Data Processing Addendum (DPA) for Customers

This Data Processing Addendum (“DPA”) is part of the Terms of Service (the “Terms”) between CargoScope LLC (“SalesScope”, “we”, “us”) and the customer that holds the SalesScope account (“Customer”, “you”). It applies whenever we process Customer Personal Data, and it takes effect when you accept the Terms. A countersigned copy is available on request from legal@salesscope.io.

1. Definitions used in this DPA

Data Protection Laws: All laws on data protection and privacy that apply to the processing of Customer Personal Data under the Terms, including the EU General Data Protection Regulation 2016/679 (“GDPR”); the GDPR as it forms part of UK law, together with the UK Data Protection Act 2018 (“UK GDPR”); the Swiss Federal Act on Data Protection (“FADP”); the California Consumer Privacy Act as amended (“CCPA”) and other US state privacy laws; and India’s Digital Personal Data Protection Act, 2023.
Customer Personal Data: Personal data within Customer Data, as the Terms define it, that we process on your behalf.
Subprocessor: A third party we engage to process Customer Personal Data.
Personal Data Breach: A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data that we process.
SCCs: The standard contractual clauses annexed to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021.

“Controller”, “processor”, “data subject”, “personal data”, “processing” and “supervisory authority” have the meanings given in the GDPR. “Business”, “service provider”, “contractor”, “sell” and “share” have the meanings given in the CCPA.

2. Roles of the parties

For Customer Personal Data, you are the controller, or a processor acting for your own clients, and CargoScope LLC is your processor or subprocessor. Under US state privacy laws, we are your service provider or contractor.

We are a controller only for the account, billing, website and early-access data that our Privacy Policy describes, and this DPA does not apply to that data.

You are responsible for the lawfulness of the Customer Personal Data you give us and of your instructions, including having a lawful basis for collecting the data and for the outreach you run through SalesScope, and for giving data subjects the notices the law requires.

3. Scope and instructions

We process Customer Personal Data only on your documented instructions, unless the law requires otherwise. In that case, we will tell you before processing, unless that law forbids it. Your instructions are:

the Terms and this DPA;
your configuration and use of SalesScope, such as connecting a mailbox, importing contacts, scheduling a sequence or deleting a record; and
any other reasonable written instructions you give us that are consistent with the Terms.

We will tell you if, in our opinion, an instruction infringes Data Protection Laws. Annex I describes the processing.

We will not sell or share Customer Personal Data. We will not retain, use or disclose it for any purpose other than providing the Service and the other purposes Data Protection Laws allow a processor or service provider (such as security, debugging and legal compliance), or outside our direct business relationship with you. We will not combine it with personal data we receive from anyone else, except as those laws allow. We will comply with the CCPA where it applies, provide the level of privacy protection it requires, and tell you if we can no longer meet our obligations under it, in which case you may take reasonable steps to stop and remedy any unauthorized processing.

4. Confidentiality of personnel

Everyone we authorize to process Customer Personal Data is bound by a duty of confidentiality, by contract or by law, and has access only to the extent their role requires.

5. Security measures

We implement and maintain the technical and organizational measures in Annex II to protect Customer Personal Data against Personal Data Breaches, at a level appropriate to the risk. We may update these measures over time, provided the overall level of protection does not decrease.

You are responsible for the security settings under your control, such as user roles, whether exporting is switched on, which mailboxes are connected, and your users’ passwords.

6. Subprocessors

General authorization. You give us general authorization to engage Subprocessors. The current list, with each Subprocessor’s purpose, the data it receives and its location, is on our subprocessors page, which forms Annex III.
Our obligations. We impose on each Subprocessor, in a written contract, data protection obligations that give at least the same level of protection as this DPA, to the extent they apply to the services it provides. Public DNS services, which receive only domain names, are bound by their published privacy terms. We remain responsible to you for each Subprocessor’s performance.
Notice of changes. We give notice of a new or replacement Subprocessor at least 14 days before it starts processing Customer Personal Data, by updating the subprocessors page and by emailing the account admins who have asked to be notified. To ask, write to legal@salesscope.io. In an emergency, such as replacing a failed provider to keep the Service running or secure, we may make a change sooner and will give notice as soon as we can.
Right to object. You may object to a new Subprocessor on reasonable data protection grounds by writing to legal@salesscope.io within the notice period. We will discuss your concerns in good faith and look for a solution. If we cannot resolve your objection within 30 days, you may end the Terms by written notice before the Subprocessor processes your data.

7. Assistance with data subject requests and DPIAs

Taking into account the nature of the processing, we will help you, by appropriate technical and organizational measures where possible, to respond to requests from data subjects who exercise their rights. You can do much of this yourself in SalesScope, by editing, deleting or exporting contacts and by adding addresses to your suppression list.

