Data Processing Agreement

1. Who the parties are

This Data Processing Agreement (“DPA”) is between you, the customer (“you”), and SDVSOFT OÜ, a company registered in Estonia with registry code 12997702 and VAT number EE101860657, having its address at Sepapaja 6, Tallinn, Estonia, 15551, operating as Sellvance.com (“Sellvance”, “we”, “us”). It is part of our Terms of Service. Where the two differ on personal data, this DPA applies.

2. Our roles

Sellvance has two different roles, depending on the data.

• Processor for your data. For the leads you upload, import from a CRM, add by hand or through the API, and for the content of the messages you send and receive, you are the controller and Sellvance is your processor. We process this data only to run the service for you.
• Controller for our company database. Sellvance compiles a database of companies and their business contacts from public business sources. For that database we are an independent controller, and our Privacy Policy explains how we handle it. When you add a contact from the database to your workspace and email them, you decide what happens next, so for that copy you are the controller and we are your processor.

3. What we process

Subject matter

Providing the Sellvance platform to you: storing and organising leads, enriching them, writing and sending your outreach emails, receiving replies, and keeping opt-out and do-not-contact lists.

Duration

For as long as you use Sellvance under the Terms, and afterwards only for the time we need to delete or return the data (section 11).

Nature and purpose

Collection through your uploads and connections, storage, organisation, enrichment, analysis, message generation, sending, reply handling, and deletion. We process the data only to provide the service you asked for, to keep it secure, and to meet our legal duties.

Categories of data

• Business contact data: name, job title, company, work email address, work phone number, professional profile links.
• Company data linked to a contact: name, website, location, industry, size.
• Data you add: notes, custom fields, enrichment results, segment membership.
• Communications: the emails you send through Sellvance and the replies you receive, with their delivery data (sent, bounced, opened where allowed, replied).
• Compliance records: opt-outs, consent records you upload, and where each address came from.

Sellvance is for business-to-business outreach. You must not upload special categories of data (for example health or political views) or data about consumers.

Categories of data subjects

• Your prospects and customers: people at other businesses, contacted in their professional role.
• People who write to your sending mailboxes.
• Your own users of the platform, as far as their data appears in your workspace.

4. Your instructions

We process your data only on your documented instructions. Your instructions are the Terms, this DPA, and what you set up in the platform: the leads you add, the campaigns you start, the settings you choose, and the calls you make to the API or the MCP server. If we believe an instruction breaks data-protection law, we tell you and may refuse to carry it out. The checks in our Sending Standards are part of the service. They can leave contacts out or pause sending, and they are not instructions you can switch off.

5. Confidentiality

Everyone at Sellvance who can access your data is bound by confidentiality, and gets access only when their work needs it.

6. How we protect the data

• Isolation. Every account and workspace is kept separate. Each query in the platform and the API is limited to the workspace it belongs to.
• Access control. Access to the platform needs a login. API keys and OAuth tokens carry scopes that limit what they can do, and can be revoked at any time.
• Encryption. Data travels over encrypted connections (HTTPS). In our company database, people's email addresses and other contact details are stored encrypted. API keys you give us for enrichment and API steps, and Google connection tokens, are stored encrypted too.
• Backups. We keep backups so data can be restored after a failure.
• Audit trail. Compliance decisions, such as why a contact was left out of a campaign, are logged.
• Staff access. Production systems are reached only by authorised staff, over authenticated connections.

We review these measures as threats and technology change, and we won't lower the overall level of protection.

7. Who helps us (sub-processors)

We use other companies for parts of the service. Each one is bound by a written agreement that protects your data at least as well as this DPA does. We tell you before we add or replace a sub-processor, so you can object. If you object on reasonable grounds and we can't fix the concern, you may end the affected service.

You can ask us for the current list of named sub-processors and where each one processes data.

When you connect your own account with another provider, for example your own email server or your own enrichment provider key, that provider works for you under your own agreement with them. It is not our sub-processor.

8. Data outside the EEA

When a sub-processor processes data outside the EEA, we make sure the transfer is lawful: the country has an adequacy decision from the European Commission, or we use the Commission's Standard Contractual Clauses with extra safeguards where they are needed. You can ask us which safeguard applies to each sub-processor.

9. Helping you with people's requests

When people ask to see, correct or delete their data, or object to being contacted, the platform lets you act on it yourself: you can edit or delete leads, and add anyone to your do-not-contact list. If we receive a request about your data directly, we pass it to you and don't answer it ourselves, unless it is about our company database. Anyone can ask us to remove them from that database on our Remove my data page. We also help you, as far as we reasonably can, with data-protection impact assessments and questions from regulators.

10. If something goes wrong

If we become aware of a personal-data breach that affects your data, we tell you without undue delay. We tell you what happened, which data and people are affected, what we have done about it, and who you can talk to. We keep helping you while you meet your own duties to notify regulators and the people affected.

11. When the service ends

You can export your leads and campaign data at any time, in the app or through the API. When your account closes, we delete your data within a reasonable period, unless the law requires us to keep part of it. Opt-out and do-not-contact records are kept as hashed fingerprints, not readable addresses, so that the people on them are never emailed again.

12. Audits

On request we give you the information you need to check that we keep this DPA. If that isn't enough, you or an independent auditor bound by confidentiality may audit us, with reasonable notice, during business hours, and at most once a year unless a regulator requires more or a breach has occurred.

13. Contact

For questions about this DPA, or to ask for a signed copy, contact us through our support page.