Data Processing Agreement

This Data Processing Addendum (DPA) forms part of the Master Terms of Service Agreement available at the Terms of Service (Agreement), entered into by and between Clearout Inc., a fully owned subsidiary of Datacept Technologies Private Limited (“Sub-Processor”) and YourCompanyName (“Processor”), in accordance with the personal data processed using Clearout’s Services (including services provided via clearout.io and clearoutphone.io) as outlined in the applicable Agreement.

The main goal of this DPA is to demonstrate agreement between the two parties in terms of the processing of Personal Data in compliance with the requirements of Data Protection Legislation.

If the Processor signing this DPA is a party to the Agreement, this DPA forms part of the Agreement.

In the course of providing the Services to Processor pursuant to the Agreement, Sub-Processor may process Personal Data on behalf of Processor (who acts under the authority of Controllers), and the Parties agree to comply with the following provisions:

1. Definitions

Sub-Processor: Clearout, which processes data on behalf of YourCompanyName (Processor).

Processor: YourCompanyName, acting under the instructions of Controllers (its Clients).

Controller: YourCompanyName's Clients, who determine the purpose and means of processing.

Service or Services: All content, services, and products available at or through websites operated by the sub-processor, including but not limited to WebApp serving domains and associated APIs, covering services such as email verification, phone number validation, and prospect data processing using the Clearout App or API.

API: Automated application programming interface to connect Clearout's Services with other websites, servers, or applications.

Data Processing: Processing of data on behalf of the Processor.

Data Protection Law: EU Directive 95/46/EC, as transposed into domestic legislation of each Member State and as amended, replaced, or superseded from time to time, including (with effect from May 25, 2018) by the GDPR and laws implementing, replacing, or supplementing the GDPR; the California Consumer Privacy Act (CCPA, Cal. Civ. Code §1798.100 et seq. and 11 CCR §999.300) (CCPA) (as applicable); and the EU law (as defined in the European Union (Withdrawal) Act 2018), the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019, and any further UK laws addressing data transfers from the UK (collectively, UK GDPR).

GDPR: The General Data Protection Regulation (GDPR) (EU) 2016/679 is a regulation on data protection and privacy for all individuals within the European Union (EU) and the European Economic Area (EEA).

Data Subject: Means the identified or identifiable natural person to whom the Personal Data relates.

Personal Data: Means any data that relates to an identified or identifiable natural person (Data Subject).

Personal Data Breach: Means a security breach leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data transmitted, stored, or otherwise processed.

Standard Contractual Clauses: Means (a) in respect of transfers subject to the GDPR, the Standard Contractual Clauses, specifically between controllers and processors and between processors and processors as approved by the European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, including all Annexes I and II thereto (EU SCCs); (b) in respect of transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses of 21 March 2022, as set forth in Annex III of the Standard Contractual Clauses (UK Cross Border Transfers) (UK Addendum); or (c) in respect of transfers subject to the Federal Act on Data Protection (FADP - as revised as of 25 September 2020), the terms set forth in Annex IV of the Standard Contractual Clauses (Switzerland Cross Border Transfers) (Switzerland Addendum). All (a)–(c) are located at Standard Contractual Clauses (Controller to Processor) and Standard Contractual Clauses (Processor to Processor), respectively.

Sub-Sub-processor: Means any person (including any third party, but excluding Clearout employees) appointed by or on behalf of Clearout to process data in connection with the Agreement.

2. Data Processing

2.1. Data Subjects

Data Subjects include customers, employees, partners, and prospects of Controllers, whose data is processed by Clearout as a Sub-Processor via YourCompanyName.

2.2. Types of Information

In the course of using the Services, the Sub-Processor asks the Processor to provide certain personally identifiable information of the Processor that can be used to contact or identify the Processor and to administer the Processor's account (Personally Identifiable Information). Personal Information such as the Processor’s name and email address is used to create the account for the Site and Services, as well as for email newsletters and invoicing.

