Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the BIZLINKED Terms of service. It applies when you, the customer, process personal data of your prospects with BIZLINKED. It follows article 28 of the GDPR (Regulation (EU) 2016/679).

1. Roles

For prospect data (LinkedIn profiles, invitations, conversations, notes), you are the controller and BIZZY CONSULTING (KvK 42108017) is your processor. For your own account data, BIZZY CONSULTING is controller, as described in the Privacy policy.

2. Subject, duration, nature and purpose

• Subject and purpose: providing the BIZLINKED service — finding prospects, running your sequences, following your conversations, writing texts on your instruction.
• Duration: as long as your account is open, then until deletion (article 9).
• Nature: storage, organisation, reading, analysis, generation of texts, deletion.
• Data: public LinkedIn profile information (name, headline, location, photo, public posts), invitation and conversation status, the content of conversations read in your inbox, your notes.
• Data subjects: the professionals you prospect and the people who write to you on LinkedIn.
• Sensitive data: not expected; you must not use BIZLINKED to collect special categories of data.

3. Instructions

We process prospect data only on your documented instructions — your settings, your campaigns and your actions in the service — unless EU or Dutch law requires otherwise, in which case we inform you first unless the law forbids it. We tell you if we believe an instruction breaches the GDPR.

4. Confidentiality

Only people who need it to run or support the service can access prospect data. They are bound by a written duty of confidentiality. Support access to your workspace happens only at your request or to resolve an incident.

5. Security

We apply technical and organisational measures appropriate to the risk (GDPR art. 32), including: encrypted connections (HTTPS/HSTS); isolation of each customer's data by account; encrypted storage of API keys; sign-in by one-time code with brute-force protection; one installation of the extension per account; least-privilege access; logging; backups by our database provider; and regular security reviews.

6. Sub-processors

You give us general authorisation to use the sub-processors listed in section 4 of the Privacy policy (Supabase, Vercel, Brevo, Stripe, Google for sign-in, Anthropic for the AI included in your plan). We impose on them data protection obligations equivalent to this DPA and remain liable for them. Likewise, an AI assistant (ChatGPT, Claude) you connect yourself (by clicking « Allow access ») is not our sub-processor: you choose it, instruct the transfer and contract with it directly. We will inform you by email at least 30 days before adding or replacing a sub-processor that handles prospect data; you may object on reasonable grounds, and if we cannot accommodate the objection you may terminate and be refunded the unused part of any prepaid period. If you add your own API key, your AI provider (Anthropic or OpenAI) is not our sub-processor for those calls: you engage it directly with your own API key and your own agreement.

7. International transfers

The prospect database is stored in the EU (Ireland). Where a sub-processor processes data outside the European Economic Area, the transfer relies on an adequacy decision (including the EU–US Data Privacy Framework) or on the European Commission's Standard Contractual Clauses.

8. Assistance

• Rights of data subjects: we help you answer requests (access, deletion, objection…). On request we delete a given prospect's data from your account within 7 days.
• Personal data breach: we notify you without undue delay and at the latest within 48 hours after becoming aware of a breach affecting your prospect data, with the information available (nature, data and people concerned, likely consequences, measures taken), so that you can meet your own 72-hour obligation.
• Impact assessments and prior consultation: we provide the information reasonably needed.

9. End of the service

When your account is closed, you can export your data for 30 days; prospect data is then deleted, including from active systems, within 30 days, and from backups when they expire, unless the law requires us to keep it.

10. Audits

We make available the information needed to demonstrate compliance with this DPA. You may audit, yourself or through an independent auditor bound by confidentiality, once a year with 30 days' notice, or after a breach; audits are carried out during business hours without disrupting the service, at your cost unless the audit reveals a material breach on our part.

11. Your obligations

You are responsible for the lawfulness of your prospecting (legal basis, information of the people contacted, honouring their requests, respect of LinkedIn's rules and anti-spam laws) and for the instructions you give.

12. Order of precedence

In case of conflict between this DPA and the Terms, this DPA prevails for the processing of prospect data. Dutch law applies.

Contact for data protection: hello@bizlinked.app