Haku
Book a demo
Data Processing Agreement

Annex I — Processing Details

Haku Labs Ltd · Company number 16248507 ← Back to the DPA

This Annex forms part of, and is incorporated into, the Data Processing Agreement between the Controller and the Processor (the "DPA"). It sets out the subject matter, duration, nature and purpose of the processing, the types of Personal Data and the categories of data subjects, for the purposes of Article 28(3) UK GDPR. Terms defined in the DPA have the same meaning in this Annex.

Sections 1 to 5 describe the processing carried out by the Processor in its capacity as processor of Controller Personal Data under clause 3.1 of the DPA. Section 6 describes, for transparency only, the processing carried out by the Processor as an independent controller under clause 3.2; it does not form part of the Article 28(3) description.

1. Categories of Data Subject

Category
Description
Source
Authorised Users
The Controller's personnel holding accounts on the Services, including sales representatives, managers and administrators.
Provided by the Controller at provisioning.
Prospective Business Contacts
Individuals at target companies identified by reference to the Controller's targeting criteria, and individuals on company lists supplied by the Controller.
Sourced by the Processor and adopted by the Controller on launch of an outbound sequence.
Reply and Thread Participants
Individuals who reply to outbound communications sent through the Services, and third parties copied into those communications who were not themselves targeted.
Received inbound through the Controller's connected mailboxes and social accounts.
Call Participants
Individuals party to outbound or forwarded inbound telephone calls placed through the Services.
Generated in the course of the Services.

2. Types of Personal Data

Type
Fields
Identity
First name, last name, salutation.
Business contact
Work email address, personal email address where returned by an enrichment provider, direct and switchboard telephone numbers, mobile telephone number, social profile URL.
Professional
Job title, seniority, function or department, employer name, employer domain, employer size and location, country and region.
Derived and inferred
Research evidence and source citations concerning the individual's employer; buying signals and triggers attributed to that employer; qualification verdicts and rejection reasons; profile-fit scoring; recency assessment of evidence.
Communications content
Outbound email and social message content naming and addressing the individual; connection request notes; inbound replies and thread content; call notes and dispositions recorded by Authorised Users.
Engagement and technical
Send, delivery, open and reply events with timestamps; message identifiers and threading headers; connection invitation and acceptance state; call session metadata comprising direction, duration, status, dialled number and caller identity; sequence and step state.
Authentication
In respect of Authorised Users only: email address, display name, identity provider subject identifier, role and organisation membership, session state and multi-factor authentication state.
Call audio and transcripts
Where the Controller enables call recording, the audio recording of a call and any transcript derived from it. Recording is disabled by default and is subject to the consent controls described in Annex II.

3. Special Categories of Personal Data

3.1 No special categories of Personal Data within the meaning of Article 9 UK GDPR, and no Personal Data relating to criminal convictions and offences within the meaning of Article 10 UK GDPR, are intentionally requested, processed or stored by the Processor in connection with the Services.

3.2 The Parties acknowledge that two categories of unstructured content processed under this DPA may incidentally contain such data, namely free-text research evidence and the content of inbound replies. The Processor does not index, enrich, infer from or otherwise process that content by reference to any special category, and applies the same technical and organisational measures to it as to all other Controller Personal Data.

4. Nature and Purpose of the Processing

The Processor processes Controller Personal Data for the following purposes:

  • Matching and enrichment - matching records supplied by the Controller against the Processor's data sources and third-party providers, and enriching them with business contact and professional data.
  • Audience construction - applying the Controller's targeting criteria to identify candidate companies and contacts, and excluding companies the Controller has designated or already holds in its customer relationship management system.
  • Research and qualification - gathering publicly available evidence concerning target companies against the buying signals specified by the Controller, and recording a qualification verdict.
  • Content generation - generating outbound message content personalised to the individual and their employer.
  • Outbound execution - sending email and social messages and connection requests, and placing telephone calls, on the schedule and through the channels configured by the Controller.
  • Reply handling - receiving, threading and classifying inbound replies and surfacing them to Authorised Users.
  • Synchronisation - writing contact, company and activity records to the Controller's own customer relationship management system on the Controller's instruction.
  • Reporting and support - producing analytics in respect of the foregoing, and providing technical support to the Controller.

5. Duration, Frequency and Retention

5.1 Frequency. The processing is continuous for the term of the Service Agreement.

5.2 Duration. The processing continues for the term of the Service Agreement and thereafter only as provided in clause 8 of the DPA.

5.3 Retention schedule. The Processor retains Controller Personal Data in accordance with the following schedule. Where a period is expressed as "term plus", the data is deleted from active production systems within ninety (90) days of termination or expiry of the Service Agreement in accordance with clause 8.2 of the DPA.

