Data processing agreement

Skeyon Lab S.L. — VerifyEmails, Pop-ups and Automation

1. Parties and purpose

This processing agreement, hereinafter “DPA”, regulates the processing of personal data carried out by Skeyon Lab S.L., with NIF B65911679 and address at Zamora 105, 6.º 3.ª, 08018 Barcelona, Spain, hereinafter “Skeyon”, on behalf of the natural or legal person identified as a customer in the account and in the contracting of the service, hereinafter “Customer”.

The contact for data protection issues, instructions and requests related to this DPA is contactar@verificaremails.com.

The DPA applies exclusively to the services contracted and used by the Client among those described in Annex I. Its purpose is to establish the conditions of processing on behalf of the Client in accordance with Regulation (EU) 2016/679, hereinafter “GDPR”, and the applicable Spanish data protection regulations.

The data used by Skeyon for its own purposes of account management, invoicing and compliance with legal obligations are regulated by the corresponding privacy policy. This distinction does not allow the reuse of the contacts provided for these purposes to verify or manage campaigns.

2. Roles and clients acting on behalf of third parties

The Client acts as the data controller when determining the purposes and essential means of the processing. In this case, Skeyon acts as the data processor.

If the Client is an agency or other provider acting as a processor on behalf of a third party, Skeyon will act as a sub-processor. The Client must have the necessary authorisation from the controller and provide instructions compatible with the assignment received. The use of the platform does not constitute a verification by Skeyon of the Client’s contractual relations with its own clients.

The references in this DPA to the Client’s instructions and obligations are understood to be adapted to its effective role. The Client will provide, where necessary, the information that allows the obligations of the final controller to be met.

3. Instructions and purpose of processing

Skeyon will process the data only to provide the contracted services, following the Client’s documented instructions. Instructions are these DPAs, account settings, transactions requested through the platform or API, and verified requests submitted through support channels.

Instructions include, where applicable, communications to integrations or recipients that the Client configures. No integration alone extends the authorized purposes.

Skeyon does not reuse contacts or verification results for other clients, to create its own contact databases or to train artificial intelligence models.

If a European Union or Member State regulation requires different treatment, Skeyon will inform the Client in advance, unless legally prohibited. If it considers that an instruction violates the applicable regulations, it will immediately notify the Client and request clarification or correction before executing the affected part.

4. Client’s obligations and minimisation

It is the Client’s responsibility to determine and prove the lawfulness of the processing, provide the information required of the data subjects, comply with their rights and give lawful instructions. The Client must have the necessary legal basis for the transactions requested, without this DPA assuming that this basis must always be consent.

The Client will only provide the data that is adequate, relevant and necessary for the service. It must avoid files with unnecessary columns and review the custom fields, forms and integrations that it configures.

Skeyon does not systematically examine all content to determine its nature or origin. This circumstance does not exclude its obligations as a processor with respect to the personal data that it actually processes.

The services covered by this DPA are not contracted to process special categories of data or data on criminal convictions and offences. Their processing will require a specific prior agreement that establishes the applicable conditions and guarantees. If the Client detects that they have been accidentally incorporated, they must request their removal or delete them using the available functions.

5. Confidentiality and authorised personnel

Skeyon staff’s access to data is limited to support staff and, as a second level, to developers when a request from the Client requires reviewing an incident or service element. Access will be limited to what is necessary for the authorised task.

Skeyon’s staff accesses from Spain and is subject to confidentiality commitments, which will remain in force after the end of their relationship with Skeyon. This location of staff does not constitute a statement about all processing locations of Annex III providers.

The direct exceptional deletion of the database is reserved for the person authorised by Skeyon for this function, internally referred to as the “data controller”. This internal name does not modify the legal roles defined in clause 2 nor does it equate to the appointment of a data protection officer.

6. Security

Skeyon will implement technical and organisational measures appropriate to the risk and will maintain the measures described in Annex II. It will review its adequacy to the nature of the data and the operation of the services.

The technical evolution of the measures will not be able to reduce the protection compromised. The Client shall protect its credentials, limit the permissions of its users and use the available functions in accordance with its own security obligations.

