The short version
- You are in control: we only use the data to run your campaigns, and only on your instructions.
- It is stored in the EU, and every sub-processor is bound by the same rules as we are.
- If there is a breach, we tell you without undue delay — within 48 hours at the latest.
- When the work ends, we delete the data or return it to you within 30 days.
Parties and scope
This data processing agreement (“DPA”) is between you, the client, and Curant AB. It is part of our Terms of service and applies whenever we process personal data on your behalf to deliver the outbound services you order from us.
- ControllerYou, the clientThe company named in your orderCalled “you” in this agreement
- ProcessorCurant ABKungsgatan 12, 111 35 StockholmOrg. no. XXXXXX-XXXXCalled “we” or “us”
For that data you are the controller, and we are your processor under GDPR Art. 28.
Some data we handle for our own purposes, and then we are the controller ourselves: our own sales and marketing, our client relationship with you, and our do-not-contact list — when someone asks not to be contacted, we keep what we need to respect that for every client. Our Privacy policy covers that data, not this agreement.
Words like personal data, processing, controller, processor and personal data breach mean what they mean in the GDPR: the EU General Data Protection Regulation (2016/679), together with the Swedish rules that supplement it.
What we process
Every data processing agreement must describe the processing (Art. 28(3)). Here is ours.
- Subject matter
- Personal data we need to deliver the outbound services you order: building prospect lists, phone, email and LinkedIn outreach, and booking meetings.
- Nature
- Collecting, storing, organising, looking up and updating data, contacting prospects, recording calls where you have switched recording on, sharing results with you, and deleting.
- Purpose
- To book qualified meetings for you and report on your campaigns. Nothing else.
- Duration
- For as long as we deliver services to you, and after that until the data is deleted or returned (see When the work ends).
Types of personal data
- Contact details: name, job title, company, work phone number and work email address.
- A link to their professional profile, such as LinkedIn.
- Call notes, the outcome of each call, and call recordings where recording is switched on.
- The email and LinkedIn messages we exchange with them for you.
- Meeting details: time, attendees and the briefing we pass on to your team.
- For your staff: name, work email and phone, calendar availability and user accounts for the client dashboard.
Whose data it is
- Prospects and contacts at the companies you want to reach.
- Your staff who take the meetings we book or use the client dashboard.
We do not ask for, and you should not send us, special categories of personal data (Art. 9, such as health or trade union membership), data about criminal offences, or personal identity numbers.
Your instructions
We process the personal data only on your documented instructions. Those are this agreement, the terms and your order, and the campaign briefs you approve (target market, lists, scripts and channels). New instructions are given in writing — email is fine.
If we believe an instruction breaks the GDPR or other data protection law, we tell you straight away, and we may pause that part of the work until you confirm or change it.
If the law requires us to process the data in some other way, we tell you before we do, unless that law forbids it.
As the controller, you are responsible for having a legal basis for the processing, for the lists and data you give us, and for telling us about restrictions we need to know, such as people who have objected to being contacted. You also decide whether calls are recorded.
Confidentiality and security
Everyone at our end who can access the data is bound by confidentiality, by contract or by law, and only gets the access their job needs.
We protect the data with technical and organisational measures that fit the risk (Art. 32). In particular, we:
- give access only to the people who work on your campaigns, and remove it when they no longer need it
- require multi-factor authentication on the tools that hold your data
- encrypt the data in transit and at rest
- log access to the systems that hold your data
- train our staff in data protection and safe handling when they start, and regularly after that
- delete data we no longer need for your campaigns on a regular schedule
- review and test these measures, and update them as threats and tools change
We may change the measures over time, but never in a way that lowers the overall level of protection.
Sub-processors and transfers
You give us general authorisation to use sub-processors. These are the ones we use today:
| Sub-processor | Service | Location |
|---|---|---|
| HubSpot | CRM | EU |
| Aircall | Calling platform | EU |
| Google Workspace | Calendar and e-mail | EU |
We tell you at least 30 days before we add or replace a sub-processor. Within that time you can object on reasonable data protection grounds. If we cannot find a solution together, you may end the part of the services that is affected.
Each sub-processor is bound by a written agreement with the same data protection obligations as this one. We remain responsible to you for how they process the data.
Transfers outside the EU
The data is stored in the EU. We transfer it outside the EU/EEA only when the GDPR allows it: to a country the EU has found to have adequate protection, or with appropriate safeguards such as the European Commission’s standard contractual clauses (SCCs), plus extra measures where they are needed. This also applies when a sub-processor’s staff access the data from outside the EU/EEA, for example for support.
Assistance and audits
We help you meet your own obligations under the GDPR, as far as we reasonably can given the nature of the processing and the information we have.
Requests from data subjects
If someone asks to see, correct or delete their data, or objects to how it is used, we help you answer with the information and tools we have. If the request comes to us, we pass it on to you without undue delay and do not answer it ourselves unless you ask us to.
One exception: if a person asks us not to contact them again, we stop at once on every channel, add them to our do-not-contact list within one business day and let you know.
Impact assessments and IMY
We help you with data protection impact assessments (Art. 35) and your other obligations under Art. 32–36, including a prior consultation with the Swedish Authority for Privacy Protection (IMY) when one is needed.
If you need help beyond what the services normally include, we agree the scope and any cost with you first.
Information and audits
On request, we give you the information you need to show that we meet our obligations under this agreement and Art. 28.
You, or an independent auditor bound by confidentiality, may audit us, including inspections, with at least 30 days’ notice, during business hours, at most once a year and at your cost. The limit does not apply after a personal data breach, or when a supervisory authority requires an audit.
Personal data breaches
If we become aware of a personal data breach affecting your data, we tell you without undue delay, and within 48 hours at the latest.
We give you what you need to report it to IMY and, where needed, to tell the people affected (Art. 33(3)):
- what happened, which categories of people and records are affected, and roughly how many
- the likely consequences
- what we have done, or propose to do, to deal with the breach and limit the harm
- a contact person who can answer your questions
If we do not have all the facts at once, we send what we know and follow up as we learn more. As the controller, you decide whether to report the breach to IMY and to the people affected.
When the work ends
This agreement applies for as long as we process personal data for you, even after the services themselves have ended.
When the services end, you choose whether we delete the personal data or return it to you. We do so within 30 days, and then delete any remaining copies.
We keep data only where the law requires us to, and only for as long as it requires; it stays protected as described here. Entries on our do-not-contact list are kept as set out in our Privacy policy.
On request, we confirm in writing that the data has been deleted.
Liability, precedence and law
Each party’s liability under this agreement follows the liability rules in the Terms of service, including their limits. That does not limit the rights of the people whose data it is under the GDPR.
If this agreement and the terms, or an order, say different things about personal data, this agreement applies.
We may update this standard agreement when the law, official guidance or our services change. We tell you about material changes before they apply, and we never lower the protection of your data without your agreement.
This agreement is governed by Swedish law, and disputes are settled by the Stockholm District Court.
Contact us
Use this address for instructions, objections to a sub-processor and anything else about this agreement. We send breach notices to the contact person you have given us.