Gegevensvoorwaarden

Data Security

Salestools AI Inc is committed to ensuring the security, integrity, and confidentiality of customer data. We adhere to industry best practices and are compliant with SOC 2 and ISO 27001 standards.

• Encryption: All data in transit is encrypted using TLS 1.2 or higher, and data at rest is encrypted using AES-256.
• Access Control: Access to customer data is restricted to authorized personnel based on role-based access control (RBAC) and the principle of least privilege.
• Data Segmentation: Customer data is logically segmented to prevent unauthorized access across accounts.
• Monitoring: Salestools employs 24/7 monitoring and alerting systems to detect and respond to potential threats promptly.
• Data Retention and Deletion: Data is retained as described in Section 10 of the Data Processing Agreement below and in our Terms of Service, in compliance with applicable laws and any Separate Agreement.

Compliance

Salestools AI Inc is aligned with:

• SOC 2 Type II: Demonstrating effective implementation of controls related to security, availability, processing integrity, confidentiality, and privacy.
• ISO 27001: Ensuring that an Information Security Management System (ISMS) is in place to protect sensitive data and reduce risks.

Incident Response

In the event of a data breach or security incident:

• We will notify affected customers within 72 hours of detection.
• A root cause analysis will be conducted, and a report will be provided to affected parties.
• Mitigation measures will be implemented immediately to prevent recurrence.

Customer Responsibilities

• Customers must ensure secure access to their accounts and systems by maintaining strong passwords and implementing two-factor authentication.
• Customers are responsible for ensuring compliance with local laws regarding data collection and processing within their jurisdictions.

Data Processing Agreement (DPA)

1. Definitions

• Controller: The entity that determines the purposes and means of the processing of Personal Data.
• Processor: The entity that processes Personal Data on behalf of the Controller.
• Personal Data: Any information relating to an identified or identifiable natural person.
• Agreement: The Salestools Terms of Service together with any Separate Agreement.
• Separate Agreement: An order form, master services agreement, data processing agreement or other written agreement relating to the Service that is signed by both the Customer and Salestools.
• Customer Personal Data: Personal Data contained in Customer Data (as defined in the Terms of Service) that Salestools processes on behalf of the Customer as Controller.
• Aggregated Data: Data, statistics and insights that have been aggregated and/or de-identified so that they do not identify the Customer or any individual.

2. Scope of Processing

• Salestools acts as Processor for Customer Personal Data and processes it on behalf of the Customer to provide the Service under the Agreement, and for the purposes set out in Section 4.
• The processing activities include but are not limited to data collection, analysis, and reporting as required for providing AI sales services.

3. Obligations of the Processor

• Process Customer Personal Data only on documented instructions from the Controller, which consist of the Agreement and the Customer's use and configuration of the Service, except as set out in Section 4 or where applicable law requires otherwise (in which case Salestools will inform the Controller of that legal requirement before processing, unless the law prohibits this).
• Ensure that personnel authorized to process Personal Data have committed to confidentiality.
• Implement technical and organizational measures to ensure data security, including pseudonymization, encryption, and incident response measures.

4. Salestools Purposes

Unless a Separate Agreement expressly provides otherwise, the Customer authorizes Salestools to process Customer Personal Data, in addition to providing the Service, for the following purposes:

• (a) service improvement and security: maintaining, securing and improving the Service, preventing fraud and abuse, and improving, training and developing Salestools products, models and features; and
• (b) creating Aggregated Data, provided that Aggregated Data does not identify the Customer or any individual.

• To the extent applicable data protection law treats Salestools as determining the purposes and means of the processing described in this Section 4, Salestools acts as an independent controller for that processing, only to that extent, and will comply with the obligations that applicable law places on controllers.
• Aggregated Data is not Personal Data or Customer Data, is owned by Salestools, and may be used and commercialized by Salestools.
• This Section 4 does not apply to email, calendar and related data that Salestools receives from Google or Microsoft when a mailbox or calendar is connected, or to text messaging opt-in data and consent. Salestools processes that data only to provide the Service, as described in its Privacy Policy.

5. Sub-processors

• Salestools may engage sub-processors for specific processing activities. A list of current sub-processors is available upon request.
• The Processor will ensure that sub-processors are bound by similar data protection obligations.

6. Data Subject Rights

The Processor will assist the Controller in responding to data subject rights requests, including:

• Right to access, rectification, and erasure.
• Right to restriction of processing and data portability.

7. International Data Transfers

Salestools will not transfer Personal Data outside the European Economic Area (EEA) without appropriate safeguards, such as Standard Contractual Clauses (SCCs).

8. Security Measures

• Secure physical facilities and restricted access.
• Secure software development lifecycle (SDLC).
• Regular security audits and penetration testing.
• Data backup and disaster recovery protocols.

9. Breach Notification

The Processor will notify the Controller within 72 hours of discovering a Personal Data Breach, including:

• Nature of the breach.
• Categories and approximate number of data subjects affected.
• Measures taken to address the breach.

10. Data Retention and Deletion

Unless a Separate Agreement sets a different period, Salestools retains Customer Personal Data for as long as the Customer's account is active and, after that, for as long as needed for the purposes in the Agreement and this DPA, to comply with legal obligations, to resolve disputes and to enforce its agreements. The Customer may request deletion of Customer Personal Data at any time, and upon termination of the Agreement Salestools will delete or return Customer Personal Data at the Controller's request, in each case except where applicable law or a legal hold requires retention. Backup copies are deleted on their normal backup cycle. Aggregated Data is not subject to this Section 10.

11. Liability

The Processor's liability arising out of or related to data processing will be governed by the liability terms in the Agreement.

12. Governing Law

This DPA shall be governed by the laws of the state or jurisdiction specified in the Agreement.

Appendix: List of Sub-processors

• AWS (Amazon Web Services): Cloud hosting and infrastructure.
• Hetzner: Cloud hosting and infrastructure.
• OVH: Cloud hosting and infrastructure.
• Attio: Customer Communication.
• OpenAI Inc.: AI Models.
• Anthropic Inc.: AI Models.
• Perplexity Inc.: AI Models.
• Meta Inc.: AI Models.
• xAI Corp.: AI Models (fallback processing).
• Recall.ai Inc.: Meeting recording and transcription (EU region).
• Twilio Inc.: Calls, SMS and messaging.
• Resend Inc.: Email delivery.
• Groq Inc.: AI Models (website page analysis).
• ElevenLabs Inc.: AI voice generation (only when AI voicemail is enabled).
• Intercom Inc.: Customer Support.