Data Processing Agreement

This Data Processing Agreement (the "DPA") forms part of the Terms of Service between Coolie (Shabbir Bhanpurawala), registered in France under SIRET 94780077700015 ("Coolie"), and the customer that holds a Coolie account ("Customer"). It sets out the terms required by Article 28 of Regulation (EU) 2016/679 (the "GDPR"). It takes effect when Customer accepts the Terms of Service.

1. Definitions

"Customer Personal Data" means the personal data Coolie processes on Customer's behalf through Coolie's services (the "Services"), as described in Annex 1. "Sub-processor" means another processor Coolie engages to process Customer Personal Data. "Controller", "processor", "data subject", "personal data", "personal data breach" and "processing" have their meaning in the GDPR.

2. Roles

Customer is the controller of Customer Personal Data and Coolie is its processor.

Coolie is itself the controller of the data about Customer's account, its billing and its use of Coolie's website, as the Privacy Notice describes. This DPA does not cover that data.

3. Customer's instructions

Coolie processes Customer Personal Data only on Customer's documented instructions, including for transfers outside the European Economic Area, unless European Union or Member State law requires otherwise. In that case Coolie tells Customer before processing, unless that law forbids it.

This DPA, the Terms of Service and what Customer sets or does in the Services (its ideal customer profile, signals, campaigns, imports and API calls) are Customer's documented instructions.

Coolie tells Customer immediately if, in its opinion, an instruction infringes the GDPR or other data protection law.

4. Customer's responsibilities

Customer decides whom it contacts and why. Customer is responsible for having a lawful basis for its prospecting, for informing the people it contacts, for honouring their objections, and for the data it imports into the Services.

5. Confidentiality

Coolie ensures that the people it authorises to process Customer Personal Data are bound by a duty of confidentiality.

6. Security

Coolie implements technical and organisational measures appropriate to the risk, as Article 32 of the GDPR requires. Annex 2 describes them. Coolie may change them, as long as the overall level of protection does not fall.

7. Sub-processors

Customer gives Coolie general written authorisation to engage Sub-processors in the categories listed in Annex 3.

Coolie tells Customer before adding or replacing a Sub-processor, so that Customer can object on reasonable data protection grounds: it publishes the change, with the Sub-processor's category, in its changelog at trycoolie.ai/changelog and in the What's new of the Services, before the change applies. If the parties find no solution, Customer may stop using the part of the Services concerned.

Customer may ask for the identity of the Sub-processors at any time by writing to shabbir@trycoolie.ai. Coolie gives it in confidence.

Coolie binds each Sub-processor by contract to data protection obligations equivalent to those in this DPA, and remains fully liable to Customer for each Sub-processor's performance of them.

8. Where the data is, and transfers

Coolie stores Customer Personal Data in the European Union (Frankfurt, Germany).

Where a Sub-processor processes Customer Personal Data outside the European Economic Area, Coolie relies on an adequacy decision of the European Commission, on the European Commission's standard contractual clauses, or on another safeguard under Chapter V of the GDPR.

9. Data subjects' requests

If Coolie receives a request from a data subject about Customer Personal Data, it tells Customer without undue delay and does not answer the request itself, beyond directing the person to Customer. An unsubscribe is the exception: each email carries an unsubscribe line, and someone who uses it, or replies "stop", gets nothing more from that sender.

The Services help Customer answer such requests: Customer can export its leads as a CSV file and erase them in Settings → Your data. Coolie gives further assistance on request, taking into account the nature of the processing.

10. Assistance and personal data breaches

Coolie assists Customer with its obligations under Articles 32 to 36 of the GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the nature of the processing and the information available to Coolie.

Coolie notifies Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, at the email address of Customer's account. It gives the information Article 33(3) of the GDPR asks for as it becomes available.

11. End of the processing

Customer can export and erase its leads at any time, as section 9 says.

When the Services end, Coolie deletes Customer Personal Data or returns it, as Customer chooses by writing to shabbir@trycoolie.ai, and deletes the existing copies, unless European Union or Member State law requires it to keep them. Without such a request, Coolie deletes it within the period the Privacy Notice gives: one year after access to the Services ends. Deleted data leaves Coolie's backups as they expire.

12. Information and audits

Coolie makes available to Customer the information needed to demonstrate compliance with Article 28 of the GDPR, and allows for and contributes to audits, including inspections, by Customer or an auditor it mandates. Customer gives reasonable notice, keeps what it learns confidential, and carries out the audit so as not to disrupt the Services.

13. Liability, precedence and law

Each party's liability under this DPA follows the GDPR and the Terms of Service. If this DPA and the Terms of Service conflict on the processing of Customer Personal Data, this DPA prevails. This DPA is subject to French law and to the jurisdiction of the Paris courts, as the Terms of Service are.

14. Changes and contact

Coolie may update this DPA when the law or the Services require it, and tells Customer when it does. Questions about this DPA go to shabbir@trycoolie.ai.

Annex 1: details of the processing

• Subject: providing the Services: finding people who match Customer's ideal customer profile, researching them, writing messages to them, sending those messages from the accounts Customer connects, and showing their replies.
• Nature: collection from data sources and from Customer's files, lookup, storage, analysis including by AI models, drafting, sending, recording and erasure.
• Purpose: Customer's business-to-business prospecting and outreach.
• Duration: as long as Customer uses the Services, then as section 11 says.
• Data subjects: Customer's prospects and contacts, and the people who write to Customer's connected accounts.
• Personal data: first and last name, job title and employer, LinkedIn profile and photo, work email address, phone number, location, the signals and research about the person, and the messages sent and received.
• Special categories of data: none are intended. Customer does not import them.

Annex 2: technical and organisational measures

• Location: the database and application servers run in the European Union (Frankfurt, Germany).
• Encryption: every connection uses HTTPS; the database is encrypted at rest.
• Backups: the database is backed up every day.
• Access: the database cannot be reached from a browser. Every request goes through Coolie's servers, which check the account it comes from. Back-office access is limited to named members of Coolie's team.
• Connected accounts: Customer connects LinkedIn, mailboxes and WhatsApp numbers on a dedicated connection page, so Coolie's database keeps no password for those accounts.
• Webhooks: the webhooks Coolie sends are signed.
• Erasure and opt-out: Customer can erase its leads itself, and the unsubscribe line and a reply of "stop" end a person's messages from that sender.

Annex 3: categories of Sub-processors

• Hosting and database.
• AI model providers, for research and drafting.
• Connection of mailboxes, LinkedIn accounts and WhatsApp numbers, and sending through them.
• Contact and company data sources, for lookups of people, email addresses, phone numbers and photos.
• Email delivery of Coolie's notifications to Customer.