This Data Processing Addendum ("DPA") forms part of the agreement between the customer ("Customer" or "you") and Unity Space SLU, Calle Lirica 9, Spain ("we", "us") under which we provide the Kercel service (the "Service"). This DPA sets out the terms on which we process personal data on your behalf.
1. Roles
- Where we process personal data that you provide or direct us to process in order to provide the Service, you are the controller and we are the processor.
- Where we collect information from public sources to build and maintain our index of business profiles, and to derive signals and scores, we act as an independent controller of that processing. That processing is described in our Privacy Policy and is not covered by this DPA.
- Where you export or otherwise use leads obtained through the Service for your own outreach, you act as an independent controller of that use, and this DPA does not apply to it.
2. Processing details
Where we act as a processor, the processing is described in Annex A. Unless you tell us otherwise, the processing we perform as a processor is limited to data you submit to the Service (such as ICP descriptions, search terms and configuration), and to account and usage data needed to provide the Service.
3. Our obligations as processor
- We process personal data only on your documented instructions, except where required by law (in which case we inform you first, unless the law prevents us).
- We ensure that persons authorised to process the data have committed to confidentiality.
- We implement appropriate technical and organisational security measures (see Annex B).
- We do not engage sub-processors without appropriate safeguards. You authorise our current sub-processors (listed on our Subprocessors page) and we will notify you of any additions or changes so you can object.
- We assist you, to the extent possible, in responding to data subject requests and in complying with your obligations regarding security, breach notification, data protection impact assessments and prior consultations.
- We notify you without undue delay if we become aware of a personal data breach affecting data we process on your behalf.
- On termination of the Service, we delete or return personal data processed on your behalf in accordance with our Privacy Policy retention terms, unless law requires storage.
- We make available to you the information necessary to demonstrate compliance with this DPA, and allow audits and inspections to the extent required by law, on reasonable notice and subject to confidentiality.
4. International transfers
Where we transfer personal data outside the EEA, the UK or Switzerland, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Agreement where applicable) and, where available, the EU-US / UK / Swiss Data Privacy Frameworks. A copy of the relevant safeguards is available on request from privacy@kercel.io.
5. Data subject rights
We will promptly forward to you any request from a data subject concerning data we process on your behalf, and (taking into account the nature of the processing) assist you in fulfilling your obligations to respond to those requests. Where a data subject contacts us directly about data you control, we will direct them to you and, where required, handle the request in accordance with your instructions and applicable law.
6. Liability
Our liability under this DPA is subject to the limitation of liability provisions in the Terms of Service. Nothing in this DPA limits either party's liability for its own breach of the GDPR or for claims from data subjects arising from its own processing.
7. Term
This DPA applies from the date the Customer begins using the Service and remains in effect until the Service is terminated and we have deleted or returned the personal data processed under it.
Annex A — Details of processing
| Item | Details |
|---|---|
| Subject matter | Provision of the Kercel lead-intelligence service, including scanning, scoring, dashboards, digests and support. |
| Categories of data subjects | Customers' authorised users and, where you direct us, the business contacts and configuration you submit to the Service. |
| Categories of personal data | Account and usage data; configuration you submit (ICPs, terms, competitors); any personal data contained in content you upload to the Service. |
| Purposes | Providing the Service, managing accounts and subscriptions, supporting users, securing the Service. |
| Retention | While your account is active, and for as long as we are required to keep it by law or to defend legal claims. See our Privacy Policy. |
| Sub-processors | See the current list on our Subprocessors page. |
Annex B — Security measures
- Encryption of data in transit (TLS) and at rest.
- Access controls and authentication (including single sign-on where supported) limiting access to authorised personnel.
- Logical and physical security of our hosting infrastructure provided by our cloud providers.
- Monitoring, logging and alerting (including error monitoring and observability tooling) to detect and respond to incidents.
- Regular backups with defined retention to support recovery.
Contact
For questions about this DPA, contact us at privacy@kercel.io or write to Unity Space SLU, Calle Lirica 9, Spain.