Data Processing Terms
1. Scope and priority
These terms (the "DPA") form part of the agreement between SLSBMB Limited ("SLSBMB") and the customer. They apply when SLSBMB processes personal data on the customer's behalf in providing SLSBMB AI, including the free interview where applicable. "Applicable Data Protection Law" means the personal-data law applicable to the processing, including the EU GDPR, UK GDPR or Hong Kong Personal Data (Privacy) Ordinance where applicable. Their controller, processor, data user and data processor concepts have their respective legal meanings.
Mandatory law and applicable mandatory transfer clauses prevail; this DPA then prevails on processing on the customer's behalf; the Terms of Service govern remaining commercial matters. Nothing limits statutory rights of individuals or powers of regulators.
2. Roles and documented instructions
The customer determines its campaign purposes, audiences, offers and permitted use of recipients' data. For processing carried out solely to provide those instructed functions, including the customer's specified paid contact search, authenticated workspace preview and Contact Pack preparation and delivery, SLSBMB acts as processor. If the customer itself acts for another controller, it warrants authority to appoint SLSBMB as a subprocessor and to give the instructions.
Instructions consist of the agreement, accepted order, workspace settings and other documented instructions accepted within the Service. SLSBMB processes personal data only on those instructions, including for transfers, unless applicable law requires otherwise. In that case SLSBMB informs the customer before processing unless that law prohibits it. SLSBMB informs the customer if it considers an instruction to infringe Applicable Data Protection Law and may pause the affected processing pending resolution. An instruction requiring a new feature or service does not itself amend an order.
SLSBMB acts separately for account administration, billing, payment evidence, security, abuse prevention, legal records and necessary service-wide suppression, as described in the Privacy Notice. SLSBMB also acts separately for its public contact-search demonstrations, including the public search tool for AI assistants. These purposes do not permit unrelated reuse of customer campaign data. Roles in sourcing and disclosing professional contact data depend on who actually determines the purpose and essential means; a provider's or SLSBMB's independent activity is not made processor activity by this DPA. The relevant role, source, purpose and rights must be recorded for that activity.
3. Customer responsibilities
The customer is responsible for lawful instructions, the authority to provide data, a valid basis for its processing, required notices and consents, recipient choices and its campaign's compliance. It supplies accurate restrictions and corrections and uses the Service consistently with the Outbound Compliance Policy. The customer remains responsible for its notices even when it does not send a campaign or uses the contacts outside SLSBMB. SLSBMB makes available the relevant source, acquisition and disclosure information it holds and assists with rights requests as required by this DPA. SLSBMB remains responsible for obligations placed directly on it by Applicable Data Protection Law, including notices for its own controller activities.
4. Confidentiality, security and incidents
SLSBMB ensures that authorised personnel are bound by confidentiality and have access appropriate to their work. It implements technical and organisational measures appropriate to the processing risks, taking account of the state of the art, costs, nature, scope, context and purposes of processing, as required by Applicable Data Protection Law. The Security page describes the baseline measures; information needed to evaluate safeguards is available under appropriate confidentiality protections.
SLSBMB notifies the customer without undue delay after becoming aware of a personal data breach affecting data processed on its behalf. The notice contains information then available about the nature of the breach, affected data and people, likely consequences, response measures and a contact. Further information may follow as it becomes available. SLSBMB investigates and takes reasonable containment and remediation steps and assists with the customer's required notifications. Notice is not an admission of liability.
5. Subprocessors
The customer gives general written authorisation for the subprocessors in the identified register made available to it under the Subprocessors and Providers page. The register identifies each legal entity, function, relevant data, processing locations and safeguards. Independent controllers are identified separately.
For a new or replacement subprocessor, SLSBMB gives advance written notice before the provider processes that customer's data. The notice states a response period that provides a reasonable opportunity to object before that processing begins, subject to any longer period required by an applicable transfer instrument. The customer may object within that period on reasonable grounds relating to the protection of its personal data. The parties seek a practical resolution, which may include additional safeguards or an available authorised provider. If no resolution is available, either party may end only the affected service; the existing Refund Policy and mandatory rights govern the financial consequences, without a separate satisfaction or refund guarantee.
While an objection is unresolved, SLSBMB uses an already authorised option or suspends the affected processing; the contested provider does not receive that customer's data. An urgent outage may be handled through an already authorised alternative. Routine routing among authorised providers within the agreed scope, including capacity or reliability switching, needs no new approval for each task. A customer's objection does not halt other customers' services.
