Data Processing Addendum

Parties and scope

This Data Processing Addendum ("DPA") forms part of the Terms of Service between you, the Subscriber, and Brewcode LLC ("Brewcode", "FirstAsk", "we"). It applies where you are a controller of personal data processed through the Service — for example teammates' account details, or notes you keep about Leads — and we act as your processor for that data. It does not apply to Poster data we index under our own legitimate interests, for which we are an independent controller (see the Privacy Policy, Section 3).

Processor: Brewcode LLC, 1130 Ogletown Road, PMB # 1857, Suite 2, Newark, Delaware 19711, USA — a subsidiary of Brewcode Technologies Private Limited, #198, CMH Road, 2nd Floor, Desk No. 269, Indiranagar, Bangalore, India – 560038.

Our obligations

• Process personal data only on your documented instructions, which are the Service as configured by you, unless required by law;
• ensure staff with access are bound by confidentiality;
• apply appropriate technical and organisational measures, including encryption in transit and at rest, least-privilege access, audit logging and field-level encryption of secrets;
• assist you, at your reasonable request and cost, with data-subject requests and with your own compliance obligations;
• delete or return personal data at the end of the agreement, subject to the retention periods in the Privacy Policy and any legal requirement to retain; and
• make available the information reasonably needed to demonstrate compliance with this DPA.

Sub-processors

You authorise the sub-processors listed in the Privacy Policy. We give at least 30 days' notice of additions by email; you may object on reasonable, documented grounds, in which case we will work with you in good faith and, failing agreement, either party may terminate the affected part of the Service.

Onward recipients

If you export Leads (CSV, API, webhooks) you become an independent controller for what you export. You agree to process exported personal data lawfully, to honour deletion requests we forward to you about a Lead you exported within 7 days, and not to use exported data to build profiles of, or a contact database about, Posters.

International transfers

Personal data is processed in the United States and by sub-processors in the regions stated in the Privacy Policy. Where a transfer requires safeguards, the parties incorporate the EU Standard Contractual Clauses (Module 2, controller to processor) and the UK International Data Transfer Addendum, and this DPA supplies the required details.

Breach notification

We notify you without undue delay, and in any case within 72 hours of becoming aware, of a personal data breach affecting your data, with the information reasonably available to us at the time and further updates as our investigation proceeds.

Liability

The limitations and exclusions of liability in the Terms of Service apply to this DPA. Each party remains liable for its own compliance with applicable data-protection law.

Contact us

DPA questions? Write to Brewcode LLC (operator of FirstAsk) at [email protected].

• Registered address: 1130 Ogletown Road, PMB # 1857, Suite 2, Newark, Delaware 19711, USA
• Parent company: Brewcode Technologies Private Limited, #198, CMH Road, 2nd Floor, Desk No. 269, Indiranagar, Bangalore, India – 560038
• Response time: within 30 days, or sooner where required by law