Data Processing Agreement

1. Parties and scope

This Data Processing Agreement supplements the Privly Terms of Service between MASTERPIECE Technologies Inc. (Privly) and the customer identified in the workspace account. It covers personal data Privly processes on the customer’s behalf to provide the service (Customer Data).

The customer acts as controller, or as a processor authorized by its controller; Privly acts as processor or subprocessor for that Customer Data. Each party must comply with the data protection laws applicable to its role. For account administration, billing, security, and Privly’s own customer communications, the Privacy Policy describes Privly’s separate responsibilities.

2. Processing details

• Purpose and operations: store, organize, qualify, retrieve, and delete workspace data; prepare messages; and perform the discovery, integrations, and outreach actions the customer configures or approves.
• People concerned: workspace members, customers, prospects, professional contacts, and individuals appearing in the customer’s selected source evidence.
• Data types: names, professional profiles, business contact details, source URLs and evidence, messages, replies, notes, campaign records, and related identifiers and activity.
• Duration: while providing the customer’s service and completing the return or deletion obligations below. Processing occurs as users and configured workflows use the service.
• The service is not intended for sensitive personal data or children’s data. The customer must not instruct Privly to process these without a separate written agreement.

3. Instructions and customer responsibilities

Privly will process Customer Data only on documented instructions, including the customer’s workspace settings and approved actions, unless legally required otherwise. Privly will notify the customer of that legal requirement unless prohibited, and immediately inform the customer if an instruction appears to violate applicable data protection law.

The customer is responsible for lawful collection, required notices and permissions, accurate instructions, and responding to individuals. Privly will not use Customer Data for its own advertising or sell it.

4. Confidentiality and security

Privly will restrict access to authorized people bound by confidentiality and maintain measures appropriate to the processing risk. These include encrypted transport, protected credentials, workspace access controls, and operational logging, as described in the Security Overview.

5. Service providers

The customer gives general written authorization for subprocessors needed for hosting, integrations, discovery, AI, and communications. Privly will provide their identities, functions, and processing locations on request, give advance notice of additions or replacements, and allow reasonable objections on data protection grounds before the change affects Customer Data.

Privly will impose equivalent applicable processing obligations on these providers and remain responsible to the customer for their performance. If an objection cannot be resolved, the parties will agree an alternative or end the affected processing.

6. Requests, incidents, and assistance

Taking account of the processing and available information, Privly will assist the customer with individual rights requests, security obligations, breach notifications, impact assessments, and regulatory consultation. Privly will notify the customer without undue delay after becoming aware of a Customer Data breach and provide available information and updates to support the response.

7. International processing

Customer Data may be processed where Privly and its authorized providers operate. Before a restricted international transfer, the parties must establish a valid transfer mechanism and any required supplementary protections. This agreement does not itself execute standard contractual clauses or guarantee a particular hosting region.

8. Return, deletion, and review

At the end of the service, Privly will return or delete Customer Data at the customer’s choice and delete remaining copies unless retention is legally required. Any retained data remains protected and limited to that purpose. The customer can request assistance through [email protected].

Privly will make information needed to demonstrate compliance available and allow and contribute to customer or appointed-auditor audits, including inspections, with safeguards for security and other customers’ data.

9. Relationship to other terms

This agreement takes precedence over conflicting Terms of Service for processing Customer Data. Neither agreement limits individuals’ statutory rights or either party’s responsibilities under applicable data protection law. Send processing questions or instructions to [email protected].