Data Processing Agreement (EU and UK)

This agreement applies automatically when a Speak To Send customer is subject to the EU GDPR or UK GDPR. It forms part of the Terms of Service between the customer ("you", the controller) and Responsiv Marketing Agency, doing business as Speak To Send, 712 West Ave, Ocean City, NJ 08226 ("we", the processor). Where it differs from the Terms, this agreement wins for personal data.

1. What we process, and why

Subject matter	Providing Speak To Send: writing, sending and scheduling your emails through your GoHighLevel account
People concerned	Your contacts in GoHighLevel, and people in the conversations you reply to
Personal data	Names, email addresses, tags, Do Not Disturb status, and the content of emails and conversations
Special categories	None intended. Don't put health, financial or similar sensitive data into the Service
How long	For as long as you use the Service, then deleted as set out in section 8

2. Your instructions

We process your contacts' data only on your documented instructions: these terms, and what you choose in the app (who to email, what to send). If we think an instruction breaks data protection law, we'll tell you. You confirm you have a lawful basis for the processing and have given people any notices the law requires.

3. Confidentiality

Only people who need access to run the Service can access the data, and they are bound to keep it confidential.

4. Security

We keep appropriate technical and organisational measures in place, including: encrypted connections (HTTPS); GoHighLevel access tokens encrypted at rest and never logged or sent to the browser; passwords stored only as one-way hashes; each account separated so it can only see its own data; and access to production systems limited to the people who run the Service.

5. Sub-processors

You authorise the sub-processors listed in our Privacy Policy (GoHighLevel, Anthropic, OpenAI, Stripe and Railway). We bind each one to data protection terms at least as protective as these. We'll tell you at least 14 days before adding or replacing one; if you object on reasonable grounds and we can't resolve it, you may cancel and we'll stop processing your data.

6. Helping you

We'll help you, as far as we reasonably can, to respond to people exercising their rights (access, correction, deletion and so on), and with security, breach notifications and data protection impact assessments. We'll pass on to you any request we receive directly from your contacts.

7. Breaches

If we become aware of a personal data breach affecting your data, we'll tell you without undue delay, and in any case within 48 hours, with the information you need to meet your own obligations.

8. Deletion at the end

When you close your account, we delete your data within 30 days, unless the law requires us to keep it. Contact lists worked out for a send and voice recordings aren't stored by us in the first place.

9. Audits

We'll make available the information reasonably needed to show we meet this agreement, and answer reasonable written questions once a year. On-site audits need 30 days' notice, happen at your cost, and are limited to what's needed.

10. International transfers

We process data in the United States. For transfers from the EU, the European Commission's Standard Contractual Clauses (Module 2, controller to processor, Decision 2021/914) are incorporated by reference, with you as data exporter and us as data importer; optional clause 7 doesn't apply, clause 9 option 2 (general authorisation, 14 days' notice) applies, clause 11's optional wording doesn't apply, the governing law and courts are those of Ireland, and Annexes I and II are filled in by sections 1 and 4 above. For transfers from the UK, the UK International Data Transfer Addendum to those clauses applies. If we're certified under the EU-US Data Privacy Framework, we may rely on that instead.

11. Liability

Each party's liability under this agreement is subject to the limits in the Terms of Service, except where the law doesn't allow that.

12. Contact

support@speaktosend.app