Legal
Data Processing Agreement
The terms under Article 28 of the UK GDPR that apply when we process personal data on your behalf. It forms part of our Terms of Service and needs no separate signature.
1. Scope and roles
This agreement applies to personal data that you, the customer, put into Portal Scraper or ask us to process, such as company and contact lists you upload, email content, recipients, replies, and connection details for email providers ("Customer Personal Data"). For Customer Personal Data you are the controller and we are your processor.
It does not apply to the planning and business database we compile, or to account and billing data. We are the controller of those, as described in our Privacy Policy. When you use or export information from our database for your own purposes, you are an independent controller of it.
2. Details of the processing
| Subject matter and purpose | Providing the Portal Scraper service, including storing lists, preparing, scheduling and sending emails, warming up mailboxes, receiving replies and showing campaign results. |
|---|---|
| Duration | For as long as you use the service, and then until deletion under section 9. |
| Nature of processing | Collection, storage, organisation, retrieval, use, transmission and deletion. |
| Data subjects | Your contacts and prospects, your staff and users, and people who reply to your emails. |
| Types of personal data | Names, job titles, business contact details, email addresses, message content and metadata, and any other data you choose to upload. You must not upload special category data. |
3. Our obligations
We will:
- process Customer Personal Data only on your documented instructions, which are given by these terms and by how you use the service, unless the law requires otherwise, in which case we will tell you first unless the law prohibits it. We will tell you if we think an instruction breaks data protection law;
- make sure that people authorised to process it are bound by confidentiality;
- take appropriate technical and organisational security measures, as required by Article 32 of the UK GDPR;
- help you, taking into account the nature of the processing, to respond to requests from people exercising their rights, and to meet your obligations on security, breach notification, data protection impact assessments and consultation with the ICO;
- make available the information needed to show we comply with this agreement, and allow for and contribute to reasonable audits, on reasonable notice and no more than once a year unless there has been a breach or a regulator requires it.
4. Security measures
- Encryption of data in transit, and access to production systems limited to authorised staff.
- Separation of each customer's workspace data.
- Hashed passwords, account lockout after repeated failed sign-ins and role-based access.
- Regular backups and controlled deployment.
5. Sub-processors
You give general authorisation for us to use the sub-processors below. We impose data protection terms on each that are equivalent in substance to this agreement, and we remain responsible for them.
| Provider | Purpose | Personal data involved | Location |
|---|---|---|---|
| DigitalOcean | Hosting, database and backups | All service data | [confirm location] |
| Stripe | Subscriptions, payments and invoices | Account email, billing name and address, payment details (card numbers are held by Stripe, not by us) | United Kingdom, European Union and United States |
| OpenAI | AI search filters, document summaries, contact discovery and the help assistant | Planning documents and descriptions, company website text, your questions and prompts | United States |
| Typesafe (Jev) | AI relevance filtering of planning applications | Planning application descriptions and your filter rules | [confirm location] |
| Brave Search | Finding company websites during contact discovery | Search queries containing company names and locations | United States |
| Google Maps Platform | Geocoding site and company addresses | Addresses | United States |
| Maildoso | Managed sending domains and mailboxes | Sender names and addresses, recipient addresses, message content | [confirm location] |
| Mailivery | Mailbox warm-up | Mailbox addresses and connection details, warm-up messages | [confirm location] |
| Microsoft Azure (Application Insights) | Error and performance monitoring | Error messages and page addresses, which can include account identifiers and email addresses | [confirm location] |
We will tell you about any intended addition or replacement at least 30 days in advance by email or in the app. If you object on reasonable data protection grounds and we cannot resolve it, you may cancel the affected service and we will refund prepaid fees for the unused period. If you connect your own email provider account, such as Instantly, that provider works for you directly and is not our sub-processor.
6. International transfers
We transfer Customer Personal Data outside the UK only with appropriate safeguards under UK data protection law, such as UK adequacy regulations, the ICO's International Data Transfer Agreement, or the Addendum to the EU Standard Contractual Clauses.
7. Personal data breaches
We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. We will give you the information you reasonably need to meet your own obligations, and take reasonable steps to contain it.
8. Your obligations
You are responsible for having a lawful basis for the processing you instruct, for giving people the required privacy information, for your marketing complying with the Privacy and Electronic Communications Regulations, and for following our Acceptable Use Policy.
9. Return and deletion
While your account is active you can delete data in the service, or ask us to export or delete it. When the service ends, we will delete Customer Personal Data within 90 days unless the law requires us to keep it. Copies in backups are overwritten on a rolling basis and are not used in the meantime. Suppression records needed to keep honouring opt-outs may be kept in minimal form.
10. Liability and precedence
The limits of liability in our Terms of Service apply to this agreement. If this agreement conflicts with the Terms of Service on the processing of Customer Personal Data, this agreement wins.
If you need a countersigned copy, contact [contact email].