This Data Processing Agreement ("DPA") forms part of the agreement between Automated Sales LTD and Automated Sales FZE LLC (together, the "Processor", "we") and the customer identified in the applicable order or account ("Controller", "you") governing use of the LeadRouter Service. Automated Sales LTD and Automated Sales FZE LLC act as joint and several processors under this DPA — each is independently bound by, and liable for, the full obligations set out below, regardless of which entity carries out a given processing activity in practice.
This DPA addresses obligations arising under the UK GDPR and Data Protection Act 2018 and the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. Where the two regimes differ, the Processor will apply the higher standard of protection unless otherwise agreed in writing.
Terms such as "personal data", "processing", "controller", "processor", and "data subject" have the meanings given in UK GDPR and, where applicable, the UAE PDPL. "Customer Data" means personal data processed by the Processor on the Controller's behalf via the Service, principally deal, contact, and representative data drawn from the Controller's connected Pipedrive account.
The subject matter of processing is the provision of automated lead-routing functionality. Processing continues for the duration of the Controller's subscription to the Service, and for any period thereafter required for data return or deletion under Clause 9.
The Processor processes Customer Data solely to: read deal, contact, pipeline, and representative data from the Controller's Pipedrive account; apply the Controller's configured routing rules; write assignment decisions back to Pipedrive; and generate activity logs and reporting within the Service.
Data subjects: the Controller's sales representatives; the Controller's leads, prospects, and customers whose records exist in the connected Pipedrive account.
Categories of data: names, email addresses, phone numbers (where present in Pipedrive), deal and pipeline metadata, and representative performance metrics. The Processor does not intentionally process special category or sensitive personal data.
The Controller acknowledges that Automated Sales LTD and Automated Sales FZE LLC each process Customer Data as part of the joint Processor arrangement, and consents to this cross-entity processing as a condition of the Service. In addition, the Controller authorises the following third-party sub-processors:
The Processor will notify the Controller of any intended addition or replacement of sub-processors, giving the Controller a reasonable opportunity to object on reasonable data protection grounds.
Because the Processor operates jointly through Automated Sales LTD (United Kingdom) and Automated Sales FZE LLC (United Arab Emirates), Customer Data will in the ordinary course be accessible to, and may be transferred between, both entities. Where Customer Data originating in the UK is transferred to the UAE, the parties agree to put in place an appropriate transfer mechanism recognised under UK GDPR.
On termination of the underlying services agreement, the Processor will, at the Controller's election, delete or return all Customer Data within thirty (30) days, save for data required to be retained by applicable law.
Each party's liability under this DPA is subject to the limitations of liability set out in the underlying Terms of Service between the parties, except where such limitation would be unenforceable under applicable data protection law.
This DPA is governed by the laws of England and Wales, the same governing law as the underlying Terms of Service, without prejudice to any data protection law of the Controller's jurisdiction that applies on a mandatory basis.
This DPA is incorporated by reference into the LeadRouter Terms of Service and takes effect automatically upon the Controller's use of the Service.