Data Processing Terms
1. Scope and priority
These terms (the "DPA") form part of the agreement between SLSBMB Limited ("SLSBMB") and the customer. They apply when SLSBMB processes personal data on the customer's behalf in providing SLSBMB AI, including the free interview where applicable. "Applicable Data Protection Law" means the personal-data law applicable to the processing, including the EU GDPR, UK GDPR or Hong Kong Personal Data (Privacy) Ordinance where applicable. Their controller, processor, data user and data processor concepts have their respective legal meanings.
Mandatory law and applicable mandatory transfer clauses prevail; this DPA then prevails on processing on the customer's behalf; the Terms of Service govern remaining commercial matters. Nothing limits statutory rights of individuals or powers of regulators.
2. Roles and documented instructions
The customer determines its campaign purposes, audiences, offers and permitted use of recipients' data. For processing carried out solely to provide those instructed functions, including the customer's specified paid contact search, authenticated workspace preview and Contact Pack preparation and delivery, SLSBMB acts as processor. If the customer itself acts for another controller, it warrants authority to appoint SLSBMB as a subprocessor and to give the instructions.
Instructions consist of the agreement, accepted order, workspace settings and other documented instructions accepted within the Service. SLSBMB processes personal data only on those instructions, including for transfers, unless applicable law requires otherwise. In that case SLSBMB informs the customer before processing unless that law prohibits it. SLSBMB informs the customer if it considers an instruction to infringe Applicable Data Protection Law and may pause the affected processing pending resolution. An instruction requiring a new feature or service does not itself amend an order.
SLSBMB acts separately for account administration, billing, payment evidence, security, abuse prevention, legal records and necessary service-wide suppression, as described in the Privacy Notice. SLSBMB also acts separately for its public contact-search demonstrations, including the public search tool for AI assistants. These purposes do not permit unrelated reuse of customer campaign data. Roles in sourcing and disclosing professional contact data depend on who actually determines the purpose and essential means; a provider's or SLSBMB's independent activity is not made processor activity by this DPA. The relevant role, source, purpose and rights must be recorded for that activity.
3. Customer responsibilities
The customer is responsible for lawful instructions, the authority to provide data, a valid basis for its processing, required notices and consents, recipient choices and its campaign's compliance. It supplies accurate restrictions and corrections and uses the Service consistently with the Outbound Compliance Policy. The customer remains responsible for its notices even when it does not send a campaign or uses the contacts outside SLSBMB. SLSBMB makes available the relevant source, acquisition and disclosure information it holds and assists with rights requests as required by this DPA. SLSBMB remains responsible for obligations placed directly on it by Applicable Data Protection Law, including notices for its own controller activities.
4. Confidentiality, security and incidents
SLSBMB ensures that authorised personnel are bound by confidentiality and have access appropriate to their work. It implements technical and organisational measures appropriate to the processing risks, taking account of the state of the art, costs, nature, scope, context and purposes of processing, as required by Applicable Data Protection Law. The Security page describes the baseline measures; information needed to evaluate safeguards is available under appropriate confidentiality protections.
SLSBMB notifies the customer without undue delay after becoming aware of a personal data breach affecting data processed on its behalf. The notice contains information then available about the nature of the breach, affected data and people, likely consequences, response measures and a contact. Further information may follow as it becomes available. SLSBMB investigates and takes reasonable containment and remediation steps and assists with the customer's required notifications. Notice is not an admission of liability.
5. Subprocessors
The customer gives general written authorisation for the subprocessors listed on the Subprocessors and Providers page, which states each provider's function, the data concerned and its processing location. Where that page describes a provider without naming it, SLSBMB gives the customer its identity on request. Independent controllers are listed separately.
For a new or replacement subprocessor, SLSBMB updates that page and informs the customer in writing, by email to the workspace address, at least 10 days before the provider starts processing the customer's personal data. The customer may object within that period on reasonable grounds relating to the protection of its personal data. The parties seek a practical resolution, which may include additional safeguards or an available authorised provider. If no resolution is available, either party may end only the affected service; the existing Refund Policy and mandatory rights govern the financial consequences, without a separate satisfaction or refund guarantee.
While an objection is unresolved, SLSBMB uses an already authorised option or suspends the affected processing; the contested provider does not receive that customer's data. An urgent outage may be handled through an already authorised alternative. Routine routing among authorised providers within the agreed scope, including capacity or reliability switching, needs no new approval for each task. A customer's objection does not halt other customers' services.
