This agreement is part of the terms. It sets out how DD Labs Limited processes the personal data of the people in your leads on your behalf, as Article 28 of the UK GDPR requires. Where it says you, that is the customer with the seat; where it says we, that is DD Labs Limited.
The parties and their roles
You are the controller of the personal data of the people whose details appear in your leads. You decide which pages to read and what happens to every lead. DD Labs Limited is the processor and acts only on your instructions, which are set out here and given through the product.
What is processed, and why
The subject matter is the leads you capture with Rensa. The purpose is to read a page you had on your screen into leads, hold them for your review, send them where you direct, and delete them when you say. The processing lasts for as long as your seat runs and for the deletion period after it.
The people concerned are the people who appear on the pages you read. The data is a name, a title, a company and a location as read from the page, the moment it was read, a reference to the page, and the status you gave the lead. No other category of personal data is processed. The image of the page is read and discarded and is never written to storage. For each image we keep a fingerprint of it (a SHA-256 hash), its width and height, which provider and model read it, the name of the app it came from and, for a page that gave leads, one line describing the page (what kind of page it was and who it listed, never a person's name), never the image.
Your instructions
We process the data only to read the page into leads, to hold the leads for you, to merge two leads into one when you confirm they are one person, to send a list where you point it, to download it for you, and to delete it. For a founding seat's list-back service, your instructions also include reading a screenshot you email us with Rensa and sending the list back; we delete the email and the screenshot once the list is sent. Anything else needs a written instruction from you. If we think an instruction breaks the law, we tell you before acting on it.
Confidentiality and security
Only the people who need to see the data to run the service can see it, and each is bound to keep it confidential. Data is encrypted in transit and at rest. The page image never touches storage. Access is logged. Data in one workspace is separated from every other by row-level security in the database. Staff access needs a named account with two-factor sign-in. Secrets are held in the hosting provider's secret store, never in code. Backups are encrypted and expire, and the service is monitored for errors and unusual access.
Sub-processors
We use other companies for parts of the service, and each is bound by terms at least as strict as these. The image is read by Google (Gemini). The sub-processors the service uses are listed below. We tell you by email thirty days before adding or replacing one, and you may object; if we cannot meet the objection, you may end the seat and we refund any month or year paid ahead.
- Google (Gemini API), which receives the page image to read it into leads.
- Stripe, which receives your account email, card, billing name and address, and tax id, for payments.
- Resend, which receives the recipient's address and the email itself, to send our emails.
- Cloudflare, which carries every request to the app and the site, page images included, and stores our database backups and the desktop app's updates (R2).
- Hetzner, which hosts the servers that hold the leads, the accounts and the billing records, in Germany.
- Google, which receives a person's sign-in when they choose to sign in with Google.
- Sentry, which receives reports of errors in the service, and crash reports from the desktop app if crash reporting is turned on, so we can find and fix faults. A report from the service carries the error, where in the code it happened and the web address it was serving, without its query string; cookies, request bodies and sign-in tokens are never sent, and email addresses and phone numbers are removed before it leaves our servers. A crash report has the computer's home folder and any credentials removed first. Sentry stores the reports in the European Union and does not keep IP addresses.
We give you thirty days' notice by email before adding or replacing a sub-processor. If you object, you may cancel the seat before the change and the terms' cancellation applies.
The people's requests
If a person whose details are in your leads asks to see, correct or delete them, that request is yours to answer. We help within a reasonable time, and if the request reaches us instead of you, we pass it to you without answering it ourselves.
If something goes wrong
If personal data in your leads is lost, disclosed or altered without authority, we tell you without undue delay and within forty-eight hours of becoming aware, with what we know and what we are doing.
Retention and deletion
After a seat ends, leads stay readable and downloadable for ninety days; then they are deleted. Ask at any time and the leads are deleted within thirty days; closing the account deletes them within the same period. On deletion we return nothing you have not already downloaded, so download every list you want to keep first. A copy held in a backup is deleted when the backup expires.
Audit
Once a year, or after an incident, you may ask us to show how we meet this agreement, and we answer in writing. An audit on our premises needs thirty days' notice, happens in working hours, and is at your cost unless it finds a breach.
Transfers
Leads are stored on servers in Germany. The page image is sent for reading to model providers in the US, and the sub-processors in the list process data outside the UK under the UK Extension to the EU-US Data Privacy Framework where the provider is certified, and otherwise under the UK's International Data Transfer Addendum to the European Commission's standard contractual clauses.
Precedence
If this agreement and the terms disagree about personal data, this agreement wins. Each party's liability under this agreement is subject to the limits in the terms, except where the law does not allow it to be limited.