Processor's credit card information is used by third parties such as PayPal or Stripe to process the payment(s) of the Processor for the Services. Processor's consent will be required if the Personal Information of the Processor is being collected, used, and stored by the sub-processor in accordance with the Terms and Conditions of Use and the Privacy Policy of the Sub-Processor.

The Processor provides data, including email addresses and phone numbers, on behalf of the Controller to the Sub-processor in order to receive the Sub-processor Services (such as email verification via clearout.io and phone validation via clearoutphone.io). Such information constitutes Personal Data and is protected as any other category of Personal Data under this DPA.

2.3. Purpose of the Processing

The purpose of processing is to verify email deliverability and validity (via clearout.io), validate phone numbers and carrier details (via clearoutphone.io), and perform related lead data processing through automated systems. The subject matter of the contract includes email verification and phone validation services. In no event will the sub-processor process any Personal or Navigational Data for its own purpose or those of any third party and/or transfer the data provided by the Processor to any third party.

2.4. Duration of the Processing

Personal Data will be processed for the duration of the Agreement, subject to Section 4 of this DPA. Information uploaded to the Site or otherwise submitted to Sub-Processor in conjunction with the Services, including but not limited to CSV or XLSX files, may be stored for a period of thirty (30) days. If the Processor initiates payment for the services, the sub-processor may collect and store Personal Information, as well as any other information provided to us. This Personal Information may be shared with third parties in order to process the payment of the Processor. The sub-processor encrypts credit card numbers using industry-standard technology.

3. Obligations of Processor

3.1. Security

The sub-processor shall take the appropriate technical and organizational measures to adequately protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.

3.2. Confidentiality

The sub-processor shall ensure that any personnel whom the Sub-Processor authorizes to process Personal Data on the sub-processor's behalf are subject to confidentiality obligations with respect to that Personal Data. The confidentiality undertaking shall continue after the termination of the above-entitled activities. The sub-processor ensures that its personnel who access the processor's Personal Data are subject to confidentiality obligations that restrict their ability to disclose the processor's Personal Data.

3.3. Personal Data Breaches

The sub-processor is obliged to promptly notify the Processor about a Personal Data Breach without undue delay and in any event within 36 hours after becoming aware of a data breach.

3.4. Data Subject Requests

The sub-processor shall respond to any request from Data Subjects seeking to exercise their rights under the Data Protection Law with respect to Personal Data (including access, rectification, restriction, deletion, or portability of personal data) to the extent permitted by the law.

3.5. Sub-Sub-processors

Sub-Processor may hire other companies to provide limited services on its behalf (Annexure 1). Any such sub-sub-processors will be permitted to process Personal Data only to deliver the services that the Sub-Processor has retained them to provide, and they shall be prohibited from using Personal Data for any other purpose. The sub-processor remains responsible for ensuring that its sub-sub-processors comply with the obligations of this DPA. Any sub-sub-contractors to whom the sub-processor transfers Personal Data will have entered into written agreements with the sub-processor requiring that they abide by terms substantially similar to this DPA. If Processor requires prior notification of any updates to the list of sub-sub-processors, Processor may request such notification in writing by emailing us at [email protected]. Sub-Processor will update the list within seventy-two (72) hours of any such notification if the processor does not legitimately object within that time frame. Legitimate objections must contain reasonable and documented grounds relating to a sub-sub-contractor's non-compliance with applicable Data Protection Legislation. If, in the Sub-Processors' reasonable opinion, such objections are not legitimate, the Processor may, by providing written notice to the Sub-Processor, terminate the Agreement.

3.6. Data Transfers

The processor acknowledges and agrees that, in connection with the performance of the services under the Agreement, Personal Data may be stored in or transferred between various global regions, including outside of the European Union (EU), European Economic Area (EEA), United Kingdom (UK), and Switzerland. When transferring or processing data across borders, the Sub-Processor takes necessary technical and organizational measures to safeguard processing activities and ensure an appropriate level of protection for Data Subjects' fundamental rights. This Privacy Policy shall apply regardless of the geographic location from which Personal Information is transferred or accessed.