Data
Retention period
Basis
Authorised User account data
Term plus 90 days
Necessary to provide the Services.
Prospect contact records forming part of an active or completed outbound sequence
Term plus 90 days
Necessary to provide the Services and to evidence what was sent.
Prospect contact records sourced but never contacted
12 months from creation
No longer necessary once not adopted into a sequence.
Research evidence and qualification verdicts
24 months from creation
Evidence loses probative value with age; superseded by re-research.
Outbound message content and inbound replies
Term plus 90 days
Necessary to provide the Services.
Engagement events
24 months from creation
Reporting.
Call session metadata
24 months from creation
Reporting and fair-usage accounting.
Call audio recordings and transcripts
6 months from the call
Minimised in view of sensitivity.
Application audit logs
30 days
Operational only.
Product analytics events
25 months from creation
Aggregate service improvement.
Data subject request ledger
6 years from closure of the request
Article 5(2) accountability; retained after the underlying data is erased.
Suppression list identifiers
Retained for as long as the Processor operates the Services
Article 17(3)(b); the minimum data necessary to recognise and skip a data subject who has exercised a right.
Backups
35 days rolling
See Annex II, section 4.

5.4 Retention is enforced by automated deletion. Where a longer period is required by law, or the Controller has given a specific written retention instruction, clause 8.5 of the DPA applies.

6. Processing by the Processor as Independent Controller

6.1 This section is recorded for transparency. It describes Haku Sourced Data under clause 3.2 of the DPA and does not form part of the Article 28(3) description in sections 1 to 5.

6.2 The Processor collects, compiles, verifies and enriches business contact and firmographic data from publicly available sources, from third-party data providers and from its own research, in order to maintain its contact database and to provide and improve the Services generally.

6.3 The lawful basis for that processing is legitimate interests under Article 6(1)(f) UK GDPR. The Processor maintains a documented legitimate interests assessment and balancing test in respect of it, publishes the transparency information required by Article 14 UK GDPR, handles data subject rights requests it receives in respect of that data, and maintains its own record of processing activities.

6.4 The vendors engaged by the Processor in that capacity are disclosed in Annex III, section 3, and in the Processor's Article 14 transparency notice. They do not receive Controller Personal Data.

Annex I - Processing Details — Haku
Data Processing Agreement

Annex I — Processing Details

Haku Labs Ltd · Company number 16248507 ← Back to the DPA

This Annex forms part of, and is incorporated into, the Data Processing Agreement between the Controller and the Processor (the "DPA"). It sets out the subject matter, duration, nature and purpose of the processing, the types of Personal Data and the categories of data subjects, for the purposes of Article 28(3) UK GDPR. Terms defined in the DPA have the same meaning in this Annex.

Sections 1 to 5 describe the processing carried out by the Processor in its capacity as processor of Controller Personal Data under clause 3.1 of the DPA. Section 6 describes, for transparency only, the processing carried out by the Processor as an independent controller under clause 3.2; it does not form part of the Article 28(3) description.

1. Categories of Data Subject

Category
Description
Source
Authorised Users
The Controller's personnel holding accounts on the Services, including sales representatives, managers and administrators.
Provided by the Controller at provisioning.
Prospective Business Contacts
Individuals at target companies identified by reference to the Controller's targeting criteria, and individuals on company lists supplied by the Controller.
Sourced by the Processor and adopted by the Controller on launch of an outbound sequence.
Reply and Thread Participants
Individuals who reply to outbound communications sent through the Services, and third parties copied into those communications who were not themselves targeted.
Received inbound through the Controller's connected mailboxes and social accounts.
Call Participants
Individuals party to outbound or forwarded inbound telephone calls placed through the Services.
Generated in the course of the Services.

2. Types of Personal Data

Type
Fields
Identity
First name, last name, salutation.
Business contact
Work email address, personal email address where returned by an enrichment provider, direct and switchboard telephone numbers, mobile telephone number, social profile URL.
Professional
Job title, seniority, function or department, employer name, employer domain, employer size and location, country and region.
Derived and inferred
Research evidence and source citations concerning the individual's employer; buying signals and triggers attributed to that employer; qualification verdicts and rejection reasons; profile-fit scoring; recency assessment of evidence.
Communications content
Outbound email and social message content naming and addressing the individual; connection request notes; inbound replies and thread content; call notes and dispositions recorded by Authorised Users.
Engagement and technical
Send, delivery, open and reply events with timestamps; message identifiers and threading headers; connection invitation and acceptance state; call session metadata comprising direction, duration, status, dialled number and caller identity; sequence and step state.
Authentication
In respect of Authorised Users only: email address, display name, identity provider subject identifier, role and organisation membership, session state and multi-factor authentication state.
Call audio and transcripts
Where the Controller enables call recording, the audio recording of a call and any transcript derived from it. Recording is disabled by default and is subject to the consent controls described in Annex II.