7. Subprocessors

The Client grants general authorization to use the subprocessors identified in Annex III, within the functions described. Skeyon shall impose on them in writing data protection obligations equivalent to those applicable to the processing entrusted to them and shall remain liable to the Client for the fulfillment of these obligations by the subprocessors.

Skeyon will give prior notice of any planned addition or substitution, identifying the provider, its role and the relevant locations. The Client may file an objection based on data protection before the new provider processes its data. A reasonable period of time will be granted to examine the change; the mere silent updating of a website will not be considered sufficient.

The parties will consider a viable alternative to a well-founded opposition. If it cannot be resolved, the affected service may be terminated, applying the return and deletion obligations of this DPA.

According to the scope declared for this release, no external providers are used to execute Skeyon’s commissioned verification checks. Infrastructure providers are listed in Annex III. This provision does not exclude the technical interactions required with the target systems to perform the requested checks.

8. International locations and transfers

The processing locations and providers are described in Annex III. A provider’s registered address does not by itself determine where it processes the data.

Where a processing, remote access or communication constitutes an international transfer, Skeyon will ensure that the requirements of Chapter V of the GDPR are met. Where applicable, an applicable adequacy decision or appropriate safeguards, including standard contractual clauses, will be used with the necessary assessments and complementary measures.

This DPA does not by itself incorporate standard contractual clauses for international transfers or replace the instruments that must be concluded with the recipients. Nor does its acceptance constitute general consent for transfers not covered by the regulations.

9. Customer Rights and Support

Skeyon will assist the Client, taking into account the nature of the processing and the information available, to respond to requests to exercise rights and comply with its obligations in terms of security, impact assessment and prior consultation.

If it directly receives a request regarding data processed on behalf of the Client, it will forward it to the Client without undue delay and will not decide on its merits independently, unless legally required or expressly instructed.

Requests will be dealt with through the functions of the dashboard or, where necessary, through support. Exceptional selective deletion in the database will require a verified request and the necessary identifiers to locate the account and records, and will be executed by Skeyon’s authorized person.

10. Security breaches

Skeyon has an incident management procedure. The support team receives communications and channels them for management.

Skeyon will notify the Client, without undue delay from becoming aware of it, of personal data security breaches affecting the data processed on its behalf. The communication will include the available information on the nature of the incident, the data and persons affected, the likely consequences, the measures taken or proposed and a contact for follow-up.

If it does not initially have all the details, it will provide updates without undue delay. It will collaborate with the Client in the corresponding containment, evaluation and communication actions. The notification will not be delayed until a definitive investigation is available.

11. Retention and end of processing

The differentiated periods in Annex I apply. Temporary retention for verification is not equivalent to the continuous retention that the Customer requests when using Pop-ups or Automation.

At the end of the service, the Customer may request the return of the available data or its deletion. The return will be made by download or an agreed procedure before the deletion period expires. It will not be possible to return data that has already been deleted in accordance with the applicable instructions and deadlines.

Backups pending deletion shall remain protected and shall not be used for ordinary use. If restoration is necessary, previous deletion orders must be complied with to avoid reintroducing deleted data into active use.

Where a legal obligation requires the retention of certain data, only the data necessary shall be retained, restricting its processing to that obligation and deleting it at the end of the required period.

12. Information and audits

Skeyon will make available to the Client the information necessary to prove compliance with this DPA and will allow and contribute to audits and inspections carried out by the Client or an auditor authorized by the Client.

The parties will coordinate the scope, timing and confidentiality measures to protect the data of other clients and the security of the service. Documentary information may be used initially when sufficient, without impeding additional justified verifications or the powers of the supervisory authorities.

13. Electronic validity and acceptance

The DPA will form part of the contractual conditions when it is provided to the Client before contracting and is expressly incorporated into their acceptance. The identity of the Client will be the one stated in the account and contract; whoever accepts on their behalf declares to be entitled to bind them.

Acceptance may be made electronically, keeping evidence of the account, date and accepted version. The mere public availability of the document does not replace its incorporation into the contract. For existing clients, the corresponding adhesion will be documented.