3.6.1. Transfers to countries with an adequate level of data protection

Personal Data may be transferred from the EEA, UK, Switzerland, or other jurisdictions to third countries that offer an adequate level of data protection under applicable Adequacy Decisions, without additional transfer safeguards being required.

3.6.2. Transfers to other countries

If the processing of Personal Data involves transfers to countries without an Adequacy Decision, processing will be governed by recognized statutory transfer mechanisms:

1. Transfers subject to the EU GDPR shall be governed by the applicable EU Standard Contractual Clauses (EU SCCs).
2. The UK International Data Transfer Addendum (UK Addendum) shall govern transfers subject to the UK GDPR.
3. Transfers subject to Swiss Data Protection Law (FADP) shall be governed by the Switzerland Addendum.

The terms in Annex V of the Standard Contractual Clauses (Additional Safeguards) apply to any transfer covered by the Standard Contractual Clauses.

3.7. Deletion or Retrieval of Personal Data

Upon termination or expiration of the Agreement or upon request, the Sub-Processor will delete or return to the Processor all individual- and account-related Personal Data that is in its possession or control (including any Data sub-sub-contracted to a third party for processing). This requirement will not apply to the extent that Sub-Processor is required by any EU (or any EU Member State) law to retain some or all of the Data, in which event Sub-Processor will isolate and protect the Data from any further processing except to the extent required by such law.

3.8. CCPA

Clearout is prohibited from retaining, using or disclosing Customers Personal Information: (a) For any purpose other than those as set out in the Agreement or as otherwise permitted under 11 CCR §999.314(c); (b) by way of Selling the Customers Personal Information and (c) by way of retaining, using, or disclosing the Customers Personal Information outside of the direct business relationship between the Parties, except as permitted under 11 CCR §999.314(c). Clearout certifies that it understands the restriction specified in the preceding subsection and will comply with it.

3.9. Shared Data Restrictions

For the avoidance of doubt, Clearout will not share and/or sell any information disclosed by the Customer or gathered on the Customer, unless expressly stated under this DPA.

4. Assistance to Processor

4.1 The Sub-Processor shall assist the Processor by appropriate technical and organizational measures (Annexure 2), in so far as this is possible, for the fulfillment of the Processor’s obligation to respond to a request for exercising the data subjects' rights under the GDPR.

4.2 The Sub-Processor shall assist the Processor in ensuring compliance with the obligations pursuant to security and prior consultations with supervisory authorities required under Article 36 of the GDPR, taking into account the nature of processing and the information available to the Sub-Processor.

4.3 The Sub-Processor shall make available all necessary information to the Processor to demonstrate compliance with the Sub-Processor's obligations and to allow for and contribute to audits, including inspections conducted by the Processor or another auditor mandated by the Processor.

5. Liability and Indemnity

The Sub-Processor indemnifies the Processor and holds the Processor harmless against all claims, actions, third-party claims, losses, damages, and expenses incurred by the Processor and arising directly or indirectly out of or in connection with a breach of this Data Processing Agreement and/or the Applicable Data Protection Law by the Sub-Processor. The Processor indemnifies the Sub-Processor and holds the Sub-Processor harmless against all claims, actions, third-party claims, losses, damages, and expenses incurred by the Sub-Processor and arising directly or indirectly out of or in connection with a breach of this Data Processing Agreement and/or the Applicable Data Law by the Processor.

6. Duration and Termination

6.1 This Data Processing Agreement shall come into effect on the date the Processor electronically signs this Data Processing Agreement.

6.2 Termination or expiration of this Data Processing Agreement shall not discharge the Sub-Processor from its confidentiality obligations pursuant to Article 3.

6.3 The Sub-Processor shall process Personal Data until the date of termination of the Service Agreement, unless instructed otherwise by the Processor, or until such data is returned or destroyed on the instruction of the Processor.

7. Data Center and Location

Clearout Services are available across multiple global regions, including North America, Europe, and Asia-Pacific. Data center selection and processing regions are configured based on account requirements to maintain performance and comply with applicable local data protection standards, including GDPR for European users.

