This DPA forms part of the Terms of Service between you (“Controller”) and Palmline Ventures (“Processor”) and applies whenever we process personal data of your prospects on your behalf. It is offered pre-signed: by accepting the Terms you accept this DPA, so most customers need not request a separate agreement.
1. Roles
You are the controller of prospect personal data: you decide which segments to target and approve every campaign. We are the processor and act only on your documented instructions, which consist of these Terms, the DPA, and your use of the product’s features. We are an independent controller only for our own account and billing data, as described in the Privacy Policy.
2. Our obligations
- Process personal data only on your instructions, and tell you if an instruction appears to breach applicable data protection law.
- Ensure people authorised to process the data are bound by confidentiality.
- Apply the technical and organisational measures in Annex II.
- Assist you, taking account of the nature of processing, with data subject requests, security incidents, breach notifications and impact assessments.
- Notify you without undue delay after becoming aware of a personal data breach affecting your data.
- On termination, delete your personal data within 30 days, except suppression records (retained so opt-outs continue to be honoured) and data we must keep by law.
- Make available the information needed to demonstrate compliance and allow audits once per twelve months on reasonable notice, or more often if a regulator requires it.
3. Sub-processors
You give general authorisation for the sub-processors listed in Annex III. We impose equivalent data protection obligations on each of them and remain liable for their performance. We will give at least 30 days’ notice before adding or replacing a sub-processor; if you reasonably object on data protection grounds you may terminate the affected part of the Service and receive a pro-rata refund of unused credits.
4. International transfers
Where personal data of individuals in the EEA, UK or Switzerland is transferred to us or our sub-processors outside those areas, the parties incorporate the European Commission’s Standard Contractual Clauses (Module 2, controller to processor), with the UK Addendum where applicable. the United Arab Emirates is not the subject of an EU adequacy decision, so these clauses provide the transfer mechanism.
5. Liability
Liability under this DPA is subject to the limitations in the Terms, except where applicable data protection law does not permit that limitation.
Annex I — Details of processing
- Subject matter: provision of AI-assisted B2B outreach — prospect research, email drafting, sending, and reply handling.
- Duration: for the term of your account, plus the retention periods in the Privacy Policy.
- Nature and purpose: collection, enrichment, verification, storage, AI-assisted analysis and drafting, transmission of email, and processing of replies.
- Categories of data subject: employees and representatives of businesses you target, acting in a professional capacity.
- Categories of personal data: name, business email address, job title, employer, country, public professional profile links, correspondence content and engagement events (sent, replied, bounced, unsubscribed).
- Special categories: none requested or required. Do not send them.
Annex II — Security measures
- Encryption in transit (TLS) and at rest for databases and backups.
- Passwords stored using a one-way hashing function; sessions expire.
- Per-workspace data isolation enforced in application queries; cross-tenant access controls tested as part of release review.
- Signed, verifiable unsubscribe links and permanent suppression records.
- Secret material held in the hosting provider’s encrypted store, not in code.
- Least-privilege access to production; access reviewed when personnel change.
- Automated backups with point-in-time recovery at the database layer.
- Rate limiting, abuse detection and bounce/complaint monitoring on sending.
Annex III — Approved sub-processors
- Amazon Web Services (Bedrock) — AI model inference (EU (Frankfurt))
- Vercel — Application hosting (EU (Frankfurt) / US)
- Neon — Database hosting (EU (Frankfurt))
- Smartlead — Email sending infrastructure and mailboxes (US)
- Apollo.io — Business contact data source (US)
- MillionVerifier — Email address validation (EU)
- Stripe — Payment processing (US / EU)
- Resend — Transactional email (account notices) (US / EU)
Contact
Data protection enquiries and audit requests: privacy@pipestork.com — Palmline Ventures, RAKEZ Business Zone, Al Nakheel Area, P.O. Box 10055, Ras Al Khaimah, United Arab Emirates.