Data Processing Agreement

About this Agreement

This Data Processing Agreement (“DPA”) governs the data protection relationship between Scalelist and its Users in the context of the enrichment services provided through the platform. It applies to B2B Customers subscribing to Scalelist’s platform.

Scalelist is a service operated by TGID Export Pte. Ltd., a company incorporated in Singapore, of 21 Collyer Quay, #02-01, Singapore 049320, UEN 201903371H. In this DPA, “Scalelist” refers to TGID Export Pte. Ltd.

This DPA is incorporated by reference into the Terms of Service accepted by the User upon subscribing to Scalelist’s platform, and prevails in the event of any inconsistency between its provisions and those of the Terms of Service in respect of the processing of personal data.

Scalelist’s processing of personal data in its own capacity as data controller is described in the Privacy Policy.

A countersigned copy of this DPA is available to Users on request at privacy@scalelist.com.

Capacities in which Scalelist acts

Depending on the processing activity, Scalelist acts in different capacities:

• As a Data Controller for the constitution and maintenance of its own professional contact database (the “Lead Database”), and for the supply of data from that database to Users. In this capacity Scalelist independently determines the purposes and means of processing and bears full responsibility for compliance with applicable data protection law. Upon receipt of such data, the User acts as an independent data controller.
• As a Data Processor within the meaning of Article 28 of the GDPR for the enrichment of contact data submitted by Users, carried out on behalf of and on the instructions of the User, who acts as data controller and is solely responsible for ensuring that its use of the enriched data complies with applicable data protection law.

1. PURPOSE

The purpose of this DPA is to describe the personal data processing operations carried out by Scalelist on behalf of the User in the context of the enrichment services, and to constitute the data processing agreement between the parties within the meaning of Article 28 of the GDPR.

2. DEFINITIONS

Terms not otherwise defined in this DPA shall have the meanings given to them in the GDPR and, where applicable, in the UK GDPR and in the Singapore Personal Data Protection Act 2012.

“Applicable Data Protection Law” means all laws relating to the processing of personal data applicable to the parties.

“User Data” means the personal data submitted by the User to Scalelist for the purposes of the enrichment services, together with the enriched results returned to the User in respect of that data.

“Sub-processor” means any third party engaged by Scalelist to process User Data.

3. DESCRIPTION OF PROCESSING ACTIVITIES

3.1 Scalelist as Data Controller: Constitution of the Lead Database

In its capacity as data controller, Scalelist independently constitutes and maintains its Lead Database by collecting and aggregating professional contact data from publicly available sources and third-party data providers, and by inference from email address formats associated with company domains. Scalelist independently determines the purposes and means of this processing, which is governed by the Privacy Policy. The Lead Database constituted by Scalelist in this capacity serves as one of the sources from which enrichment data is drawn when performing the enrichment services described in Section 3.2 below.

3.2 Scalelist as Data Processor: Enrichment of User-submitted data

In its capacity as data processor, Scalelist processes personal data submitted by the User as follows:

3.3 Separation of User Data from the Lead Database

Scalelist shall not incorporate User Data into the Lead Database. User Data shall not be disclosed or otherwise made available to any other User, and shall not be contributed to any shared or community dataset.

From the performance of the enrichment services, Scalelist retains only the email address format associated with a company domain, by way of example, that a given domain uses the format first.last@. Address formats of this kind relate to organisations and not to identified or identifiable individuals, and are retained by Scalelist as its own asset.

3.4 User as Data Controller: Use of enriched data

Upon receipt of the enriched data, the User acts as an independent data controller and is solely responsible for ensuring that its subsequent use of such data, including any commercial prospecting, outreach or recruitment activities carried out on the basis of such data, complies with applicable data protection law, including the GDPR and applicable national electronic marketing regulations. The obligations of the User in this capacity are set out in Section 6 of this DPA.