SLSBMB puts equivalent applicable data-protection duties in its written subprocessor contracts and remains responsible for their performance as required by Applicable Data Protection Law. The Terms' lawful commercial liability limits apply.
6. Assistance and evidence
Taking account of the processing and information available, SLSBMB provides the assistance required by Applicable Data Protection Law for data-subject requests, security, breach notification, impact assessments and regulator consultation. It passes requests concerning data processed on the customer's behalf to that customer and responds on its instructions or as law requires.
SLSBMB supplies information needed to demonstrate compliance and permits legally required audits and inspections. Available documentation and remote evidence are used first where sufficient. Routine audits require reasonable notice, business hours, confidentiality and safeguards for security and other customers' data; they should not unnecessarily duplicate existing evidence. These arrangements do not restrict a legally required audit or urgent regulatory investigation. The customer bears its own auditor's costs. Reasonable charges for exceptional assistance may be agreed in advance where lawful; fee discussions do not postpone mandatory action. No general right to inspect unrelated systems, source code or other customers' information is granted.
7. International transfers
The Service stores customer data on servers in the European Union (Hetzner, Finland and Germany). SLSBMB operates from Hong Kong, and the subprocessors listed on the Subprocessors and Providers page process data in the locations stated there, including the United States, Singapore and the United Kingdom.
EU transfers. Where the customer's personal data is subject to the EU GDPR and is transferred to SLSBMB, or onward to a subprocessor, in a country without an adequacy decision, the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914 (the "EU SCCs") are entered into between the customer as data exporter and SLSBMB as data importer and are incorporated into this DPA by reference. Module 2 applies where the customer is a controller and Module 3 where the customer acts as a processor for another controller. Their options and annexes are completed in the Transfer Schedule below. Acceptance of this DPA, including through the Service, is acceptance of the EU SCCs; no separate signature is required.
UK and Swiss transfers. Where the UK GDPR applies, the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner (version B1.0, in force from 21 March 2022) is incorporated by reference and completed as set out in the Transfer Schedule. Where the Swiss Federal Act on Data Protection applies, the EU SCCs apply with the Swiss adaptations in the Transfer Schedule.
If there is a conflict, the EU SCCs, the UK Addendum and the Swiss adaptations prevail over this DPA and the Terms for the transfer concerned. SLSBMB requires its subprocessors to apply data-protection obligations and transfer safeguards to onward transfers as Clause 9 of the EU SCCs requires.
8. Return, deletion and retention
At the end of the relevant processing service, SLSBMB returns or deletes personal data processed on the customer's behalf, at the customer's choice, and deletes remaining copies unless law requires retention. The customer can export through available functions or contact a@slsbmb.com for return or deletion instructions. Data retained by legal requirement is isolated from ordinary use and protected for the required period.
Backup copies remain protected and beyond ordinary use until overwritten under the documented backup schedule; if restored, the deletion instruction is reapplied. This does not extend a mandatory deletion deadline. Independent-controller accounting, security and necessary suppression records follow their separate lawful purposes and retention criteria in the Privacy Notice. Archive, cancellation and completed erasure are different states; SLSBMB confirms the scope and completion of an erasure request.
9. Liability and contact
The Terms' exclusions, liability limit and indemnity apply between the parties to the extent lawful. They do not override mandatory transfer clauses, statutory liability or individuals' rights. An indemnity does not transfer SLSBMB's non-transferable duties. Contact: a@slsbmb.com.
10. Processing description
Subject and duration: providing the selected SLSBMB AI functions during the agreement and the return/deletion process. Nature: collection, recording, organisation, retrieval, analysis, generation, contact lookup and verification, transmission, hosting, support, export, suppression and deletion as instructed. Purpose: the customer's professional research, outreach and reply handling within the purchased or free function.
People: the customer's authorised users, representatives, professional prospects, campaign recipients and people whose details appear in the customer's supplied material or correspondence. Data: professional names, roles, organisations, work contact details, website/profile information, interview and brief content, campaign messages and replies, delivery and suppression events, and necessary workspace identifiers. Particular instructions and restrictions are in the customer's order and workspace.
