Data processing agreement

1. Who is responsible for what

• Website visit information (visitors to the customer’s website): the customer is the controller and Lewis Scott Consulting Ltd is its processor.
• Business contact details (the people the service shows): Lewis Scott Consulting Ltd is the controller. The customer receives them to decide whom to contact, and once it takes a person’s details to contact them it is responsible for its own use of them.
• The customer’s staff and account details: Lewis Scott Consulting Ltd is the controller.

The rest of this agreement is about the first of these, where we are the customer’s processor.

2. What is processed, and why

• Subject matter and purpose: identifying the companies that visit the customer’s website, on its instructions.
• Nature of the processing: collecting, storing, matching to a company, scoring and deleting.
• Duration: while the account is open, with each visit deleted 90 days after it happens.
• Personal data: a random browser identifier, pages viewed, time active, referring site, campaign tags, and the visitor’s IP address (kept encrypted, used once, and wiped within 24 hours; a hash stays with the visit for 90 days).
• Whose: people who visit the customer’s website and agree to its analytics or marketing cookies.
• Never processed: form fields, key presses, clicks or the text on a page; and no attempt to identify an individual visitor.

3. Processing on instructions

We process only on the customer’s documented instructions (its settings and the script it installs), unless the law requires otherwise, in which case we tell the customer first unless the law forbids it. We keep the data confidential, make sure everyone who can see it is bound to confidentiality, and tell the customer if an instruction breaks the law. We help the customer with its data protection impact assessments, and with consulting the ICO where they concern the service.

4. Security measures

• Hosting and database in London, with row-level security so one customer’s data cannot be read by another’s, enforced by the database.
• IP addresses and webhook links encrypted with AES-256-GCM before they are stored, with keys outside the database.
• Only the server holds the keys that bypass row-level security, and background jobs are protected by a secret.
• Two-factor authentication for administrators, and a log, which cannot be altered, of every search, export and deletion they make across accounts.
• Nightly deletion of what is past its retention period.

We keep these measures under review, and will not lower the level of protection they give.

5. Sub-processors

The customer agrees to the companies on the sub-processors page. We have a written contract with each that carries the same data protection duties as this agreement, and we remain responsible to the customer for what they do. We will tell the customer at least 30 days before we add or replace one. The customer may object within that time on reasonable data protection grounds; if we cannot find a way to meet the objection, the customer may cancel its account.

Where a sub-processor handles personal data outside the UK, we make sure a safeguard the UK GDPR recognises applies: the UK Extension to the EU–US Data Privacy Framework, or standard contractual clauses with the UK Addendum, or the ICO’s International Data Transfer Agreement.

6. Helping with people's rights

We help the customer answer requests from visitors, and tell the customer without delay if a visitor makes a request to us about its data. For the business contact details, anyone can use the opt-out page, and we search, export and delete across every account on request, aiming to finish within 7 days and always within the legal limit of one month. The customer can delete a person from its own account and keep them out of it in Settings, under Data.

7. Personal data breaches

We will tell the customer without undue delay after we become aware of a breach affecting its data, and in any case within 48 hours, with what we know about it and what we are doing.

8. When the agreement ends

Visit information is deleted 90 days after each visit whatever happens, and we delete the rest of the customer’s data within 30 days of the account closing, unless the law requires us to keep it. The customer can export everything it holds in Settings, under Data, before then.

9. Audits, liability and law

• We give the customer the information it reasonably needs to show that we meet these duties. If that is not enough, we allow an audit by the customer or an auditor it appoints, on at least 30 days’ notice, during working hours, no more than once a year unless there has been a breach, and subject to confidentiality.
• Our liability under this agreement is part of, and subject to the same limit as, our liability under the customer terms.
• This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.