SLSBMB puts equivalent applicable data-protection duties in its written subprocessor contracts and remains responsible for their performance as required by Applicable Data Protection Law. The Terms' lawful commercial liability limits apply.
6. Assistance and evidence
Taking account of the processing and information available, SLSBMB provides the assistance required by Applicable Data Protection Law for data-subject requests, security, breach notification, impact assessments and regulator consultation. It passes requests concerning data processed on the customer's behalf to that customer and responds on its instructions or as law requires.
SLSBMB supplies information needed to demonstrate compliance and permits legally required audits and inspections. Available documentation and remote evidence are used first where sufficient. Routine audits require reasonable notice, business hours, confidentiality and safeguards for security and other customers' data; they should not unnecessarily duplicate existing evidence. These arrangements do not restrict a legally required audit or urgent regulatory investigation. The customer bears its own auditor's costs. Reasonable charges for exceptional assistance may be agreed in advance where lawful; fee discussions do not postpone mandatory action. No general right to inspect unrelated systems, source code or other customers' information is granted.
7. International transfers
Restricted transfers require a valid transfer arrangement for the relevant processing relationship. Where legally applicable, the parties must incorporate the EU Standard Contractual Clauses in Commission Implementing Decision (EU) 2021/914 by reference through a completed transfer schedule accepted with this DPA. Publication of this DPA alone does not complete or execute that schedule. The schedule must identify the parties, applicable module, clause options, competent authority, governing law and forum, and the required annexes. Module 2 is used for controller-to-processor transfers and Module 3 for processor-to-subprocessor transfers where those clauses apply. Other roles and transfers require the instrument applicable to that activity. UK and Swiss transfers include the required local instrument or adaptations.
SLSBMB provides its relevant entity, provider, location and security information for the schedule. The parties complete the required transfer assessment and additional safeguards before relying on the arrangement. The standing arrangement covers repeated transfers within its recorded scope; a separate signature is not required for every model request or routine switch between covered providers. A material change in scope, role or destination is addressed through the applicable change procedure before the changed restricted transfer begins. Mandatory transfer terms prevail for that transfer.
Request the applicable schedule and evidence of safeguards at a@slsbmb.com, subject to lawful redaction. A missing record must be resolved; it must not be treated as an executed agreement. A required arrangement must be in force for the relevant transfer; if it is absent or cannot be complied with, only that affected transfer is suspended while an authorised alternative or another lawful solution is arranged. The applicable transfer instrument governs any further suspension, return, deletion or termination.
8. Return, deletion and retention
At the end of the relevant processing service, SLSBMB returns or deletes personal data processed on the customer's behalf, at the customer's choice, and deletes remaining copies unless law requires retention. The customer can export through available functions or contact a@slsbmb.com for return or deletion instructions. Data retained by legal requirement is isolated from ordinary use and protected for the required period.
Backup copies remain protected and beyond ordinary use until overwritten under the documented backup schedule; if restored, the deletion instruction is reapplied. This does not extend a mandatory deletion deadline. Independent-controller accounting, security and necessary suppression records follow their separate lawful purposes and retention criteria in the Privacy Notice. Archive, cancellation and completed erasure are different states; SLSBMB confirms the scope and completion of an erasure request.
9. Liability and contact
The Terms' exclusions, liability limit and indemnity apply between the parties to the extent lawful. They do not override mandatory transfer clauses, statutory liability or individuals' rights. An indemnity does not transfer SLSBMB's non-transferable duties. Contact: a@slsbmb.com.
10. Processing description
Subject and duration: providing the selected SLSBMB AI functions during the agreement and the return/deletion process. Nature: collection, recording, organisation, retrieval, analysis, generation, contact lookup and verification, transmission, hosting, support, export, suppression and deletion as instructed. Purpose: the customer's professional research, outreach and reply handling within the purchased or free function.
People: the customer's authorised users, representatives, professional prospects, campaign recipients and people whose details appear in the customer's supplied material or correspondence. Data: professional names, roles, organisations, work contact details, website/profile information, interview and brief content, campaign messages and replies, delivery and suppression events, and necessary workspace identifiers. Particular instructions and restrictions are in the customer's order and workspace.
Sensitive data: the ordinary Service is not intended to process special-category data, criminal records, children's data or credentials. The customer must not intentionally submit these without a separate lawful, agreed arrangement. Unexpected sensitive material remains protected and must be addressed by restriction, deletion or another lawful instruction. The customer's rights and obligations are those in this DPA and the agreement. Transfer-specific annexes and the identified subprocessor register supplement this description where required.