Data processing agreement

This agreement applies to all personal data SpecStream processes on your behalf as your processor: the requests you run and the results SpecStream returns for them, lists and files you import, data you send through the API, an agent, or a connected tool, records you add or edit, and notes. You are the controller of that data. It takes effect when you accept the terms of use, and it lasts as long as SpecStream processes such data for you.

SpecStream is the controller only for its own opt-out list. Exclusions on that list apply to results returned to you and saved in your workspace, and you instruct SpecStream to honor them.

SpecStream processes the personal data only on your documented instructions, which are these terms, this agreement, and your use and configuration of the service, including transfers to the destinations you choose, unless the law requires otherwise; in that case SpecStream tells you first, unless the law forbids it. SpecStream tells you if, in its opinion, an instruction infringes data protection law.

Everyone at SpecStream who can access the data is bound by confidentiality.

SpecStream takes appropriate technical and organizational measures under Article 32 of the GDPR, including:

• Hosting in the European Union, and encryption in transit for all traffic to the website, the workspace, and the API
• Strong sign-in, including passkeys and single sign-on, and protected sessions
• Role-based access, checked on every access, export, share, and delivery
• Encryption of stored credentials for connected tools
• An account audit log of sign-ins, access changes, spending, and exports, kept for 12 months
• Logging that leaves out the content of requests, contact details, credentials, and sign-in tokens
• Pseudonymized opt-out records
• Abuse prevention and rate limiting
• Regular backups, with encrypted copies kept off-site in the European Union

You give SpecStream general authorization to engage subprocessors. SpecStream imposes the same data protection obligations on each subprocessor by contract and remains responsible to you for them. These are the categories in use:

The current list with each subprocessor’s name and address is available from [email protected]. SpecStream emails account owners at least 30 days before adding or replacing a subprocessor. You can object on reasonable data protection grounds within that time. If SpecStream cannot address the objection, you can end the affected service and receive a refund of prepaid, unused fees for it.

Taking into account the nature of the processing, SpecStream helps you respond to requests from people exercising their rights, mostly through the service itself: you can find, correct, export, and delete records in your workspace. SpecStream forwards to you any request it receives that concerns your data.

SpecStream notifies you without undue delay, and within 48 hours of becoming aware of it, of a personal data breach affecting your data, with the information Article 33(3) of the GDPR requires as it becomes available, and helps you with your own notifications. SpecStream gives you reasonable help with data protection impact assessments and prior consultations with a supervisory authority.

You can export your data at any time. When you delete records, lists, or your account, SpecStream deletes the corresponding personal data from its active systems, at once for an account deletion, and from backups within 8 days, unless the law requires it to be kept.

Copies of pages read for your requests are kept for at most 24 hours and only for you; working copies from a run are deleted within 7 days.

SpecStream makes available the information necessary to demonstrate compliance with Article 28 of the GDPR, answers reasonable written questions, and allows audits by you or an auditor you mandate who is bound by confidentiality: once a year, on 30 days’ written notice, during business hours, in a way that does not compromise other customers’ data or SpecStream’s security, and at your cost, except where an audit reveals a material breach by SpecStream or is required by a supervisory authority.

Where processing under this agreement involves a transfer of personal data from the European Economic Area to a country without an adequacy decision, the European Commission’s Standard Contractual Clauses (Decision (EU) 2021/914) apply and are incorporated by reference: Module 2 where you are a controller, Module 3 where you are a processor, and Module 4 where SpecStream sends data back to you outside Europe. Clause 7 does not apply; under Clause 9(a), option 2 applies with the 30-day notice above; the optional wording in Clause 11 does not apply; the competent supervisory authority is the CNIL; and the clauses are governed by French law, with the French courts competent. The sections above form their annexes. The UK International Data Transfer Addendum and the Swiss amendments apply to data from those countries.

If this agreement conflicts with the terms of use, this agreement prevails for the processing of personal data. If it conflicts with the Standard Contractual Clauses, the clauses prevail. Each party’s liability under this agreement is subject to the limits in the terms of use, except where the law does not allow them.