Data Processing Agreement

1. Introduction

This Data Processing Agreement (“Agreement”) is part of the Terms of Service between Stelloa ApS (“Processor”) and the business customer (“Controller”). It covers personal data the Processor handles for the Controller under the GDPR.

2. Definitions

Controller:

The customer, who decides why and how personal data is processed.

Processor:

Stelloa ApS, acting for the Controller.

Personal data:

Any data about an identified or identifiable person.

Subprocessor:

A third party the Processor uses to process that data.

3. Subject matter

This Agreement covers personal data of prospects and of the Controller’s users inside Sixthings.

4. Purpose

The Processor processes personal data only to:

• Find, score, and research prospects.
• Draft and send outreach and follow-ups, and handle replies.
• Provide, maintain, and secure the product.
• Meet legal obligations.

5. Data subjects

• Prospects the Controller asks us to find or contact.
• The Controller’s users and representatives.

6. Types of data

• Name, job title, company, professional profile, email, and message content.
• Account data for the Controller’s users.
• Technical data such as IP addresses and logs.

7. Processor obligations

The Processor will:

• Process data only on the Controller’s documented instructions.
• Use appropriate technical and organisational security measures.
• Limit access to people who need it, and keep it confidential.
• Help the Controller with data-subject requests and any legally required impact assessment.
• Provide the information the Controller reasonably needs to show compliance, and allow an audit on reasonable notice.

8. Subprocessors

Accepting this Agreement authorises the subprocessors used to run the product. The list is available on request. Notice of a new or replacement subprocessor is given in time to cancel and leave at the end of the billing period, before it is used. Subprocessors have the same data-protection duties.

Integrations the Controller connects, such as HubSpot or an email account, receive data only as the Controller configures them.

9. Transfers

The service is hosted in the European Union, and personal data the Processor stores is kept there. If a subprocessor processes personal data outside the EU, the Processor will use an appropriate safeguard, such as Standard Contractual Clauses.

10. Security

The Processor will keep appropriate technical and organisational security measures in place.

11. Breaches

The Processor will notify the Controller without undue delay after becoming aware of a personal data breach.

12. Retention

The Processor keeps personal data for as long as needed to provide the service. The Controller may ask for deletion. When the contract ends, the Processor will delete or return the data, unless the law requires it to be kept.

13. Liability

The Processor is liable for breaches of this Agreement only to the extent required by law.

14. Term

This Agreement lasts while the Processor handles personal data for the Controller, and ends when that processing stops.

15. Governing law

Danish law governs this Agreement. Disputes are resolved in the courts of Denmark.

16. Contact

Questions about this Agreement: hello@sixthings.ai.