Sign inCreate account
Menu
Painting of a woman writing a letter while her maid waits by the window
Watercolour of a girl writing at a desk in a room full of plants
A handwritten letter from 1585, opened flat, with its address on the back
A brass pen nib, close up

Data processing agreement

How Scrisly processes the personal data in your campaigns on your behalf under Art. 28 GDPR, and how to get the signed agreement.

Data processing agreement

Draft. This text describes how Scrisly works today. A lawyer reviews it before public launch, so it may still change. Highlighted passages are details still to be filled in.

When you use Scrisly, you decide who your campaigns write to and why. For the personal data in your workspace you are the controller and Scrisly is your processor (Art. 28 GDPR). This page sums up the agreement that covers it. [How to get the signed agreement].

What we process for you

  • Whose data: the contacts in your campaigns, the people who reply to you, and your own users.
  • What data: names, business email addresses, roles, company details, the emails written and sent, replies and their labels and summaries.
  • What for: finding and checking leads, writing and spam-checking emails, sending the ones you approve, reading and sorting replies, and honouring opt-outs.
  • How long: while your workspace exists; the privacy policy says what is deleted and what stays when you delete a contact or a workspace.

What we commit to

  • Process the data only on your documented instructions, which are your settings and actions in the app.
  • Bind everyone with access to confidentiality.
  • Keep the security measures described in the privacy policy: encrypted connections, sealed mailbox passwords, workspace data kept apart by the database itself, a second factor for staff.
  • Use only the subprocessors listed, and tell you before adding or changing one, so you can object.
  • Help you answer people's requests about their data and with data protection impact assessments where needed.
  • Tell you without undue delay after we learn of a personal data breach that affects your data.
  • At the end, delete your data with your workspace, except what the law or the opt-out records require us to keep.
  • Make available the information needed to show we comply, and allow audits under [audit terms].

The shared pool is different

Company and contact details that Scrisly finds on public websites are kept in a pool shared by all workspaces. For that pool Scrisly is the controller, not your processor; the privacy policy covers it.

Business contacts you choose to share with Scrisly when you upload a list are outside this agreement once shared: Scrisly holds its copy as controller, as the privacy policy says. [The agreement's wording on contacts shared from uploads].