Data processing agreement

This agreement is part of our terms. It applies when you use Outreach Desk to process personal data of other people (your leads, contacts, subscribers and customers), and explains what Outreach Desk (“we”) does with that data on your behalf.

1. Roles

You are the controller of the personal data you put into Outreach Desk or collect with it (for example through signup forms or a connected store). We are your processor: we process it only to provide the service to you.

2. What we process

• People: your leads, contacts, subscribers and customers.
• Data: what you import or collect: names, email addresses, the columns of your lists, consent records from signup forms, orders and carts from a connected store; and what the service records: emails sent, replies, bounces, unsubscribes and, if you turn tracking on, clicks and opens.
• Purpose and duration: to provide the service, for as long as your account exists, and then as set out in section 8.

3. Your instructions

We process the data only on your documented instructions, which are these terms and what you do in the app (importing, sending, setting up forms and automations). If we believe an instruction breaks data protection law, we will tell you.

4. Confidentiality

Everyone at Outreach Desk who can access the data is bound to keep it confidential. Our team looks at a workspace only to support you, to keep the service safe (for example reviewing a paused workspace), or when the law requires it, and every such look is logged.

5. Security

• Mailbox passwords, service keys and two-factor secrets are encrypted (AES-256-GCM); account passwords and backup codes are stored only as one-way hashes.
• All traffic uses HTTPS. Sessions are signed and can be ended per device; two-factor sign-in is available.
• Links in emails that record clicks or unsubscribes are signed so they can't be forged. Webhooks from the payment provider and online stores are checked against their signatures; other webhooks need a secret key in their address.
• Unsubscribes and bounces are honoured automatically and kept on a suppression list.

6. Sub-processors

You agree that we use the sub-processors listed on our sub-processors page. Each is bound by terms that protect the data at least as well as this agreement. We will update that page before adding a new one, and you may object; if we can't resolve it, you may end your use of the service.

7. Helping you

• People's rights: the app lets you find, export, correct and delete a person's data, and unsubscribe them. If a person contacts us about data you control, we will pass the request to you.
• Breaches: if we become aware of a personal data breach affecting your data, we will tell you without undue delay, with what we know and what we are doing about it.
• Assessments: we will give you the information you reasonably need for data protection impact assessments and consultations with authorities about the service.

8. Deletion

When you delete data in the app it is deleted (deleted leads stay in a trash for 30 days so you can undo it). When you delete your account, we delete your workspace, its data and files. Copies may remain in backups for a limited time before they are overwritten. Payment records are kept as long as accounting law requires.

9. Information and audits

We will answer reasonable questions about how we protect your data, and make available the information needed to show we comply with this agreement.

10. Transfers

Our sub-processors may process data outside your country. Where the law requires it, we rely on appropriate safeguards, such as standard contractual clauses.

Questions about this agreement, or need a signed copy? Write to burhanb53.work@gmail.com.