4. INSTRUCTIONS

Scalelist processes User Data solely in accordance with the User’s documented instructions, which consist of:

• receiving the contact data submitted by the User to the platform;
• enriching the User’s contact records by reference to Scalelist’s systems, its inference engine and, where applicable, its third-party providers;
• returning the enriched results to the User and retaining them within the User’s account;
• in the Leads Finder feature only, responding to requests submitted by the User concerning the contents of a list held within their account, including by transmitting contact data from that list to an artificial intelligence model provider to the extent necessary to respond to the request.

Scalelist shall not process User Data for any purpose other than those listed above.

Where Scalelist considers that an instruction from the User infringes the GDPR or any other applicable data protection law, it shall immediately inform the User thereof. Where Scalelist is required by applicable law, including European Union or Member State law, to process personal data otherwise than in accordance with the User’s documented instructions, it shall inform the User of that legal requirement before processing, unless such notification is prohibited on important grounds of public interest.

5. OBLIGATIONS OF SCALELIST AS DATA PROCESSOR

Scalelist undertakes to:

a) process User Data solely for the purposes of the enrichment services described in Section 3.2 of this DPA, and only in accordance with the User’s documented instructions;

b) guarantee the confidentiality of User Data, and ensure that its affiliates, officers, directors, agents and employees authorised to process such data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and have received appropriate data protection training;

c) take into consideration, in terms of its tools, products, applications and services, the principles of data protection by design and by default;

d) assist the User, by appropriate technical and organisational measures, in fulfilling its obligations to respond to requests for exercising data subjects’ rights, including the right of access, rectification, erasure, objection, restriction of processing, data portability, and the right not to be subject to automated individual decision-making (including profiling). Upon receipt of any such request, Scalelist undertakes to forward the request to the User and refrain from responding to the substance of the request, unless expressly instructed to do so by the User in writing. Upon written confirmation from the User that an erasure or objection request has been validated, Scalelist shall add the relevant data subject to its suppression list to ensure that their data is not reintroduced into the Lead Database or made available to any other User;

e) assist the User regarding compliance with its obligations pursuant to Articles 32 to 36 of the GDPR, including obligations relating to security, notification of personal data breaches to the supervisory authority and/or to data subjects, data protection impact assessments, and prior consultation of the supervisory authority;

f) implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as further described in Section 9 of this DPA;

g) notify the User without undue delay, and where feasible within 48 hours, upon becoming aware of any personal data breach, together with any necessary documentation to enable the User, where required, to notify the breach to the competent supervisory authority in accordance with Article 33 of the GDPR. Such notification shall describe, so far as known at the time, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a point of contact for further information. Scalelist shall not notify any supervisory authority or data subject in respect of a breach affecting User Data on the User’s behalf, unless required to do so by applicable law or instructed in writing by the User;

h) maintain a written record of all categories of processing activities carried out on behalf of the User, in accordance with Article 30(2) of the GDPR;

i) engage sub-processors only in accordance with Section 7 of this DPA;

j) provide the User with all necessary documentation to demonstrate compliance with its obligations under this DPA, and submit to audits in accordance with Section 11 of this DPA.

6. OBLIGATIONS OF THE USER AS DATA CONTROLLER

The User, acting as an independent data controller in respect of the data it submits and of its use of the enriched data, bears sole responsibility for ensuring that such use complies with applicable data protection law. Scalelist shall bear no liability for any non-compliance by the User with its obligations as data controller, including any claim, complaint, investigation or sanction by a supervisory authority arising from the User’s own use of the enriched data.

In this capacity, the User warrants and undertakes to:

a) Lawfulness of submitted data: Ensure that the personal data submitted to Scalelist has been collected lawfully, and refrain from submitting data containing special categories of personal data within the meaning of Article 9 of the GDPR, data relating to criminal convictions and offences, or data relating to minors;

b) Ensure a valid legal basis: Identify and document a valid legal basis under Article 6 of the GDPR for the submission of data to Scalelist and for any subsequent use of the enriched data;