If a data subject contacts us directly about Customer Personal Data, we will not answer the request ourselves, except to tell them we have passed it to you, and we will forward it to you promptly. You instruct us that, when a person asks us directly to stop receiving your emails, we may add their address to your workspace’s suppression list and let you know.

We will also give you reasonable help, taking into account the nature of the processing and the information available to us, with data protection impact assessments and prior consultations with supervisory authorities that relate to the Service, and with your other obligations under Articles 32 to 36 GDPR. We may charge reasonable costs for help that goes beyond what the Service and our standard documentation provide.

8. Personal Data Breach notification

We will notify you without undue delay, and in any case within 72 hours, after becoming aware of a Personal Data Breach. We send the notice by email to the account’s admins. As far as we know at the time, it will describe:

the nature of the breach, including the categories and approximate number of data subjects and records concerned;
its likely consequences;
the measures we have taken or propose to take to address it and limit its effects; and
who to contact for more information.

Where we cannot give all the information at once, we will provide it in stages without undue delay. We will take reasonable steps to contain, investigate and remedy the breach. Unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, such as pings, port scans or failed sign-in attempts, are not Personal Data Breaches. Notifying you of a breach is not an admission of fault or liability.

9. Return and deletion

While your account is open, you can export Customer Personal Data from SalesScope at any time, and we will help with an export in a common format such as CSV if you ask before the account is closed. When the Terms end or your account is closed, we delete Customer Personal Data from our live systems within 30 days, unless the law requires us to keep it. Copies in backups are deleted as the backups roll off on their own schedule; until then they are kept secure and used only for backup and restoration. On request, we will confirm the deletion in writing.

10. Audits

On request, we will make available the information reasonably needed to demonstrate our compliance with this DPA and Article 28 GDPR. That includes answers to reasonable security questionnaires, summaries of our policies, and our Subprocessors’ audit reports or certifications where they allow us to share them.

If that information is not enough to demonstrate compliance, or a supervisory authority requires it, you may audit our compliance, including by an on-site inspection, on these conditions:

no more than once a year, unless there has been a Personal Data Breach or a supervisory authority requires more;
at your cost, with at least 30 days’ written notice, during business hours, and without unreasonably disrupting our business;
by you or by an independent auditor who is not our competitor, bound by confidentiality; and
you give us a copy of the audit report.

Our Subprocessors are audited through their own audit reports and certifications. Audits under the SCCs are carried out in line with this section.

11. International transfers

We and our Subprocessors may process Customer Personal Data in the United States and in the other countries listed on the subprocessors page. Where a transfer of Customer Personal Data is a restricted transfer under Data Protection Laws, the following are incorporated into this DPA by reference:

Transfers from the EEA. The SCCs, with Module Two (controller to processor) where you are a controller, and Module Three (processor to processor) where you are a processor. You are the data exporter and CargoScope LLC is the data importer. Clause 7 (the docking clause) applies. Under Clause 9(a), Option 2 (general written authorization) applies, with the notice period in section 6 of this DPA. The optional wording in Clause 11(a) does not apply. The competent supervisory authority is the one determined under Clause 13. Under Clause 17, the SCCs are governed by the law of Ireland, and under Clause 18(b), disputes are resolved by the courts of Ireland. Annexes I to III of this DPA complete the Appendix to the SCCs.
Transfers from the UK. The International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0, in force 21 March 2022), incorporating the SCCs as set out above. Tables 1 to 3 are completed with the information in this DPA and its Annexes, and in Table 4 either party may end the Addendum as its Section 19 allows.
Transfers from Switzerland. The SCCs as set out above, with these changes: references to the GDPR are to be read as references to the FADP as far as the transfers are subject to it; the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for those transfers; and the term “member state” must not be read in a way that prevents data subjects in Switzerland from bringing claims in their place of habitual residence under Clause 18(c).

If the SCCs or the UK Addendum are replaced or found invalid, we will work with you to put another lawful transfer mechanism in place.

12. Liability

Each party’s liability arising out of or relating to this DPA, including the SCCs as far as the SCCs and the law allow, is subject to the exclusions and limitations of liability in the Terms. Nothing in this DPA limits either party’s liability to data subjects under the SCCs, or any liability that Data Protection Laws do not allow to be limited.

13. Order of precedence and term

If documents conflict, this order applies, with the first prevailing: the SCCs and the UK Addendum, where they apply; then this DPA; then the Terms. In all other respects the Terms apply unchanged, including their governing law and venue, except where the SCCs require otherwise. This DPA lasts for as long as we process Customer Personal Data, and the provisions that by their nature should survive do so.

Annex I: Details of processing

A. List of parties

Data exporter: the Customer named in the SalesScope account. Contact: the account’s admins. Activities: using SalesScope as the Terms describe. Role: controller, or processor on behalf of its own clients.

