Legal
Data processing addendum
This data processing addendum ("DPA") is part of the Opptix Terms of Service between you, the customer, and BASE 1 MEDIA LIMITED, trading as BaseOne, company number 07293735, registered office 3rd Floor, 45 Albemarle Street, Mayfair, London W1S 4JL ("we"). It applies automatically when you accept the terms. It meets the requirements of Article 28 of the UK GDPR, and of the EU GDPR where that applies to you.
1. Roles
For customer personal data (defined below), you are the controller and we are your processor. You decide why and how it is used. We process it only to provide Opptix to you.
This DPA does not cover data we use as a controller, such as account and billing details, security logs, and the public business data we collect and provide to all customers. Our privacy notice covers those.
2. Details of the processing
| Customer personal data | Personal data you or your users add to Opptix, or that Opptix processes for you in your workspace. This includes the people you add to cards and Pipelines, contacts found through your own contact data account, emails and messages sent and received through your connected mailboxes and accounts, replies, notes, files, your do-not-email list, and recordings or transcripts of your voice sessions. |
|---|---|
| Subject matter and purpose | Providing Opptix: finding and checking opportunities, keeping your Pipeline, finding contacts, drafting, sending and reading messages, the Aria assistant, and support. |
| Nature of processing | Collecting, storing, organising, analysing with AI, drafting, sending, receiving, retrieving, exporting and deleting. |
| Categories of data subjects | Your prospects, customers, suppliers and other business contacts; your users; job seekers using their own workspace. |
| Types of personal data | Names, job titles, employers, work email addresses, phone numbers, social network profile links, the content of messages and notes, and any other data you choose to add. For job seekers, also CVs and application details. |
| Special category data | Not intended. You should not add it unless you have a clear lawful basis. |
| Duration | For the term of your use of Opptix, and until deletion under section 10. |
3. Your instructions
We process customer personal data only on your documented instructions. The Terms, this DPA, and how you set up and use Opptix are your instructions. If the law requires us to process it in another way, we will tell you first unless the law forbids it. If we think an instruction breaks data protection law, we will tell you.
4. Your duties
You are responsible for having a lawful basis for the customer personal data, for giving people the information the law requires, and for your outreach complying with UK GDPR, PECR and the laws of the places you contact. You must not instruct us to process data unlawfully.
5. Confidentiality
Everyone we allow to process customer personal data is bound by a duty of confidentiality. Our staff only access it where needed to run, secure or support the service. In job seeker workspaces, staff can read profiles and CVs only when the person allows it, and every look is logged.
6. Security
We take appropriate technical and organisational measures under Article 32, including:
- encryption in transit (TLS) for the app and the services it connects to;
- encryption at rest for passwords, API keys, mailbox credentials and other secrets;
- separation of each customer's workspace, with access checks on every request;
- roles within a workspace, two-step sign-in, and limits on sign-in attempts;
- logging of sign-ins, staff access and important changes;
- encrypted backups, and tested restore procedures;
- limiting staff access to those who need it.
We may update these measures as long as the overall level of protection does not go down.
7. Sub-processors
You give us general authorisation to use sub-processors. Our current sub-processors are listed on our sub-processors page. We will give you at least 30 days' notice of a new sub-processor by updating that page and telling account owners by email or in the app. You may object on reasonable data protection grounds within that time. If we cannot resolve your objection, you may end the service and we will refund any fees paid in advance for the period after it ends.
We put a written contract in place with each sub-processor with data protection duties no less protective than this DPA. We remain responsible to you for their performance.
8. International transfers
Our main servers are in the EU. Where customer personal data is transferred outside the UK or EEA, we make sure a lawful safeguard is in place: an adequacy decision (including the UK Extension to the EU-US Data Privacy Framework), the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses.
9. Helping you
- Requests from individuals. Opptix lets you find, export, correct and delete data in your workspace. If we receive a request about customer personal data, we will pass it to you and not answer it ourselves unless you ask us to.
- Breaches. We will tell you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting customer personal data. We will give you the information you reasonably need to meet your own duties, and take steps to contain it.
- Assessments. We will give reasonable help with data protection impact assessments and consultations with regulators, as far as they relate to Opptix.
10. Deletion and return
The workspace owner can download all workspace data from Settings at any time. When the owner deletes a workspace, it is deleted 14 days later. Copies in encrypted backups are overwritten within 13 months. We may keep data where the law requires, and payment records for accounting, and we will keep protecting it.
11. Audits
We will make available the information reasonably needed to show we meet this DPA. You may audit us, or appoint an independent auditor bound by confidentiality, once a year with at least 30 days' notice, or after a breach. Audits are at your cost, in working hours, and must not disrupt our service. We may first offer written answers or reports to meet the request.
12. General
The limits of liability in the Terms apply to this DPA. If this DPA and the Terms conflict about customer personal data, this DPA wins. This DPA is governed by the law of England and Wales. We may update it, and will give notice of material changes as set out in the Terms.
If you need a signed copy for your records, email [email protected].