c) Comply with applicable law: Ensure that its use of the enriched data complies with the GDPR, applicable national electronic marketing regulations in each jurisdiction in which data subjects are located, and any other applicable data protection law, including in particular the obligation to inform data subjects at the time of first contact in accordance with Article 14 of the GDPR, and to identify Scalelist as a source where requested to do so by a recipient of its communications. The User acknowledges that it is solely responsible for identifying and complying with country-specific rules, including jurisdictions requiring prior consent for B2B outreach and jurisdictions operating do-not-call registries, including under the Singapore Personal Data Protection Act 2012;

d) Honour objections: Give effect to any opt-out or objection received from a recipient of its communications, and refrain from re-submitting data relating to a person who has objected;

e) Security and breach notification: Implement appropriate technical and organisational measures to protect the enriched data against unauthorised access, loss or disclosure, and notify Scalelist without undue delay in the event of a personal data breach affecting enriched data received from Scalelist.

6.1 Users acting on behalf of their own customers

Where the User accesses the services on behalf of its own customers, the User warrants that it has a valid legal basis and documented instruction from each such customer to submit their data to Scalelist, and that it has concluded a data processing agreement with them.

Results returned to a User may be used only for the customer on whose behalf the request was made. The User shall not retain or reuse such results in order to serve any other customer, and shall not represent Scalelist’s data as its own proprietary database, save under a separate written agreement with Scalelist.

7. SUB-PROCESSORS

7.1 General authorisation

By accepting the Terms of Service, the User grants Scalelist general written authorisation, within the meaning of Article 28(2) of the GDPR, to engage sub-processors for the performance of the services.

7.2 Published sub-processors

The list of Scalelist’s general sub-processors, including hosting, infrastructure, billing, communication and support providers, is published at scalelist.com/sub-processors, specifying for each its identity, location, processing activity, categories of personal data processed and the applicable transfer mechanism.

7.3 Data providers: confidential list

In connection with the provision of the enrichment services, Scalelist engages specialist providers in the categories set out at scalelist.com/sub-processors, namely contact data providers and email verification providers.

The complete nominative list of such providers, including the identity, location and applicable transfer mechanism of each, constitutes confidential information and a trade secret of Scalelist, protected as such under the law of Singapore and under the confidentiality provisions of the Terms of Service. The identity, selection and ordering of these providers is a material element of the Service and of Scalelist’s competitive position.

That list shall be communicated to the User upon written request to privacy@scalelist.com, within five business days, subject to the prior execution of a non-disclosure agreement. The User undertakes not to disclose that list, or the information contained in it, to any third party, and to use it solely for the purpose of verifying Scalelist’s compliance with applicable data protection law.

7.4 Notification and right of objection

Should Scalelist wish to engage a new sub-processor to carry out specific processing activities on behalf of the User, it shall notify the User at least 15 days in advance, allowing the User to object to such engagement, on reasonable data protection grounds, before it takes effect. Such objection shall not be unreasonably exercised, and the parties shall discuss any objection in good faith.

This notification and objection mechanism applies in full to the providers referred to in Section 7.3. The User shall be notified of any change no fewer than 15 days before it takes effect, even where the identity of the new provider is communicated only under non-disclosure agreement.

Where a change of sub-processor is necessary in order to maintain the continuity or security of the services, including where an existing sub-processor ceases to provide the service, materially breaches its obligations, or presents a security or availability risk, Scalelist may engage a replacement without prior notice, and shall notify the User as soon as reasonably practicable thereafter. The User’s right to object under this Section applies from the date of that notification.

7.5 Guarantees

Scalelist undertakes to engage only sub-processors that provide sufficient guarantees to implement appropriate technical and organisational measures ensuring that their processing meets the requirements of the GDPR and protects the rights of data subjects.

Scalelist shall ensure that a written and binding contract is in place with each sub-processor, imposing the same data protection obligations as those set out in this DPA. Scalelist shall remain fully liable to the User for the performance of its sub-processors’ obligations.

Scalelist warrants that each provider referred to in Section 7.3 (a) is contractually bound by data protection obligations substantially equivalent to those set out in this DPA, (b) is located within the EEA or is covered by a transfer mechanism compliant with Chapter V of the GDPR, and (c) processes personal data solely within the scope of Scalelist’s instructions and solely for the purposes of the enrichment services.

