1. When this addendum applies
This addendum applies only when a business customer and we both sign it, or an Enterprise contract that we sign says that it applies. It then covers the personal data that the customer brings into TapForNetwork and that we process for the customer (“customer personal data”). For everything else, and for everyone without a signed addendum, the privacy notice applies and we are the controller. We do not offer this addendum yet.
2. Who is who
The customer is the controller of customer personal data and decides why it is processed. We are its processor and process it only for the customer. Words such as “controller”, “processor”, “personal data breach” and “sub-processor” have the meaning they have in the GDPR (Regulation (EU) 2016/679).
3. What we process, and why
Subject and purpose: providing TapForNetwork to the customer under its contract, including storage, import, suggestions, AI features the customer's users start, downloads, deletion, support and security. Duration: the contract's term, and the time needed to delete afterwards.
Types of data: names, professional profile details, job titles, companies, the contact details shared in the customer's imports, dates of contact and invitations, notes and other content the customer's users write. People concerned: the customer's users and the people in their professional networks.
The customer must not bring in special categories of data (article 9 of the GDPR) or data about criminal convictions (article 10).
4. We follow your instructions
We process customer personal data only on the customer's documented instructions: this addendum, the contract and the customer's use of TapForNetwork's settings. If an instruction seems to break data protection law, we tell the customer. If the law requires us to process data otherwise, we tell the customer first, unless the law forbids it.
5. Confidentiality
Everyone who can access customer personal data for us is bound to keep it confidential.
6. Security
We keep the technical and organisational measures in the annex below, and keep them up to date as the risk requires (article 32 of the GDPR). We may improve them; we do not make them weaker.
7. Sub-processors
The customer allows us to use the companies on the sub-processors page. We tell the customer at least 30 days before we add or replace one, and the customer may object for a reasonable reason within that time; if we cannot meet the objection, the customer may end the affected service and we refund what was paid for the time after it ends.
We bind each sub-processor to data protection duties that are at least as protective as these, and we stay responsible to the customer for its work.
8. Helping you with people's rights
TapForNetwork lets the customer's users download, correct and delete their data themselves. Where that is not enough, we help the customer answer requests from people about their data. If a person asks us directly, we pass the request to the customer and do not answer it ourselves, unless the law requires us to.
9. Personal data breaches
We tell the customer without undue delay, and where possible within 48 hours, after we learn of a personal data breach that affects customer personal data, with what we know: what happened, the data and people likely affected, the likely effects and what we are doing. We update the customer as we learn more.
10. Helping you with assessments and authorities
We give the customer the information it reasonably needs for a data protection impact assessment and for consulting a supervisory authority (articles 35 and 36 of the GDPR), about TapForNetwork as we provide it.
11. Transfers outside the EU
Some sub-processors are based outside the EU. Each transfer rests on a safeguard of chapter V of the GDPR, and the signed addendum names the safeguard for each sub-processor.
12. At the end
When the contract ends, the customer can download its data first. We then delete customer personal data, including copies, unless the law requires us to keep it. Backups that still hold it expire within 30 days. We confirm the deletion in writing on request.
13. Information and audits
We give the customer the information needed to show that we meet this addendum, and answer reasonable written questions. The customer, or an auditor bound to confidentiality, may audit once a year with 30 days' notice, during working hours and without harming our security or other customers; each side bears its own costs.
14. Liability and order of documents
The limits of liability of the contract apply to this addendum, as far as the GDPR allows. If this addendum and the contract differ on data protection, this addendum wins.
15. Annex: security measures
Encrypted connections (HTTPS) for every request; sign-in through a specialist provider; each account's data kept apart from every other account's; operators work in a separate console with its own sign-in in two steps; it never shows the people in a customer's networks, their notes or their messages, does not show e-mail addresses, and records every opening of an account and every action.
Uploaded archives deleted after processing; download links valid for 10 minutes and download files deleted after 24 hours; technical logs without content, kept 30 days.
Daily backups, encrypted before they leave our servers with a key our running service does not hold, kept up to 30 days in separate, locked storage in the EU; restores rehearsed.
Limits on how often each account and each network address can use costly or sensitive actions; bot checks at sign-up and before imports; a security contact published in security.txt.
What changed in this version
- Says that operators work in a separate console with its own sign-in in two steps, which never shows the people in a customer's networks, their notes or their messages.