Data importer: CargoScope LLC, a Georgia (USA) limited liability company. Contact: legal@salesscope.io, or privacy@salesscope.io for data protection questions. Activities: providing SalesScope. Role: processor, or subprocessor.

Each party is treated as having signed this Annex when the Customer accepts the Terms.

B. Description of the processing

Categories of data subjects: The Customer’s prospects, contacts and customers, and the people who work at them or reply on their behalf; and the Customer’s users, meaning its employees and contractors who use SalesScope.
Categories of personal data: Names; business email addresses; phone and mobile numbers; company, job title and other job details; business addresses, city, country and time zone; website and social profile links; tags, notes, pipeline stages, tasks, meetings and call outcomes; the content of emails sent and received through connected mailboxes; email engagement events (opens, clicks, replies, bounces, auto-replies and unsubscribes), with their times and user-agent strings; address-check results; for users, names, email addresses, roles and activity records; and any other personal data the Customer chooses to add, for example in custom columns.
Sensitive data: None intended. Under the Terms, the Customer does not put special categories of personal data or other sensitive data into SalesScope. The measures in Annex II apply to all data.
Frequency of the transfer: Continuous, for as long as the Customer uses SalesScope.
Nature of the processing: Hosting and storage; organizing, structuring and displaying contact records; sending email through connected mailboxes, which for Outlook.com and Microsoft 365 means saving each email as a draft in the mailbox and then sending it; reading connected Gmail, Google Workspace, Outlook.com and Microsoft 365 mailboxes to find replies, bounces and auto-replies to email sent through SalesScope; recording email engagement; checking email addresses and their domains, including DNS lookups of domain names; scheduling, reminders and reporting; and backup, security and support.
Purpose: Providing SalesScope to the Customer under the Terms: running the Customer’s sales outreach and records, protecting deliverability and security, and supporting the Customer.
Duration and retention: For the duration of the Terms. During that time, the Customer decides how long data is kept by editing and deleting it in SalesScope. After the account is closed, data is deleted from live systems within 30 days, and from backups as they roll off on their own schedule.
Transfers to Subprocessors: As Annex III describes, for the subject matter, nature and duration set out above.

C. Competent supervisory authority

The supervisory authority determined under Clause 13 of the SCCs; for transfers from the UK, the Information Commissioner; for transfers from Switzerland, the Federal Data Protection and Information Commissioner.

Annex II: Technical and organizational measures

Encryption in transit. Every connection to SalesScope uses TLS (HTTPS with HSTS), and plain HTTP is redirected. Connections to our database, our Subprocessors and mail providers use TLS, and SMTP mailboxes must support STARTTLS.
Encryption at rest. The database and its backups are encrypted at rest by our database provider. Mailbox OAuth tokens and SMTP passwords are also encrypted with AES-GCM, using a 256-bit key, before they are stored, so a copy of the database on its own gives no access to any mailbox.
Separation between customers. Every database table is protected by row-level security tied to workspace membership. Each row belongs to one workspace and cannot reference rows in another.
Access control within an account. Roles (admin, manager and member) are enforced in the database, not only in the interface. Admins can switch off exporting and deleting for everyone, and a removed user’s sessions are revoked.
Least-privilege access. Database credentials that bypass row-level security are held only by SalesScope’s server code, never by browsers. Access to production systems is limited to the staff who need it, and the accounts that administer our infrastructure use multi-factor authentication.
Application security. A strict Content-Security-Policy, no third-party scripts, and security headers on every response; passwords of at least 12 characters; rate limits on sensitive actions; and tracking and unsubscribe links that use unguessable tokens for each recipient.
Logging and monitoring. Server and error logs with query strings redacted; an audit record of administrative actions in each account; and monitoring of sending health, such as bounce rates and provider holds.
Backups and resilience. Automated database backups by our database provider; queued work that is retried safely without sending twice; and a company-wide emergency stop for sending.
Data minimization. The inbox sync starts from the moment a mailbox is connected, imports no older mail, and keeps only replies, bounces and auto-replies to email sent through SalesScope. Address checks send only domain names to DNS services. The app’s browser cache is removed when a user signs out.
Change management. Code changes are checked in continuous integration, with dependency audits, a secret scan, type checks and automated tests, and database changes are applied as versioned migrations.
Personnel. Confidentiality obligations, and access on a need-to-know basis.
Incident response. Breaches are handled and notified as section 8 describes. Vulnerability reports go to security@salesscope.io.
Subprocessors. Chosen with their security in mind and bound by written data protection terms, as section 6 describes.

Annex III: Subprocessors

The Subprocessors authorized under this DPA, with their purpose, the data they process and their location, are listed on our subprocessors page. We update that page at least 14 days before a new Subprocessor starts processing Customer Personal Data, except in an emergency, as section 6 describes.

Questions about this DPA, or a request for a countersigned copy: legal@salesscope.io.