms. If the Customer needs a signed copy, email privacy@agentsophia.com.

1. Scope and roles

The Customer is the controller of the personal data it uploads, imports or collects through the service (such as contact records of prospects and replies to its campaigns), and FollowArc is its processor. For account and billing data about the Customer's own users, FollowArcacts as an independent controller under the Privacy Policy. This DPA covers the data protection laws that apply, including the EU and UK GDPR and the California Consumer Privacy Act as amended ("CCPA").

2. Details of processing

Subject matter and purpose: providing the outreach, inbox, enrichment, analytics and related features of the service.
Duration: the term of the Terms, plus the period needed to return or delete data under section 8.
Data subjects: the Customer's prospects, contacts and leads, people who reply to its messages, and the Customer's own users.
Types of data: names, job titles, companies, business email addresses, phone numbers, public profile links and identifiers, message content and engagement records.
Special categories: none are intended. The Customer must not use the service to process special category data.

3. Our commitments

We process personal data only on the Customer's documented instructions, which are the Terms, this DPA and the Customer's use of the service. We tell the Customer if we believe an instruction breaks the law.
We ensure that people authorized to process the data are bound by confidentiality.
We do not sell or share the personal data, and we do not retain, use or disclose it outside the direct business relationship or for any purpose other than providing the service, except as the law requires. We do not combine it with data from other sources except as the service requires.
We apply the technical and organizational measures described in section 5.

4. Sub-processors

The Customer gives general authorization for FollowArc to use sub-processors. The categories are listed on our Sub-processors page. We bind each one by written terms that provide at least the protection in this DPA and remain responsible for their performance. We give advance notice of a new or replacement sub-processor, and the Customer may object on reasonable data protection grounds within 14 days of notice. If we cannot resolve the objection, the Customer may stop using the affected part of the service and receive a pro rata refund of prepaid fees for it.

5. Security

We maintain the safeguards described on our Security page, including encryption in transit, encryption of stored credentials, workspace-level access control, authenticated access, optional two-factor sign in and audit records of administrative actions. We may update these measures if the update does not reduce the overall level of protection.

6. Data subject requests and assistance

Taking into account the nature of the processing, we help the Customer respond to requests from people exercising their rights of access, correction, deletion, restriction, portability and objection. The service includes self-service export and deletion tools. If we receive a request directly about the Customer's data, we pass it to the Customer without undue delay and do not respond except as the Customer instructs or the law requires. We also provide reasonable help with data protection impact assessments and prior consultations.

7. Personal data breaches

We notify the Customer without undue delay, and within 72 hours, after we become aware of a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to the Customer's personal data. The notice describes what happened, what data is affected, what we are doing and what the Customer may need to do, and we update it as we learn more.

8. Return and deletion

When the Customer's account ends, or on request, we delete the Customer's personal data or return it in a common format within 30 days, unless the law requires us to keep it. Backups and logs are deleted in the ordinary course. The Customer may export its data at any time before deletion.

9. Audit and information

On request we provide the information needed to show compliance with this DPA, including a completed security questionnaire. If that does not satisfy a legal requirement, the Customer may carry out an audit once in any twelve months, on at least 30 days' notice, during business hours, under confidentiality and without unreasonable disruption, at the Customer's cost.

10. International transfers

Customer data is stored in the United States. Where personal data from the EEA, the UK or Switzerland is transferred to FollowArc or its sub-processors in a country without an adequacy decision, the parties rely on the European Commission's standard contractual clauses (module two, controller to processor) and the UK addendum, which are incorporated by reference and completed by this DPA and the Terms.

11. Liability and order of precedence

Each party's liability under this DPA is subject to the limits in the Terms. If this DPA conflicts with the Terms on the processing of personal data, this DPA applies.

Contact

TJR Universe LLC, 12922 Bur Oak Lane North, Champlin, MN 55316, USA. Data protection questions: privacy@agentsophia.com.