Data Processing Agreement

This Data Processing Agreement (the DPA) is part of our Terms and Conditions (the Terms). It is an agreement between you, the customer, and Alion, a company registered in Saint Lucia. Words that are defined in the Terms, such as Services, Customer Data, Authorized Users and End Users, have the same meaning here.

Personal data means any information about a person who can be identified, directly or indirectly. Processing means anything done with personal data, such as receiving, storing, sending or deleting it.

Data protection law uses two roles, and this DPA follows them:

• You are the controller. The controller is the business that decides why and how personal data is processed.
• We are the processor. The processor handles personal data on behalf of the controller and only as the controller instructs.

This DPA applies to all personal data contained in Customer Data that we process for you when we provide the Services. It does not cover personal data that we handle for our own purposes, such as your account and billing details. Our Privacy Policy covers that data.

The table below describes the processing we carry out for you.

We process personal data only on your documented instructions. Your instructions are the Terms, this DPA and the way you configure the platform, for example the routing rules, destinations and integrations you set up.

If we believe that an instruction breaks data protection law, we will tell you. We may then pause the processing affected by that instruction until you confirm or change it.

We may also process personal data where a law that applies to us requires it. In that case we will tell you first, unless that law does not allow us to do so.

As the controller, you are responsible for the personal data you send through the Services. In particular, you must:

• have a lawful basis for processing the personal data of every End User, and give them the notices and collect the consents that the law requires;
• give us only instructions that comply with data protection law;
• make sure the personal data you send us is accurate and up to date, and correct it when needed.

A lawful basis is the legal reason that allows a business to process personal data, for example consent or the performance of a contract.

Everyone we allow to access personal data on your behalf, including our staff and contractors, is bound by a duty of confidentiality. This duty comes from a contract or from the law, and it continues after their work with us ends.

We give access only to people who need it to provide, secure or support the Services.

We use appropriate technical and organisational measures to protect personal data against accidental or unlawful loss, change, disclosure or access. We choose these measures based on the state of the art, the cost, the nature of the processing and the risks to the people involved.

Annex: technical and organisational measures. These are the measures we apply as a minimum. We may improve them over time, but we will not reduce the overall level of protection.

We host the platform with established cloud infrastructure providers.

A subprocessor is another company that we engage to process personal data on your behalf, for example a hosting provider. You give us general authorisation to use subprocessors.

A current list of our subprocessors is available on request at [email protected].

For subprocessors, we agree that:

• we give you at least 30 days' notice before we add or replace a subprocessor;
• you may object to a new subprocessor on reasonable data protection grounds within that notice period, and we will then discuss the concern with you in good faith;
• we bind every subprocessor by written contract to data protection obligations equivalent to those in this DPA;
• we remain responsible to you for the work of our subprocessors.

A data subject is the person the personal data is about. Data subjects have rights under data protection law, such as the right to access, correct or delete their data.

We help you respond to these requests, taking into account the nature of the processing, for example through the tools in the platform or with reasonable assistance on request.

If we receive a request directly from one of your End Users, we forward it to you. We do not answer it ourselves unless you instruct us to.

A personal data breach is a security incident that leads to personal data being lost, changed, disclosed or accessed without permission.

If we become aware of a personal data breach that affects your personal data, we will:

• notify you without undue delay;
• share the information we have at that time, such as what happened, the data and people likely affected, and the steps we are taking, and add more details as we learn them;
• help you with any notifications you need to make to data protection authorities and to the people affected.

Notifying you about a breach does not mean that we accept fault or liability for it.

We give you reasonable help with data protection impact assessments and with prior consultations with data protection authorities, where the law requires them and they relate to our processing.

A data protection impact assessment is a review a controller carries out before processing that is likely to create a high risk for people.

The Services can flag or score leads, for example as likely duplicate or likely fraudulent. We do this using the rules you set and our own fraud signals.

You control what happens to flagged leads, for example whether they are rejected, held for review or delivered. You are responsible for any obligations you have toward End Users about automated decisions, such as informing them or offering a human review.

Personal data may be processed in countries other than the one where it was collected. Some countries have an adequacy decision, which means the European Commission or the United Kingdom has decided that the country protects personal data to an adequate level.

Where personal data from the European Union or the United Kingdom is transferred to a country without an adequacy decision, the European Commission's standard contractual clauses apply to that transfer. Where UK personal data is involved, the UK addendum to those clauses also applies. These clauses are incorporated into this DPA by reference, which means they form part of it as if they were written out here.

When your contract with us ends, you can export your data during a 30 day window. After that window, we delete your personal data, unless a law requires us to keep it. If we must keep some data, we continue to protect it under this DPA and use it only for the purpose the law requires.

We make available to you the information you reasonably need to show that we comply with this DPA.

You may also audit our compliance, subject to these conditions:

• you give us reasonable notice in advance;
• audits happen at most once a year, unless a personal data breach or a data protection authority requires more;
• everyone involved in the audit keeps our information confidential.

The limits of liability in the Terms also apply to this DPA.

If this DPA and the Terms conflict on a data protection matter, this DPA wins.

For any question about this DPA or about how we process personal data for you, email us at [email protected].