This agreement (the “Agreement”) supplements the General Terms and Conditions and forms an integral part of them. It applies automatically as soon as you use Swimlane, without a separate signature. It is entered into between:
- the Customer, acting as controller (“you”);
- Berenger.dev SRL, Rue Sainte Anne, Termes 8, 6813 Chiny, Belgium, enterprise number 0787.693.448, acting as processor (“we”).
Words and expressions defined in the General Terms and Conditions and in Regulation (EU) 2016/679 (the “GDPR”) have the same meaning here. In the event of a conflict between this Agreement and the General Terms and Conditions concerning data protection, this Agreement prevails.
1. Subject matter and allocation of roles
You decide whom you prospect, which data you import, which messages you send and which automations you configure: you determine the purposes and the essential means of the processing of Customer Data, and you are responsible for it. We process this data solely to provide you with the Service, in accordance with your instructions.
This Agreement does not cover the data that we process as controller (your account, invoicing, security, usage statistics), which is described in the Privacy Policy.
2. Description of the processing
- Nature and purposes: collection from LinkedIn on your instruction, storage, organization, enrichment, analysis (including by artificial intelligence), consultation, sending of messages and performance of actions on LinkedIn, tracking of interactions, export and deletion, for the sole purpose of providing the Service.
- Duration: the term of the contract, and thereafter until the data is deleted in accordance with Article 9.
- Data subjects: your prospects, contacts and LinkedIn connections; the people with whom you exchange messages; the people who view your profile, interact with posts or send you invitations; the Members of your Organization.
- Categories of data: identity and professional information published on LinkedIn (name, photo, title, position, company, industry, location, biography, LinkedIn URL and identifiers); relationship with you (connection degree, invitations, ability to send a message); content of conversations and messages; interactions (profile visits, “Likes”, replies, clicks on tracked links, without IP address); data that you create (notes, tags, lists, pipeline stages, reminders); derived data (engagement scores, fit with the ideal customer profile, analyses and suggestions generated by artificial intelligence, estimated language).
- Special categories: the Service is not intended for processing special categories of data (Article 9 of the GDPR) or data relating to criminal convictions. You undertake not to import such data deliberately.
3. Your instructions
We process Customer Data on your documented instructions. These consist of the General Terms and Conditions, this Agreement and your use of the features and settings of the Service. Any additional instruction must be given in writing and be compatible with the Service.
If an instruction appears to us to infringe the GDPR or another data protection rule, we inform you immediately. If the law requires us to carry out processing, we inform you before carrying it out, unless the law prohibits this.
We may use Customer Data to produce aggregated and anonymized statistics in order to improve the Service. These statistics do not allow you, your Members or the data subjects to be identified, and are never shared with another customer. We do not reuse one customer’s Customer Data for another customer, and we do not use it to train artificial intelligence models.
4. Your obligations
You warrant that the processing of the Customer Data you entrust to us is lawful. In particular, you are required to:
- have a legal basis for each processing operation, in particular for prospecting;
- inform data subjects in accordance with Article 14 of the GDPR, at the latest at the time of your first communication with them, stating in particular the source of the data;
- respect their rights, in particular their right to object to prospecting;
- comply with the rules applicable to commercial communications and with the terms of the platforms you use.
5. Confidentiality
Only the people who need access in order to provide, maintain or secure the Service have access to Customer Data. They are bound by a duty of confidentiality.
6. Security
We implement the appropriate technical and organizational measures described in the annex, which we may change without reducing their overall level of protection.
7. Sub-processors
You give us a general authorization to engage the sub-processors listed on the Sub-processors page, which states, for each of them, its purpose, its location and the applicable transfer mechanism.
- We impose on each sub-processor, by contract, the same data protection obligations as those set out in this Agreement, and remain liable to you for their performance.
