Data processing agreement

"Data protection law" means the UK GDPR, the Data Protection Act 2018, and, where it applies to you, Regulation (EU) 2016/679.

"Customer personal data" means personal data contained in your book: the people, companies, notes, interactions, tasks, opportunities, events and connections you record in KnowWho.

"Controller", "processor", "data subject", "personal data", "processing" and "personal data breach" have the meanings given in data protection law.

Terms not defined here have the meaning given in the terms of service.

You are the controller of customer personal data. We are your processor.

You determine what goes into your book, what it says, how long it stays, and what it is used for. We hold it and process it on your instructions.

We are a separate controller for your account and billing data, which is governed by our privacy policy and not by this agreement.

We will process customer personal data only:

a) to provide the KnowWho service under the terms of service; b) on your further documented instructions, including those you give through the service itself; and c) where required by law, in which case we will tell you before processing unless the law prohibits us from doing so.

If we believe an instruction of yours breaches data protection law, we will tell you. We are not obliged to carry it out.

We will not sell customer personal data, share it for advertising, or use it to train artificial intelligence models.

Set out in Annex 1.

We will keep customer personal data confidential. Everyone we authorise to process it is bound by a duty of confidentiality, whether by contract of employment or otherwise, that survives the end of their engagement.

We limit access to those who need it to provide or support the service.

We will implement and maintain appropriate technical and organisational measures to protect customer personal data, as required by Article 32 of the UK GDPR.

Our current measures are set out in Annex 2. We may update them, and will not reduce the overall level of protection while this agreement is in force.

You give us general authorisation to appoint sub-processors. Our current sub-processors are listed in Annex 3.

Before we add or replace a sub-processor we will give you at least 30 days' notice, by email to your account address or by a notice in the service. If you reasonably object on data protection grounds within that period, we will work with you to find a solution. If we cannot, you may terminate the affected part of the service and we will refund any fees you have paid for a period you have not used.

Every sub-processor is bound by written terms no less protective than this agreement. We remain fully liable to you for their performance.

The service lets you access, correct and delete customer personal data yourself, through your assistant, and lets your owners and admins export all of it as one file. That will usually be enough to answer a data subject request without involving us.

Where it is not, we will assist you, taking into account the nature of the processing and the information available to us.

If a data subject contacts us directly about customer personal data, we will not respond substantively. We will route the request to you and tell the data subject that we have done so, unless the law requires otherwise.

If we become aware of a personal data breach affecting customer personal data, we will notify you without undue delay and in any event within 48 hours.

Our notification will describe the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, the measures we have taken or propose to take, and a contact point for further information. Where we cannot provide all of that at once, we will provide it in stages without undue delay.

We will assist you with your own notification obligations to the Information Commissioner's Office and to data subjects.

Taking into account the nature of the processing and the information available to us, we will provide reasonable assistance with data protection impact assessments and any prior consultation with a supervisory authority.

Your owners and admins can export your data at any time through the service, as one machine-readable file.

On termination of the service, or on your written request, we will delete customer personal data within 30 days, and from automatic backups within a further 30 days, unless the law requires us to keep it. Where the law requires us to keep it, we will keep it only for as long as required and will continue to protect it under this agreement.

We will confirm deletion in writing if you ask.

We will make available the information reasonably necessary to demonstrate our compliance with Article 28 of the UK GDPR, and will contribute to audits conducted by you or an auditor you appoint.

Audits must be at reasonable notice of at least 30 days, no more than once in any 12 months unless required by a supervisory authority or following a personal data breach, during business hours, and must not unreasonably disrupt our operations. The auditor must sign a reasonable confidentiality agreement.

Where a recognised certification or report addresses the question, providing it satisfies this clause.

We will not transfer customer personal data outside the United Kingdom or the European Economic Area unless an appropriate transfer mechanism is in place under data protection law.

Where a transfer is made to a country without an adequacy decision, it is protected by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or by the EU Standard Contractual Clauses, as applicable, which are incorporated into this agreement by reference.

The location of each sub-processor is stated in Annex 3.

You warrant that:

a) you have a lawful basis for the personal data you record in KnowWho, and for our processing of it on your instructions; b) you have met your own transparency obligations to the people whose data you record, including under Article 14 of the UK GDPR where their data was not collected from them directly; c) your instructions comply with data protection law; and d) you will not record special category data, criminal offence data, or the personal data of children in KnowWho.

You acknowledge that KnowWho is built for business relationship information and is not designed to hold the categories in (d).

Liability under this agreement is subject to the limitations and exclusions in section 10 of the terms of service, including the separate limit in clause 10.4 that applies to claims relating to data protection and the security of personal data.

If there is a conflict between this agreement and the terms of service on the processing of customer personal data, this agreement takes precedence.

We may update this agreement where needed to reflect changes in law, sub-processors, or the service. Material changes will be notified to you at least 30 days in advance.

This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Subject matter. Provision of the KnowWho relationship management service.

Duration. For as long as your KnowWho account is open, plus the deletion periods in clause 11.

Nature and purpose. Storing, organising, indexing, retrieving, returning and exporting the information you record about your business contacts, so that it can be recalled by you and your colleagues through an AI assistant of your choosing, and viewed in the KnowWho app.

Types of personal data. Names, email addresses, phone numbers, dates of birth, LinkedIn profiles, employers, job titles, tags, and any other information you choose to record about a person, including free text notes, records of meetings and conversations, event attendance, commitments, and connections between people and organisations.

Categories of data subjects. Your business contacts, prospects, customers, suppliers and professional network, and your own personnel who use the service.

Special category data. Not permitted under clause 14(d).

Access control

• Access to production systems restricted to personnel who require it
• Multi-factor authentication required for production access
• Access reviewed on joining, role change and leaving

Tenant isolation

• Every account's data is logically isolated from every other account
• Isolation is enforced on every request at the data access layer, rather than inferred from an authentication token

Encryption

• All data encrypted in transit using TLS
• All data encrypted at rest by our infrastructure providers

Authentication

• Customer authentication handled by a specialist identity provider
• Connector authorisation by OAuth 2.0, with no long-lived shared secrets held by the customer

Logging and monitoring

• Service events logged as the fact of a request, the tool invoked, the acting user and organisation, the assistant client, the outcome and the duration
• Tool parameters and response contents are not logged on success; on failure, only the shape of the parameters (field names and types) is recorded
• Errors logged with a reference identifier for support. Error text is retained as received and may contain fragments of the data that caused the failure. Deleted after 90 days.
• Records of connecting clients deleted 90 days after last use; the record that a tool ran, with no content, kept while the account is open
• The hosting provider's own copy of service logs deleted after 7 days

Resilience

• Automatic backups: daily snapshots of the graph database and continuous point-in-time recovery of the account database, each retained for up to 30 days
• Documented restoration process

Organisational

• Confidentiality obligations on all personnel
• Written terms with all sub-processors
• Breach response process with the notification timetable in clause 9

Planned: Voyage AI (MongoDB, Inc.), United States, for text embedding when search by meaning launches. It is not appointed and receives no data today; it will be added under clause 7, with at least 30 days' notice, before any is sent.

The current list is maintained at knowwhocrm.com/dpa.