Data Processing Agreement

This Data Processing Agreement (“DPA”) is between Black Ocean Ventures (Vondelstraat 81, 1054 GL Amsterdam, the Netherlands, “Processor”) and the customer that accepts it (“Controller”). It applies to every account that uses Linqyou to process personal data about people other than the account holder: tracked profiles, their connections, people who comment on tracked posts, leads, researched people, hirers and reviewers. It is accepted when the account is created and forms part of the Terms of Service. Where this DPA and the Terms conflict on data protection, this DPA prevails. It meets GDPR Art. 28(3).

1. Roles

The Controller decides whose data is processed and why: which profiles and Company Pages to track, whether to switch on comment collection, Leads, research, Content and Career features, and which users can see what. Each of those choices, and the use of the features described in Annex 1, is a documented instruction to the Processor. The Processor processes the data only to provide those features to the Controller.

The Processor acts as an independent controller, outside this DPA, only for: the Controller’s own account, sign-in and billing data; security and abuse prevention; the benchmark metrics described in §9; and public facts about companies (never people) kept in a shared cache.

If the Controller is itself a processor for its own client (for example an agency), the Controller warrants that its client has authorised the use of the Processor and the sub-processors listed under §6, and this DPA applies to the Processor as the Controller’s sub-processor.

2. Controller’s responsibilities

• Having a lawful basis for every processing it instructs, and recording it. Where that basis is legitimate interest, the Processor supplies a template assessment on request.
• Informing the people concerned (Art. 13 and 14). The Processor publishes a notice on the Controller’s behalf in its Privacy Policy; the Controller gives its own information at the latest when it first contacts a person, for which lead exports include the date the data was first held.
• For an employee whose posts or stories are used: respecting that participation is voluntary, and involving the works council where national law requires before per-person results are switched on.
• Lawful use of any outreach, including e-mail marketing rules, and its own agreement with any CRM it connects.

3. Processor obligations

• Process personal data only on the Controller’s documented instructions, including for transfers, unless EU or Member State law requires otherwise; in that case it tells the Controller first unless the law forbids it.
• Immediately tell the Controller if, in its opinion, an instruction infringes the GDPR or other data protection law.
• Not use the data for its own purposes, except as stated in §9.
• Ensure everyone authorised to process the data is bound by confidentiality.
• Take the technical and organisational measures in Annex 2 (Art. 32).
• Help the Controller, taking into account the nature of the processing, to meet its duties on data subject rights (Art. 12–23), security, breach notification, impact assessments and prior consultation (Art. 32–36).
• Make available all information needed to show compliance with Art. 28 and allow audits under §8.

4. Data subject requests

The Processor forwards a request it receives about the Controller’s data within five business days, unless §4a applies. The Controller can itself export, correct and delete data in the product.

4a. Objections and erasure across customers. The Controller instructs the Processor to act on an objection or erasure request received through the Processor’s public objection form for all its customers at once: delete the person’s comments, reactions, endorsements, commenter record, lead records and research, remove their name and link from connection records, and keep a one-way hash of their profile link so they are not collected again. The Processor tells the Controller, on request, that a request was applied, without identifying the person beyond what the Controller already holds.

5. Personal data breaches

The Processor notifies the Controller without undue delay and in any event within 36 hours of becoming aware of a personal data breach affecting the Controller’s data, with what is known about its nature, the categories and approximate number of people and records, likely consequences and the measures taken or proposed, and provides further information as it becomes available. The Processor keeps a record of every breach.

6. Sub-processors

The Controller gives general authorisation for the sub-processors listed at /subprocessors. The Processor gives at least 30 days’ notice by email to workspace owners before adding or replacing one. The Controller may object on reasonable data protection grounds within that period; if the parties cannot resolve it, the Controller may end the affected service and receive a pro-rata refund of prepaid fees for it. The Processor imposes the same data protection obligations as in this DPA on every sub-processor by written contract and remains fully liable to the Controller for them.

7. International transfers

Data is stored in the EU. Any transfer to a third country takes place only to a country with an adequacy decision (including companies certified under the EU-US Data Privacy Framework) or under the European Commission’s Standard Contractual Clauses (2021/914) with a transfer impact assessment. The safeguard for each sub-processor is listed at /subprocessors and copies are available on request.

8. Audits

The Processor answers reasonable written questions on its compliance and provides available certifications and reports. If those are not sufficient, the Controller may audit, itself or through an independent auditor bound by confidentiality, once per 12 months and in any case after a personal data breach affecting its data, with 30 days’ notice (shorter after a breach), during business hours. Each party bears its own costs unless the audit finds a material breach of this DPA by the Processor.

9. Benchmark metrics

The Controller may allow profiles in its workspace to contribute a fixed list of numeric metrics (for example posting frequency and engagement rate, never text, names, connections, comments or research) to sector benchmarks, per profile and for the whole workspace. Where it does, it discloses those metrics to the Processor, which uses them as an independent controller only to publish pooled figures meeting the thresholds in the Privacy Policy. The Controller can switch this off at any time, with effect from the next nightly rebuild.

10. Duration, return and deletion

This DPA lasts as long as the Processor processes personal data for the Controller. At the end of the service the Controller can export its data in the Privacy Centre (machine-readable formats) during the remaining term. The Processor then deletes the data within 30 days, including stored files, and backups as they expire, unless EU or Member State law requires storage, and confirms deletion in writing on request.

11. Liability and law

Each party is liable to data subjects as set out in GDPR Art. 82. Between the parties, the liability provisions of the Terms apply, except that they do not limit liability for intent or deliberate recklessness, or for a party’s share of fines and compensation caused by its own breach of this DPA or the GDPR. This DPA is governed by Dutch law; the courts named in the Terms have jurisdiction.

12. Contact

Data protection: privacy@linqyou.com. Enterprise customers who need their own DPA can contact support@linqyou.com.

Annex 1: Description of the processing

Annex 2: Technical and organisational measures

• Access control: every table is protected by database row-level security per workspace, profile and organization; users see only profiles they are granted; service-role access is limited to server code.
• Encryption: TLS for all traffic; storage encrypted at rest by our database and storage providers.
• Minimisation: a fixed allowlist of export files; connection email addresses never read; keyed hashes to match people; suppression checked before anything is stored.
• Separation: nothing collected for one customer is used for another; comments and research are never part of benchmarks, which are guarded by automated tests.
• Secrets: per-feature API tokens with minimal rights; signed webhooks; tokens and comment text are not logged.
• Deletion: soft-delete followed by permanent erasure after 30 days; raw results at Apify deleted within 7 days, with an alert if overdue.
• Resilience: managed database backups; monitoring of scheduled jobs.
• People: confidentiality obligations for everyone with access; administrative access limited to named people.
• Incidents: a written breach procedure and breach register.
• Testing: automated tenant-isolation and privacy-promise tests run on every change.