3. Special Categories of Personal Data

3.1 No special categories of Personal Data within the meaning of Article 9 UK GDPR, and no Personal Data relating to criminal convictions and offences within the meaning of Article 10 UK GDPR, are intentionally requested, processed or stored by the Processor in connection with the Services.

3.2 The Parties acknowledge that two categories of unstructured content processed under this DPA may incidentally contain such data, namely free-text research evidence and the content of inbound replies. The Processor does not index, enrich, infer from or otherwise process that content by reference to any special category, and applies the same technical and organisational measures to it as to all other Controller Personal Data.

4. Nature and Purpose of the Processing

The Processor processes Controller Personal Data for the following purposes:

  • Matching and enrichment - matching records supplied by the Controller against the Processor's data sources and third-party providers, and enriching them with business contact and professional data.
  • Audience construction - applying the Controller's targeting criteria to identify candidate companies and contacts, and excluding companies the Controller has designated or already holds in its customer relationship management system.
  • Research and qualification - gathering publicly available evidence concerning target companies against the buying signals specified by the Controller, and recording a qualification verdict.
  • Content generation - generating outbound message content personalised to the individual and their employer.
  • Outbound execution - sending email and social messages and connection requests, and placing telephone calls, on the schedule and through the channels configured by the Controller.
  • Reply handling - receiving, threading and classifying inbound replies and surfacing them to Authorised Users.
  • Synchronisation - writing contact, company and activity records to the Controller's own customer relationship management system on the Controller's instruction.
  • Reporting and support - producing analytics in respect of the foregoing, and providing technical support to the Controller.

5. Duration, Frequency and Retention

5.1 Frequency. The processing is continuous for the term of the Service Agreement.

5.2 Duration. The processing continues for the term of the Service Agreement and thereafter only as provided in clause 8 of the DPA.

5.3 Retention schedule. The Processor retains Controller Personal Data in accordance with the following schedule. Where a period is expressed as "term plus", the data is deleted from active production systems within ninety (90) days of termination or expiry of the Service Agreement in accordance with clause 8.2 of the DPA.

Data
Retention period
Basis
Authorised User account data
Term plus 90 days
Necessary to provide the Services.
Prospect contact records forming part of an active or completed outbound sequence
Term plus 90 days
Necessary to provide the Services and to evidence what was sent.
Prospect contact records sourced but never contacted
12 months from creation
No longer necessary once not adopted into a sequence.
Research evidence and qualification verdicts
24 months from creation
Evidence loses probative value with age; superseded by re-research.
Outbound message content and inbound replies
Term plus 90 days
Necessary to provide the Services.
Engagement events
24 months from creation
Reporting.
Call session metadata
24 months from creation
Reporting and fair-usage accounting.
Call audio recordings and transcripts
6 months from the call
Minimised in view of sensitivity.
Application audit logs
30 days
Operational only.
Product analytics events
25 months from creation
Aggregate service improvement.
Data subject request ledger
6 years from closure of the request
Article 5(2) accountability; retained after the underlying data is erased.
Suppression list identifiers
Retained for as long as the Processor operates the Services
Article 17(3)(b); the minimum data necessary to recognise and skip a data subject who has exercised a right.
Backups
35 days rolling
See Annex II, section 4.

5.4 Retention is enforced by automated deletion. Where a longer period is required by law, or the Controller has given a specific written retention instruction, clause 8.5 of the DPA applies.

6. Processing by the Processor as Independent Controller

6.1 This section is recorded for transparency. It describes Haku Sourced Data under clause 3.2 of the DPA and does not form part of the Article 28(3) description in sections 1 to 5.

6.2 The Processor collects, compiles, verifies and enriches business contact and firmographic data from publicly available sources, from third-party data providers and from its own research, in order to maintain its contact database and to provide and improve the Services generally.

6.3 The lawful basis for that processing is legitimate interests under Article 6(1)(f) UK GDPR. The Processor maintains a documented legitimate interests assessment and balancing test in respect of it, publishes the transparency information required by Article 14 UK GDPR, handles data subject rights requests it receives in respect of that data, and maintains its own record of processing activities.

6.4 The vendors engaged by the Processor in that capacity are disclosed in Annex III, section 3, and in the Processor's Article 14 transparency notice. They do not receive Controller Personal Data.