How we process personal data for you

01What this agreement covers

This data processing agreement (“DPA”) is between the customer that accepts it (“you”, the controller) and Programmable LLC, 3607 10th Street Northwest, Washington, DC 20010, United States (“we”, the processor). It forms part of the Terms of Service and applies whenever we process personal data on your behalf while providing Growth Playbook. To accept it, email [email protected] from the address on your playbook with your company name; we’ll countersign and return a copy. It applies from that date, and to processing that has already taken place for you.

For most of what Growth Playbook does we are an independent controller: we research your company from public sources and write a playbook for the person who asked. This DPA covers the part where we process personal data for you: the names, roles and contact details that appear in the material you give us or ask us to research, and the recipients you add to a playbook.

02What we process for you

• Subject matter and purpose: researching your company and its market, writing and refreshing your playbook, and delivering it where you ask (the page, PDFs, exports, email).
• Personal data: business contact details of people at your company and in your market as they appear in the notes you add, the material you provide, and public sources: names, job titles, employers, work emails, public profile URLs. No special categories (health, religion, politics and the like) and no data about children; the Service must not be used for them.
• Data subjects: your staff, customers, prospects and competitors’ staff, as they appear in that material.
• Duration: the life of your playbook; deleted within 30 days of its deletion or of closing your account, except billing records kept as tax law requires.

03Our obligations as processor

• We process personal data only on your documented instructions, which are the Terms, this DPA, and what you ask the Service to do. We’ll tell you if we think an instruction breaks the law.
• We keep the personal data we process for you confidential, and everyone who works on the Service is bound by confidentiality.
• We keep the security measures in section 5, and won’t reduce them during the term.
• We help you respond to data-subject requests and to your own security and impact-assessment obligations, as far as the Service allows.
• We notify you without undue delay, and in any case within 72 hours, of a personal data breach affecting your data, with what we know and what we’re doing.
• On termination, we delete the personal data we hold for you within 30 days, unless the law requires us to keep it.
• We make available the information needed to show compliance, and allow audits by you or an auditor you appoint, on reasonable notice, no more than once a year unless a breach or a regulator requires otherwise.

04Your obligations as controller

You are responsible for having a lawful basis for the personal data you give us or ask us to research, for honouring the rights of the people concerned, and for using the playbook in line with the law (including direct-marketing rules). You warrant that your instructions to us are lawful.

05Subprocessors

You authorise the subprocessors below. We’ll email you at least 30 days before adding one; you may object on reasonable data-protection grounds and, if we can’t resolve it, end the affected service.

Stripe acts as merchant of record for purchases and is an independent controller, not our subprocessor. Optional integrations we may switch on (Groq, Resend, Apify, Apollo.io) are listed in the Privacy Policy and become subprocessors, with notice, only if we start using them for your data.

06Security measures

• Encryption in transit everywhere (TLS 1.2+); secrets and integration keys encrypted at rest or stored as hashes.
• Servers reachable only through Cloudflare; firewalling on ingress and egress; SSH by key only; no shared accounts.
• Every server-side fetch goes through an outbound guard that allows only public addresses, so research cannot be pointed at internal systems.
• Access to production is limited to the people who operate the Service, with logging.
• Error reports have personal data removed before they leave the server.

07Where data is processed

Our servers and database are in the United States (Virginia), and our subprocessors are listed in section 5. Where you are established in the EU, the EEA or the UK, transfers to us are made under the standard contractual clauses (module two, controller to processor, with the UK addendum where it applies), which we will sign on request and which then form part of this DPA.

08General

If this DPA conflicts with the Terms, this DPA wins for personal-data matters. Our liability under this DPA is subject to the limits in the Terms. This DPA lasts as long as we process personal data for you. It is governed by the same law as the Terms, except where section 7 says otherwise. Questions: [email protected].