The DPA shall remain in force for as long as Skeyon processes data on behalf of the Client, including subsequent obligations of confidentiality, return and deletion. Material changes shall be communicated and formalized in accordance with the contract and applicable regulations.

14. Relationship to the general terms and conditions

In the event of a contradiction, this DPA shall prevail over the general terms and conditions regarding the processing of data on behalf of the Client. No contractual limitation shall exclude mandatory obligations or responsibilities, rights of data subjects or powers of the authorities.

Spanish law and the GDPR will apply. The resolution of disputes will be governed by the valid provisions of the main contract, respecting the applicable mandatory rules.

Annex I Description of processing and storage

A Data verification

Products: verification of emails, telephone numbers, names and postal addresses, using the contracted methods, including APIs and files.

Purpose and operations: reception, reading, checking, standardisation or correction when part of the product, generation and delivery of results and deletion. The result is used to respond to the Client’s request.

Data: email addresses, telephone numbers, names, surnames, postal addresses, identifiers provided by the Client, validation results and other fields incorporated into the file that are necessary for its processing. The Client must exclude fields that are not for the purpose.

Data subjects: people whose data the Client provides for verification, such as customers, prospects, professional contacts or employees, depending on the use determined by the Client.

Retention: files and results kept for the service for a maximum of 30 days from the date of verification, after which they are deleted.

Contacts and validations for other customers or training of AI models are not reused.

B Pop-ups and Automation

Products: Pop-ups platform and Automation platform, depending on the functionalities contracted and activated.

Purpose and operations: capture, registration, storage, organization, consultation, update, segmentation and execution of the actions or communications configured by the Client, as well as export and deletion. The specific functionalities activated specify the Client’s instructions.

Data: identification and contact data, form fields and required custom fields, subscription preferences and statuses, and interaction or activity data generated by the functionalities used. Product and transaction data, when provided by an activated integration and linked to people, will be processed only within the Customer’s instructions.

Data subjects: visitors who interact with the forms or pop-ups, subscribers, customers, prospects and other persons whose data is lawfully managed by the Customer.

Retention: the data remains for as long as the Customer maintains the service and does not order its deletion. In the event of cancellation or cessation of payment of the corresponding service, it will be deleted within a maximum of 30 days from said event, including copies within that global period. The cessation of payment rule does not apply to a free plan merely because it is free.

C Common rules

Annex II Technical and organisational measures

The measures confirmed for this version are:

• Use of HTTPS/TLS in communications to access services.
• File encryption and backups.
• Role-based access, limited to authorized functions.
• Multi-factor authentication for administrators.
• Access by Skeyon staff from Spain.
• Confidentiality commitments of staff with access.
• Attention to incidents by support and second-level access by developers when necessary for a request from the Client.
• Incident management procedure.
• Deletion of accounts through the panel and exceptional procedure of selective deletion with restricted access to the database.
• Rotation of logs and deletion of copies in accordance with Annex I.

This annex does not declare certifications, annual external audits or specific encryption algorithms that have not been confirmed.

Annex III Subprocessors and infrastructure

Hostalia

Entity: TELEFÓNICA SOLUCIONES DE INFORMÁTICA Y COMUNICACIONES DE ESPAÑA S.A.U.
Brand: Hostelia.
NIF: A78053147.
Address: Ronda de la Comunicación S/N, Distrito C, Edificio Norte 2, 28050 Madrid, Spain.
Role: Hosting, storing, and managing Automation data.
Data location: Madrid, Spain.

Noraina

Entity: Noraina Ltd.
Address: Unit 3D North Point House, North Business Park, Cork, Co. Cork, T23 AT2P, Ireland.
Registration number: 614532.
VAT ID: IE3505981KH.
Function: hosting, storage and data management of verification services and pop-ups.
Data Centers:

Cloudflare

Entity: Cloudflare, Inc.
Address: 101 Townsend Street, San Francisco, California 94107, United States.
US EIN provided: 270805829.
Function: Cache and proxy services for the service infrastructure.
Declared configuration: use of European region.

Reference to European region does not constitute a guarantee of processing exclusively within the European Economic Area. International transfers, where applicable, will be governed by clause 8.