Sensitive data: the ordinary Service is not intended to process special-category data, criminal records, children's data or credentials. The customer must not intentionally submit these without a separate lawful, agreed arrangement. Unexpected sensitive material remains protected and must be addressed by restriction, deletion or another lawful instruction. The customer's rights and obligations are those in this DPA and the agreement. The Transfer Schedule below and the Subprocessors and Providers page complete this description.
Transfer Schedule
This schedule completes the EU SCCs and the UK Addendum incorporated by section 7.
A. Clause options
- Clause 7 (docking clause) applies.
- Clause 9(a): Option 2, general written authorisation. SLSBMB informs the data exporter in writing of intended changes to the list of subprocessors at least 10 days in advance, as described in section 5.
- Clause 11(a): the optional wording on an independent dispute resolution body does not apply.
- Clause 13: the competent supervisory authority is set out in Annex I.C.
- Clause 17: Option 1. The EU SCCs are governed by the law of the Netherlands.
- Clause 18(b): disputes are resolved by the courts of Amsterdam, the Netherlands.
Annex I.A. List of parties
Data exporter: the customer identified in its SLSBMB AI workspace and order, with the contact details recorded there. Role: controller (Module 2) or processor (Module 3). Activities: use of SLSBMB AI as described in Annex I.B. Signature and date: acceptance of this DPA through the Service, recorded with the accepted legal edition.
Data importer: SLSBMB Limited, a limited company incorporated in Hong Kong. Contact: a@slsbmb.com. Role: processor (Module 2) or subprocessor (Module 3). Activities: providing SLSBMB AI as described in Annex I.B. Signature and date: as for the data exporter.
Annex I.B. Description of the transfer
Data subjects: the customer's authorised users and representatives; professional prospects and campaign recipients; people whose details appear in material or correspondence the customer supplies. Personal data: professional names, roles, organisations, work email addresses and other work contact details, public professional profile information, interview and brief content, campaign messages and replies, sender identities, delivery and suppression events, and workspace identifiers. Sensitive data: none intended; see section 10. Frequency: continuous for the duration of the agreement. Nature and purpose: as described in section 10, to provide the SLSBMB AI functions the customer uses. Retention: for the agreement, then return or deletion under section 8; backups until overwritten under the backup schedule. Transfers to subprocessors: to the providers listed on the Subprocessors and Providers page, for the functions stated there, for the duration of the agreement.
Annex I.C. Competent supervisory authority
Where the data exporter is established in the EU, the supervisory authority of that Member State. Where it is not established in the EU but has appointed a representative under Article 27(1) GDPR, the supervisory authority of the Member State where the representative is established. Otherwise, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Annex II. Technical and organisational measures
- Production servers, databases and backups are hosted in Hetzner data centres in the European Union.
- Traffic over public networks is encrypted with TLS. Database backups are encrypted with AES-256 before they leave the server and are kept for a limited period.
- Customers sign in with single-use email links or passkeys; sessions use secure cookies; workspace data is bound to its workspace.
- Server administration uses SSH keys only; password and root logins are disabled. Credentials are kept outside the code repository with restricted access.
- Only the web entry point is public. Databases, the mail engine and internal services listen only on local or private network interfaces. Web research runs on a separate, isolated host.
- Operator-visible changes are recorded in audit logs. Monitoring raises alerts for failures and incidents, which are investigated and handled under section 4.
- Providers receive only the data needed for their function. Card details are handled by the payment provider and never reach SLSBMB's systems.
- Opt-outs, objections and hard bounces are suppressed, and campaign emails carry an unsubscribe mechanism.
- Return and deletion follow section 8, including reapplying an erasure after a backup restore.
- People with access to personal data are bound by confidentiality and receive access appropriate to their work.
Annex III. List of subprocessors
The subprocessors are listed on the Subprocessors and Providers page.
UK Addendum tables
Table 1 (parties): as Annex I.A. Table 2 (selected SCCs, modules and clauses): the EU SCCs incorporated by section 7, with Modules 2 and 3 and the options in part A. Table 3 (appendix information): Annexes I.A, I.B, II and III above. Table 4 (ending the Addendum when the Approved Addendum changes): the importer may end it under Section 19 of the Addendum.
Swiss adaptations
For transfers subject to the Swiss Federal Act on Data Protection, references to the GDPR include that Act, the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority, and the term "Member State" does not prevent data subjects habitually resident in Switzerland from bringing claims there.