8. DATA TRANSFERS OUTSIDE THE EUROPEAN ECONOMIC AREA

Transfers of personal data between the parties in the context of the enrichment services are carried out on the basis of the Standard Contractual Clauses adopted by the European Commission on 4 June 2021 (Commission Implementing Decision 2021/914)Module 2 (Controller to Processor), applicable to transfers of personal data from EEA-based Users to Scalelist in Singapore, and to the restitution of enriched data from Scalelist to the User.

For the purposes of the Standard Contractual Clauses:

• the User is the data exporter and Scalelist is the data importer;
• the optional docking clause applies;
• Annex I is completed by Annex 1 of this DPA;
• Annex II is completed by Section 9 of this DPA;
• Annex III is completed by the list of sub-processors referred to in Section 7 of this DPA;
• the competent supervisory authority, for the purposes of Annex I.C, is that of the EEA Member State in which the data exporter is established.

The Clauses shall be governed by the law of Ireland, and any dispute arising from the Clauses shall be resolved by the courts of Ireland.

The SCCs are incorporated by reference into this agreement. By accepting the Terms of Service, each party automatically becomes a party to the applicable SCCs. The parties agree to execute any additional documentation required to give effect to the SCCs upon request. A copy of the applicable SCCs is available upon request at privacy@scalelist.com.

Where the recipient is established in the United Kingdom, the UK International Data Transfer Addendum applies in addition.

Where the User is established outside the EEA, the User is responsible for ensuring that appropriate safeguards are in place for any onward transfer of personal data in accordance with Chapter V of the GDPR.

9. SECURITY

Scalelist implements and maintains technical and organisational measures appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing, including in particular:

• (i) encryption of personal data in transit and at rest, and pseudonymisation where technically possible;
• (ii) an authentication system protecting access to Scalelist platform accounts, and irreversible hashing of login credentials;
• (iii) role-based access control, limiting access to personal data to authorised personnel on a need-to-know basis, subject to confidentiality obligations;
• (iv) audit logging of access to personal data;
• (v) separation of development and production environments;
• (vi) rate limiting and access controls on public interfaces;
• (vii) data minimisation by design, whereby contact data is masked by default and disclosed only upon an explicit, individually authorised and logged action by a User;
• (viii) the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
• (ix) the ability to restore the availability of and access to personal data in a timely manner in the event of a physical or technical incident.

A detailed schedule of these measures may be obtained by the User on request at privacy@scalelist.com and will be provided within five business days.

Scalelist reviews these measures periodically and may update them, provided that the level of security is not thereby materially reduced.

10. FATE OF DATA

User Data remains available within the User’s account for the duration of the subscription.

Upon the User’s instruction at any time, or upon termination of the account, Scalelist shall delete User Data. Deletion following termination shall occur within 60 days, unless the User requests earlier deletion, or requests the return of the data in a structured, commonly used and machine-readable format, before the expiry of that period. Scalelist shall provide the User, upon request, with a written certificate of deletion recording the scope of the deletion, the date on which it was carried out and the systems concerned.

Backups and audit records. Deletion is applied to production systems immediately. Backups are not modified in place; deleted data ceases to exist in any backup upon expiry of the backup rotation period, and any restored backup is filtered against the record of deletions before being returned to production.

Scalelist retains a minimal record of each lookup performed, its date, source and outcome, in an enrichment audit log, for a period of 24 months. This record is retained in accordance with Article 17(3)(b) of the GDPR, in order to allow Scalelist to demonstrate compliance and to respond to enquiries from data subjects as to the origin of their data. It is not used to serve results to any User.

Scalelist may retain User Data where required to do so by applicable law, for the duration of that requirement, and shall continue to protect such data in accordance with this DPA.