8. Miscellaneous

For the avoidance of doubt and to the extent allowed by applicable law, any and all liability, including limitations thereof, will be governed by the relevant provisions of the Agreement.

If the processor does not agree to any changes to the Agreement, do not continue using the Clearout application.

List of GDPR-compliant Sub-Sub-Processors

As a data processor under the GDPR, Clearout uses the sub-sub-processors listed below. To meet its obligations under Art. 28 of the GDPR, the following disclosure relates to the name and processing actions of these sub-sub-processors.

Technical and Organizational Measures (TOMs): Security Services

This document describes technical and organizational security measures and controls implemented by Clearout, or Clearout affiliates (hereafter Clearout), to protect personal data and ensure the ongoing confidentiality, integrity, and availability of Clearout's products and services.

This document is a high-level overview of Clearout's technical and organizational security measures. More details on the measures we implement are available upon request. Clearout reserves the right to revise these technical and organizational measures at any time, without notice, provided that such revisions do not materially reduce or weaken the protection provided for personal data that Clearout processes in providing its various services. In the unlikely event that Clearout does materially reduce its security, Clearout shall notify its customers.

Clearout shall take the following technical and organizational security measures to protect personal data:

1. Organizational management and dedicated staff responsible for the development, implementation, and maintenance of Clearouts' information security program.
2. Audit and risk assessment procedures for the purposes of periodic review and assessment of risks to the Clearout organization, monitoring and maintaining compliance with Clearout policies and procedures, and reporting the condition of its information security and compliance to senior internal management.
3. Maintain Information security policies and make sure that policies and measures are regularly reviewed and, where necessary, improved.
4. Communication with Clearout applications utilizes cryptographic protocols such as TLS to protect information in transit over public networks. At the network edge, stateful firewalls, web application firewalls, and DDoS protection are used to filter attacks. Within the internal network, applications follow a multi-tiered model, which provides the ability to apply security controls between each layer.
5. Data security controls, which include logical segregation of data; restricted (e.g., role-based) access and monitoring, where applicable; and utilization of commercially available and industry-standard encryption technologies.
6. Logical access controls designed to manage electronic access to data and system functionality based on authority levels and job functions (e.g., granting access on a need-to-know and least privilege basis, using unique IDs and passwords for all users, periodic review, and revoking/changing access promptly when employment terminates or changes in job functions occur).
7. Password controls are designed to manage password strength and usage, including prohibiting users from sharing their passwords.
8. System audit or event logging and related monitoring procedures to proactively record user access and system activity for routine review.
9. Physical and environmental security of data center, server room facilities, and other areas containing client confidential information designed to (i) protect information assets from unauthorized physical access, (ii) manage, monitor, and log movement of persons into and out of Clearout facilities, and (iii) guard against environmental hazards such as heat, fire, and water damage.
10. Operational procedures and controls to provide for configuration, monitoring, and maintenance of technology and information systems according to prescribed internal and adopted industry standards, including secure disposal of systems and media to render all information or data contained therein as undecipherable or unrecoverable prior to final disposal or release from Clearout possession.
11. Change management procedures and tracking mechanisms designed to test, approve, and monitor all changes to Clearout technology and information assets.
12. Incident/problem management procedures designed to allow Clearout to investigate, respond to, mitigate, and notify of events related to Clearout technology and information assets.
13. Network security controls that provide for the use of enterprise firewalls and layered DMZ architectures, and intrusion detection systems and other traffic and event correlation procedures designed to protect systems from intrusion and limit the scope of any successful attack.
14. Vulnerability assessment, patch management, and threat protection technologies, along with scheduled monitoring procedures, are designed to identify, assess, mitigate, and protect against identified security threats, viruses, and other malicious code.
15. Business resiliency/continuity and disaster recovery procedures, as appropriate, are designed to maintain service and/or facilitate recovery from foreseeable emergency situations or disasters.
16. Formal Vendor Management program, including vendor security reviews for critical vendors to ensure compliance with Clearout Information Security Policies.
17. A Data Protection Officer (DPO) who is independent regularly reviews data protection risks and controls.

For a signed copy, please write to us at [email protected]