Data processing addendum
How we process the details of the people your agent contacts, on your instructions.
The page in three cards
You are the controller
You decide who is contacted and approve every message. We process on your instructions.
Sub-processors
Google Cloud, Cloudflare, ZeptoMail by Zoho and your own mail provider. 30 days' notice of any change.
Deletion
When your subscription ends, we stop processing and delete the data.
Parties and scope
This data processing addendum ("DPA") forms part of the terms of service between Media Experts Pvt Ltd ("we", the processor) and the customer who holds a BacklinkReach account (the controller). It applies when we process personal data on the customer's behalf in providing the service, and it is written to meet Article 28 of the GDPR and the corresponding rules of other data protection laws, including India's Digital Personal Data Protection Act, 2023, where they apply.
What we process
| Item | Details |
|---|---|
| Data subjects | People the customer's agent identifies or contacts for outreach: editors, writers, site owners and staff of the sites concerned. Also people who reply to the customer's messages. |
| Personal data | Name, role, business email address and the public page it was found on; the content of messages the customer approves and sends; replies and their headers. |
| Special categories | None are intended. The customer should not instruct the agent to process special-category data. |
| Purpose | Finding relevant pages and contacts, drafting one-to-one outreach for the customer's approval, sending approved messages from the customer's mailbox, labelling replies, drafting answers, and monitoring links won. |
| Duration | For the term of the customer's subscription, and until deletion under this DPA. |
The customer's instructions
We process the personal data only on the customer's documented instructions. The customer's instructions are the terms of service, this DPA, the settings the customer chooses in the product, and the approvals the customer gives, including the approval of each message before it is sent. If we believe an instruction breaks data protection law, we will tell the customer. If the law requires us to process data otherwise, we will tell the customer first unless the law forbids it.
The customer is responsible for having a lawful basis for the outreach it approves, for the content of its messages, and for honouring objections and opt-outs.
Confidentiality and security
Everyone at Media Experts Pvt Ltd who can access the personal data is bound by a duty of confidentiality. We keep technical and organisational measures appropriate to the risk, including encryption of stored data at rest on Google Cloud, encryption in transit with HTTPS, access to production systems limited to the people who run the service, and mailbox access that the customer grants through the mail provider and can revoke at any time.
Sub-processors
The customer gives general authorisation for us to use sub-processors. The current list is:
| Sub-processor | Purpose |
|---|---|
| Google Cloud | Hosting and processing: the application, its database, the crawler and the agent's work |
| Cloudflare | DNS, content delivery and protection from abusive traffic for the public site |
| ZeptoMail by Zoho | Transactional email: sign-in codes, receipts, account notices. Not outreach. |
| Your own mail provider | Outreach messages you approve are sent from your connected mailbox, through the provider you already use |
| Our payment provider | Card payments for your plan. We do not receive or store your full card number. |
We bind each sub-processor to data protection terms that give at least the same protection as this DPA, and we remain responsible for their performance. We give the customer at least 30 days' notice by email before adding or replacing a sub-processor. The customer may object on reasonable data protection grounds within that period; if we cannot address the objection, the customer may cancel and receive a refund of the unused part of the current period.
Helping the customer
Taking into account the nature of the processing, we help the customer answer requests from data subjects to exercise their rights, including objections and deletion requests, and we pass on any such request we receive directly. We also give reasonable help with data protection impact assessments and with consultations with authorities, where they relate to our processing.
Personal data breaches
We notify the customer without undue delay after becoming aware of a personal data breach affecting the customer's data, with the information we have about its nature, likely consequences and the measures taken, and we update the customer as we learn more.
International transfers
Personal data may be processed in India and in the countries where our sub-processors operate. Where a transfer of personal data from the European Economic Area, the United Kingdom or Switzerland needs a transfer mechanism, the parties rely on the standard contractual clauses approved for that purpose, and on the equivalent terms our sub-processors offer.
Deletion on termination
When the subscription ends, we stop processing the customer's personal data except to delete it. We delete the personal data processed under this DPA, including prospect details, messages and replies held in the service, after termination, unless the law requires us to keep it. Before termination the customer can export its data from the account. Records of objections may be kept, without other content, so that an objection continues to be respected if the customer returns.
Information and audits
We make available the information reasonably needed to show compliance with this DPA, and answer reasonable written questions about our processing. Where the law gives the customer a right to audit, the customer may exercise it on reasonable notice, at its own cost, in a way that protects other customers' data and our confidential information.
Order of precedence
If this DPA and the terms of service conflict on the processing of personal data, this DPA wins. Liability under this DPA is subject to the limits in the terms of service, to the extent the law allows.
Contact
For questions about this DPA, use the form inside your account, or write to the address on your receipt.