This Data Processing Agreement ("DPA") is between StudioIndex - F.Z.C (Registration Number: 43943), which operates Swokei ("Swokei", "we", "us"), and the customer that has accepted the Swokei Terms of Service ("Customer", "you").
It forms part of the Terms of Service and is incorporated into them by reference. It applies whenever Swokei processes Customer Personal Data on your behalf, and you accept it by accepting the Terms. You do not need to sign a separate copy. If you need a countersigned copy for your records, write to [email protected].
1. Definitions
"Data Protection Law" means the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection, and any other data protection law that applies to the processing under this DPA.
"Customer Personal Data" means personal data that you, or your users, put into Swokei or that Swokei collects or generates on your instructions, including the leads and contacts in your campaigns, the emails sent to them and the replies they send back.
"Controller", "processor", "data subject", "personal data", "personal data breach", "processing" and "supervisory authority" have the meanings given in the GDPR.
"Sub-processor" means a third party that Swokei engages to process Customer Personal Data.
"SCCs" means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914.
2. Roles
For Customer Personal Data, you are the controller and Swokei is your processor. You decide which people to contact, what to send them and on what legal basis; Swokei processes their data only to provide the service to you.
Swokei is a separate controller, not your processor, for: your own account, billing and usage data, which our Privacy Policy covers; and Swokei's own business directory, from which you can choose leads. Once you add a lead from the directory to a campaign, the copy in your campaign is Customer Personal Data and you are its controller.
3. Details of the processing
Subject matter and duration
Providing Swokei to you under the Terms, for as long as you have an account, and afterwards until the data is deleted under section 10.
Nature and purpose
Storing and organising lead lists; finding and verifying business contact details; visiting and analysing the websites of your leads; writing email drafts; sending emails from the mailboxes you connect; tracking opens, clicks and replies where you turn that on; reading and sorting replies; recording unsubscribes and suppressing those addresses; and the support, security and billing tasks needed to run the service.
Categories of data subjects
- your leads and prospects, and the people who work at those businesses
- people who reply to emails sent through Swokei
- your own team members who use Swokei under your account
Categories of personal data
Names, job titles, business email addresses, business phone numbers, company names, business addresses, website addresses, links to public business and social profiles, the content of emails sent and received, open, click and reply events, unsubscribe status, and any other data you choose to import.
Special categories
None. Swokei is not designed to process special categories of personal data, and you must not upload them.
4. Swokei's obligations
Swokei will:
- process Customer Personal Data only on your documented instructions, which are the Terms, this DPA and the settings and actions you take in Swokei, unless the law requires otherwise, in which case we will tell you first unless the law forbids it
- tell you if, in our opinion, an instruction breaks Data Protection Law
- make sure everyone authorised to process Customer Personal Data is bound by confidentiality
- apply the security measures in section 8
- use sub-processors only as section 6 allows
- help you, taking into account the nature of the processing, to answer requests from data subjects exercising their rights
- help you meet your obligations on security, breach notification, data protection impact assessments and prior consultation, taking into account the information available to us
- delete or return Customer Personal Data at the end of the service as section 10 describes
- make available the information needed to show compliance with Article 28 of the GDPR, and allow audits as section 11 describes
5. Your obligations
You are responsible for the lawfulness of the processing you instruct. In particular, you:
- have a lawful basis for every lead you import or select, and for every email you send
- give recipients the information that Articles 13 and 14 of the GDPR require, including where you got their details and their right to object
- comply with the anti-spam, electronic marketing and data protection laws of each recipient's country, as the Terms and the Acceptable Use Policy describe
- honour every objection and opt-out, and do not re-import or re-contact a person who has opted out
6. Sub-processors
You give Swokei general authorisation to engage sub-processors. The current list is at swokei.com/subprocessors.
We will update that list before a new sub-processor starts processing Customer Personal Data. If you object on reasonable data protection grounds within 14 days of the update, write to [email protected]. We will work with you to find a solution; if we cannot, you may stop using the affected part of the service or end your subscription, and we will refund any prepaid fees for the period after termination.
Swokei will bind each sub-processor by a written contract with data protection obligations that are no less protective than those in this DPA, and remains responsible to you for its sub-processors' performance of those obligations.
7. International transfers
Swokei is established in the United Arab Emirates, and some sub-processors process data in other countries outside the European Economic Area, the United Kingdom and Switzerland.
To the extent your use of Swokei involves a transfer of Customer Personal Data from the EEA to Swokei in a country without an adequacy decision, the SCCs are incorporated into this DPA by reference and apply as follows: Module Two (controller to processor), with you as data exporter and Swokei as data importer; Clause 7 (docking clause) applies; under Clause 9, Option 2 (general written authorisation) applies with the notice period in section 6; the optional wording in Clause 11 does not apply; under Clause 13, the competent supervisory authority is the one that Clause 13 identifies for you; under Clause 17, Option 2 applies, and where the law of the data exporter's Member State does not allow third-party beneficiary rights, the law of Ireland applies; under Clause 18, disputes are resolved by the courts of the Member State in which you are established. Annex I is completed by section 3 of this DPA, Annex II by section 8, and Annex III by the sub-processor list.
For transfers subject to UK data protection law, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner applies, completed with the information in this DPA; either party may end it as section 19 of that Addendum allows.
For transfers subject to Swiss data protection law, the SCCs apply with the Federal Data Protection and Information Commissioner as the competent supervisory authority, references to the GDPR read as references to the Swiss Federal Act on Data Protection, and "Member State" read so that data subjects in Switzerland can bring claims where they habitually reside.
Onward transfers from Swokei to sub-processors outside the EEA, the UK or Switzerland are made under the SCCs (Module Three where Swokei is the exporter) or another transfer mechanism recognised by Data Protection Law.
8. Security
Swokei maintains technical and organisational measures appropriate to the risk, including:
- encryption of data in transit between your browser and Swokei (HTTPS)
- passwords stored only as salted hashes, optional two-factor authentication, and sessions that can be revoked
- API keys stored only as hashes
- separation of each customer's data by account and workspace in the application
- a read-only, separately permissioned connection to the business directory database
We may change these measures over time, provided the overall level of protection does not go down.
9. Personal data breaches
Swokei will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as we know at the time, what happened, the data and people affected, the likely consequences and what we are doing about it, and we will add information as it becomes available. We will send it to the email address on your account.
10. Deletion and return
You can delete leads, contacts and campaigns at any time, and download campaign data as CSV files before you do. When you delete your account, it is deactivated straight away and permanently deleted after a 30-day grace period, during which you can change your mind. Data held by sub-processors is deleted under their own retention schedules. Swokei may keep data longer only where the law requires it, and then only for that purpose.
11. Information and audits
On written request, Swokei will provide the information reasonably needed to show compliance with this DPA. If that information is not enough, or a supervisory authority requires it, you may audit Swokei's compliance, on at least 30 days' notice, during normal business hours, no more than once a year unless there has been a personal data breach, at your own cost, and under a duty of confidentiality. The audit may not give access to other customers' data.
12. Liability and precedence
Each party's liability under this DPA is subject to the limitations in the Terms, except where Data Protection Law or the SCCs do not allow that. If this DPA conflicts with the Terms, this DPA prevails. If it conflicts with the SCCs, the SCCs prevail.
13. Changes
We may update this DPA to reflect changes in the law or in the service. We will not reduce the protection it gives Customer Personal Data without your agreement. The "Last updated" date shows the current version.
14. Contact
StudioIndex - F.Z.C
Registration Number: 43943
Email: [email protected]