Data Processing Agreement

This Data Processing Agreement (“DPA”) is between the Customer (controller) and Carpuse (processor) and applies to personal data in Customer Data that Carpuse processes on the Customer's behalf. It forms part of the Terms of Service. Terms used here have the meaning given in the EU General Data Protection Regulation (“GDPR”) and, where applicable, the UK GDPR.

• Subject matter and purpose: providing the Carpuse revenue platform and related support.
• Duration: for the term of the Customer's use of the Service, plus the deletion period below.
• Nature: hosting, storage, organization, retrieval, analysis (including AI-assisted analysis on user request), display and deletion.
• Data subjects: the Customer's prospects, customers, contacts and business partners, and the Customer's users.
• Categories of data: names, business contact details, job titles, company information, communication and activity records, deal and subscription data, notes, and any custom fields the Customer adds. The Service is not designed for special category data, and the Customer agrees not to upload it.

• We process personal data only on the Customer's documented instructions, which are these Terms, this DPA and the Customer's use of the Service, unless the law requires otherwise (in which case we will inform the Customer unless the law forbids it).
• Everyone authorized to process the data is bound by confidentiality.
• We implement the technical and organizational measures described in the annex below.
• We help the Customer respond to data subject requests, carry out data protection impact assessments and meet its security obligations, taking into account the nature of the processing.
• We do not use Customer Data to train AI models and do not sell it.

The Customer gives general authorization for us to use the subprocessors listed on our Subprocessors page. We impose data protection terms on each subprocessor that are at least as protective as this DPA and remain responsible for their performance. We will notify the Customer at least 30 days before adding or replacing a subprocessor; the Customer may object on reasonable data protection grounds, and if we cannot resolve the objection, the Customer may terminate the affected Service and receive a refund of prepaid fees for the remaining period.

We will notify the Customer without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting Customer Data. The notice will describe the nature of the breach, the data and data subjects concerned, likely consequences and the measures taken, and we will keep the Customer updated as we learn more.

Customer Data is hosted in the European Union. Where a subprocessor processes personal data outside the EEA or UK in a country without an adequacy decision, the transfer is covered by the European Commission's Standard Contractual Clauses (and the UK Addendum where relevant), or by the EU–US Data Privacy Framework where the recipient is certified, together with supplementary measures where needed.

We will make available the information reasonably needed to demonstrate compliance with this DPA, including answers to security questionnaires and our subprocessors' certifications. If that is not enough, the Customer may carry out an audit, at its own cost, with at least 30 days' notice, no more than once a year, during business hours and subject to confidentiality.

The Customer can request an export of Customer Data at any time and for 30 days after the end of the Service. After that period we delete Customer Data within 30 days, and it is removed from backups as they rotate, unless the law requires us to keep it.

Liability under this DPA is subject to the limitations in the Terms. If this DPA conflicts with the Terms, this DPA prevails for matters of data protection.

• Workspace isolation enforced in the database with row-level security on every table, verified by automated tests.
• Encryption in transit (TLS) and at rest (AES-256) for the database and file storage.
• Role-based access (Admin / Member) inside each workspace; the Revenue Assistant can only use records the requesting user can see.
• Passwords stored only as salted hashes; API keys for data capture stored as hashes.
• Private file storage with short-lived signed links.
• Least-privilege access to production systems for our staff, with multi-factor authentication.
• Daily backups managed by our database provider.
• Changes to the database made only through reviewed, versioned migrations.

Data protection questions or a countersigned copy: hi@carpuse.com.