- We notify you by email at least 30 days before adding or replacing a sub-processor. You may object on reasonable grounds relating to data protection by writing to hello@getswimlane.com within that period. If we are unable to address your objection, you may terminate free of charge before the change takes effect; the unused part of the paid period of a Subscription is refunded to you.
LinkedIn is not our sub-processor: it is the platform with which you ask us to interact on your behalf, under its own terms.
8. Transfers outside the European Economic Area
Customer Data is hosted in the European Union. Certain sub-processors may access it from a third country or be subject to the law of a third country. Any transfer is governed by an adequacy decision of the European Commission, in particular the EU-U.S. Data Privacy Framework for certified companies, or by the standard contractual clauses adopted by the Commission, supplemented where necessary by additional measures.
9. End of processing
Customer Data is deleted:
- when you delete a contact in the Service, immediately; the other items you delete (lists, campaigns, audiences, tags…) disappear from the Service immediately and are erased from our database 30 days later or, for lists, when the Organization is deleted;
- when you delete your account or your Organization;
- when an Organization has been deactivated for more than 12 months, after a warning sent at least 30 days in advance;
- at the end of the switching procedure provided for in Article 16 of the General Terms and Conditions, after the retrieval period;
- if we stop operating Swimlane, at the end of the notice period provided for in Article 10 of the General Terms and Conditions.
Before deletion, you may retrieve your data as set out in Article 16 of the General Terms and Conditions. Backup copies are erased as they are rotated, no later than 14 days after deletion. We do not retain any Customer Data beyond these deadlines, unless required to do so by law.
10. Assistance
- Data subjects’ rights. The Service allows you to view, correct, export and delete a person’s data. If a data subject contacts us directly about Customer Data, we forward their request to you without delay and do not respond to it on the merits without your instruction, except to tell them to contact you.
- Security, impact assessments and prior consultation. We provide you with the information available to us that you reasonably need to comply with Articles 32 to 36 of the GDPR.
11. Data breaches
We notify you of any personal data breach affecting Customer Data without undue delay and no later than 48 hours after becoming aware of it. The notification describes, as far as possible, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences and the measures taken or proposed. We supplement this information as it becomes available.
12. Audit
We make available to you the information necessary to demonstrate compliance with this Agreement. If this information is not sufficient, you may, once a year and subject to 30 days’ notice, have an audit carried out at your own expense, by yourself or by an independent auditor bound by confidentiality, without disrupting the Service or accessing other customers’ data. An additional audit is possible following a data breach affecting you or at the request of a supervisory authority.
13. Liability and term
Each party’s liability under this Agreement is governed by the rules of the General Terms and Conditions, without prejudice to the rights of data subjects under Article 82 of the GDPR. This Agreement applies for as long as we process Customer Data on your behalf.
Annex — Technical and organizational measures
- Hosting: application servers and database located in France; files stored in the Netherlands.
- Encryption in transit: all communications with the Service and with LinkedIn go through encrypted connections (TLS).
- Encryption at rest of LinkedIn access: the session cookies and the email address of your LinkedIn account are encrypted (AES-256-GCM). Your LinkedIn password is not stored, and password saving is disabled in the browsers we run. Our servers must be able to decrypt the session in order to act on your behalf: the key is kept separately from the database, in the server configuration.
- Service passwords: stored in hashed form.
- Segregation: Customer Data is attached to an Organization and is accessible only to its Members; technical caches relating to LinkedIn are specific to each connected account.
- Access control: access to production is limited to the people who need it, using individual credentials; the internal statistics tool reads only restricted views, with no access to login credentials or LinkedIn sessions.
- Minimization: no IP address stored for clicks on tracked links; technical logs of calls to LinkedIn kept for 7 days; other technical logs kept for no more than 12 months.
- Backups: daily database backup, retained for 14 days.
- Action limits: daily caps, random spacing and time windows for actions performed on LinkedIn.
- Incidents: application errors are reported automatically; any data breach is handled and notified in accordance with Article 11.