11. AUDIT

Scalelist shall make available to the User the information necessary to demonstrate compliance with its obligations under this DPA, and shall allow the User or any auditor mandated by the User to conduct audits, including inspections, subject to 30 days’ prior written notice and appropriate confidentiality undertakings, and shall contribute to such audits.

Such audits shall be conducted no more than once per calendar year, unless a personal data breach has been established or an audit is required by a supervisory authority, during business hours, at the User’s cost, and shall be limited in scope to the processing activities described in this DPA. Source code, proprietary algorithms, inference methods and other trade secrets of Scalelist are excluded from the scope of any audit. The auditor shall have no access to data belonging to other clients of Scalelist or to any commercially sensitive information unrelated to the processing activities covered by this DPA. Scalelist may object to the appointment of any auditor which is a competitor of Scalelist.

Scalelist may satisfy an audit request by providing the User with one or more of the following, dated no more than 12 months prior: an independent third-party penetration test report, a completed CSA CAIQ (Consensus Assessments Initiative Questionnaire) or equivalent security questionnaire, its schedule of technical and organisational measures, or any recognised security certification or audit report. The provision of such documentation shall discharge Scalelist from the obligation to accept an on-site audit for the period covered, save where a personal data breach has been established or an audit is required by a supervisory authority.

12. LIABILITY

The liability of each party under this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service.

13. TERM AND TERMINATION

This DPA enters into force on the date the User accepts the Terms of Service and remains in force for the duration of the contractual relationship. Upon termination of the Terms of Service for any reason, this DPA terminates automatically. The fate of data upon termination is governed by Section 10 of this DPA. Sections 5(b), 9, 10 and 12 survive termination.

14. GOVERNING LAW AND JURISDICTION

Regardless of the governing law chosen by the parties for contractual purposes, the processing of personal data described in this DPA is subject to applicable data protection regulations as mandatory regulatory frameworks, which may include in particular the GDPR (Regulation (EU) 2016/679) in respect of the processing of personal data of EU/EEA residents, and the Personal Data Protection Act 2012 in respect of Singapore.

This DPA and any dispute arising from it shall be governed by the laws of Singapore, without prejudice to the mandatory application of applicable data protection regulations and the competence of the relevant supervisory authorities, and without prejudice to the governing law of the Standard Contractual Clauses referred to in Section 8.

15. UPDATES TO THIS DPA

Scalelist reserves the right to update this DPA at any time to reflect changes in its processing activities, applicable law, or regulatory guidance. Where an update materially affects the obligations of Users, Scalelist will provide at least 30 days’ prior notice by email and/or by displaying a prominent notice on its platform. Minor updates may be made without prior notice and will take effect upon publication. Continued use of the platform following notification of material changes constitutes acceptance of the updated DPA.

ANNEX 1: DETAILS OF PROCESSING

Subject matter of the processing. Provision of contact data enrichment and lead management services.

Duration of the processing. The term of the User’s subscription, together with the deletion period set out in Section 10 of this DPA.

Nature and purpose of the processing. Receipt of identifiers submitted by the User; resolution of a professional email address or telephone number by reference to Scalelist’s systems, its inference engine and its third-party providers; verification of deliverability; restitution of results to the User; storage of results within the User’s account; and transmission to destinations selected by the User.

Categories of data subjects. Business professionals acting in their professional capacity, being the prospects, customers or business contacts of the User, as determined by the User.

Categories of personal data. Full name; professional email address; professional telephone number; job title, seniority and function; company name, domain, industry and size; location; professional profile URL; and any additional field submitted by the User.

Special categories of data. None. The User is prohibited from submitting special categories of data pursuant to Section 6(a) of this DPA.

Frequency of the transfer. Continuous, upon the User’s instruction.

Retention. As set out in Section 10 of this DPA.

ANNEX 2: SUB-PROCESSORS

The list of Scalelist’s published sub-processors, and the categories of data providers engaged in the performance of the enrichment services, are set out at scalelist.com/sub-processors and form part of this DPA.

The complete nominative list of data providers is available to the User under the conditions set out in Section 7.3 of this DPA.

Scalelistprivacy@scalelist.com