Data processing agreement

1. Scope and roles

• The Customer is the controller (or, where it acts for its own clients, a processor acting on their instructions) of the personal data in its workspace. Outvoy is its processor (or sub-processor).
• Annex I describes the processing: its subject matter, duration, nature and purpose, the types of personal data and the categories of data subjects.
• Outvoy's own processing of account, billing and security data as a controller is outside this DPA and is described in the privacy policy.
• This DPA applies to processing under the GDPR, the UK GDPR and the UK Data Protection Act 2018, Spain's LOPDGDD, and, where relevant, the CCPA (for which Outvoy is a service provider and will not sell or share the data, or retain, use or disclose it outside the direct business relationship).

2. The Customer's obligations

• The Customer is responsible for the lawfulness of the processing it instructs: having a legal basis for each person it imports and contacts (for example, legitimate interest assessed and documented), informing them where article 14 GDPR requires it, and honouring their objections and requests.
• The Customer must not put special categories of data (article 9 GDPR), data about criminal convictions (article 10) or data about children into the service.
• The Customer is responsible for its own use of LinkedIn, under LinkedIn's terms, and for the instructions its users and Agents give through the console, API and MCP server.

3. Instructions

Outvoy processes personal data only on the Customer's documented instructions: these terms and this DPA, and the way the Customer configures and uses the service (its campaigns, imports, settings and API calls). Outvoy will not process it for any other purpose, unless EU or member-state law requires it, in which case Outvoy will tell the Customer first unless that law forbids it. Outvoy will tell the Customer promptly if it believes an instruction infringes data protection law.

4. Confidentiality

Outvoy ensures that everyone authorised to process the personal data is bound by confidentiality obligations and accesses it only as needed to provide, support or secure the service.

5. Security

Outvoy implements the technical and organisational measures in Annex II, appropriate to the risk, as article 32 GDPR requires. Outvoy may update them as technology evolves, provided the overall level of security does not decrease.

6. Sub-processors

• The Customer gives Outvoy general authorisation to engage sub-processors. The current list is Annex III and the sub-processors page.
• Outvoy will notify the Customer (by email to its workspace owners and on that page) at least 30 days before engaging a new sub-processor or changing the purpose or location of an existing one. The Customer may object on reasonable data protection grounds within that period; if the parties cannot resolve it, the Customer may terminate the affected service and receive a refund of fees prepaid for the period after termination.
• Outvoy imposes on each sub-processor, by written contract, data protection obligations no less protective than this DPA, and remains liable to the Customer for its sub-processors' performance.

7. Data subjects' requests and assistance

• The service lets the Customer handle most requests itself: find a person's data through the console and API, remove them from lists, add them to the blocklist so they are never contacted again, erase one person from every record of the workspace (Delete lead in the console, or the API) — their sequences stop, their data is deleted and past events keep no personal details, with their profile kept on the blocklist as a suppression list unless the Customer chooses otherwise — export all workspace data and delete the workspace in Settings → Data.
• Where the Customer cannot do something itself, Outvoy will do it on the Customer's written request without undue delay.
• If Outvoy receives a request directly from a data subject about Customer Data, it will pass it to the Customer without undue delay and will not answer it itself, except to direct the person to the Customer.
• Taking into account the nature of the processing, Outvoy will reasonably assist the Customer with security, breach notifications, data protection impact assessments and prior consultations (articles 32 to 36 GDPR).

8. Personal data breaches

Outvoy will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Data, by email to its workspace owners. The notice will describe, as far as known, the nature of the breach, the categories and approximate number of people and records affected, the likely consequences and the measures taken or proposed. Outvoy will provide further information as it becomes available and take reasonable steps to contain the breach. Notifying a breach is not an admission of fault.

9. Return and deletion

The Customer can export all workspace data at any time in Settings → Data or through the API. When the Customer deletes its workspace, or the terms end, Outvoy deletes Customer Data from its live systems within 30 days, and it disappears from backups as they rotate, within a further 30 days, unless EU or member-state law requires Outvoy to keep part of it (in which case it stays protected by this DPA and is used for nothing else). On request, Outvoy will confirm the deletion in writing.

10. Information and audits

Outvoy will make available the information reasonably needed to demonstrate compliance with article 28 GDPR, including answers to security questionnaires and this DPA's annexes. Where that is not enough, the Customer (or an independent auditor bound by confidentiality and not a competitor of Outvoy) may audit Outvoy once a year, on at least 30 days' written notice, during business hours, without disrupting the service or accessing other customers' data, at the Customer's cost. Additional audits are allowed after a personal data breach or when a supervisory authority requires them.

11. International transfers

• Outvoy hosts Customer Data in the European Economic Area ({{HOSTING_LOCATION}}). Outvoy will only transfer it, or allow a sub-processor to transfer it, outside the EEA with safeguards under chapter V GDPR: an adequacy decision (including the EU–US Data Privacy Framework for certified recipients) or the Standard Contractual Clauses adopted by Commission Decision (EU) 2021/914.
• Where the Customer is outside the EEA and its data is processed by Outvoy in the EEA, no transfer from the Customer is needed for the processing itself; returning data to the Customer (exports, API, webhooks) is at the Customer's direction.
• For personal data subject to the UK GDPR, the International Data Transfer Addendum issued by the UK Information Commissioner applies to the Standard Contractual Clauses where a restricted transfer occurs.

12. Liability and precedence

Each party's liability under this DPA is subject to the limitations in the terms, except where the law does not allow them. If this DPA and the terms conflict on the processing of personal data, this DPA prevails; if the Standard Contractual Clauses apply and conflict with this DPA, the Clauses prevail.

13. Term and law

This DPA lasts as long as Outvoy processes Customer Data. It is governed by Spanish law, and disputes are submitted to the courts of the city of Madrid, Spain, except where the Standard Contractual Clauses require otherwise. Contact for anything under this DPA: {{CONTACT_EMAIL}}. Customers who need a countersigned copy can ask for one at that address.

Annex I — Details of the processing

Annex II — Technical and organisational measures

“In place” means the measure is implemented in the service today. “Commitment” means Outvoy undertakes to maintain it as part of this DPA.

Annex III — Sub-processors

Changes are announced on the sub-processors page under section 6.