productData Processing Addendum
This Addendum applies to the personal information about your clients, leads and other contacts that you enter into Keyline (“Client Data”). You are the business (CCPA) or controller (GDPR) for Client Data; B & CR GROWTH PARTNERS, S.L. (“we”) is your service provider (CCPA) and processor (GDPR). It applies automatically when you accept the Terms.
1. What we process and why
Subject matter and purpose: hosting and processing Client Data to provide the Service to you. Data subjects: your clients, prospects, referral partners, vendors and other contacts. Categories of data: names, contact details, company, roles and tags, notes, activities, tasks, deal and transaction details, voice note transcripts. Duration: for as long as you use the Service, plus the deletion periods in section 7.
2. Your instructions
We process Client Data only on your documented instructions, which are these Terms and your use of the Service’s features. If we believe an instruction breaks the law we will tell you. We will not:
- sell or share Client Data, as those terms are defined in the CCPA;
- retain, use or disclose it for any purpose other than providing the Service to you, or outside our direct business relationship with you;
- combine it with personal information we receive from others or collect ourselves, except as the CCPA permits for service providers;
- use it to train artificial intelligence models.
We certify that we understand and will comply with these restrictions. We will notify you if we can no longer meet our obligations under the CCPA, and you may then take reasonable steps to stop and remedy unauthorized use.
3. Confidentiality and security
Everyone we authorize to access Client Data is bound by confidentiality. We maintain the technical and organizational measures described in our Privacy Policy: encryption in transit and at rest, workspace isolation through row-level security, private file storage, least-privilege staff access and backups.
4. Subprocessors
You authorize the subprocessors listed on our Subprocessors page. We bind each of them by written contract to obligations at least as protective as this Addendum and remain responsible for them. We will announce new subprocessors on that page and by email at least 30 days in advance; if you object on reasonable data protection grounds and we cannot address the objection, you may close your account.
5. Helping you
We will help you, through the Service’s features or by request, to respond to your clients’ requests to know, delete, correct or access their data, and with security, breach notification and data protection impact assessments where the law requires them. If a person contacts us directly about Client Data, we will refer them to you.
6. Security incidents
We will notify you without undue delay, and in any case within 72 hours, after becoming aware of a breach affecting Client Data, with the information you need to meet your own obligations, and we will take reasonable steps to contain it.
7. Return and deletion
When you close your account we delete Client Data from the live system within 30 days and from backups within the following 30 days, unless the law requires us to keep it. Ask us for an export before closing your account.
8. Information and audits
We will make available the information reasonably needed to demonstrate compliance with this Addendum and allow reasonable assessments, at your cost, with 30 days’ notice and no more than once a year, unless a regulator requires otherwise.
9. International transfers
Client Data is hosted in the United States. Where the GDPR applies to the transfer, it is made under the EU–US Data Privacy Framework for certified recipients, or under the European Commission’s Standard Contractual Clauses (Module 2 between you and us where relevant, and Module 3 with our subprocessors), which are incorporated by reference.
10. Precedence
If this Addendum conflicts with the Terms on the processing of Client Data, this Addendum prevails.