Data Processing Agreement

Last updated: October 31, 2026

This Data Processing Agreement (“DPA”) is part of the Netwarm Terms of Service between the company registered in France under SIREN 942232950 (“Netwarm”, the “Processor”) and the customer who accepted those Terms (the “Customer”, the “Controller”). It applies whenever Netwarm processes personal data on the Customer’s behalf, and meets the requirements of Article 28 of the GDPR.

If this DPA and the Terms disagree on data protection, this DPA wins.

1. Definitions

Terms such as “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meaning given in the EU General Data Protection Regulation 2016/679 (“GDPR”). “Customer Personal Data” means the personal data described in Annex 1 that Netwarm processes on the Customer’s behalf.

2. Roles

Netwarm as processor. For Customer Personal Data, the Customer is the controller and Netwarm is the processor. This covers what the Customer adds or collects through Netwarm: notes, stages, targets assigned to people, contact details, Reveal visitor details, scheduled content, and the personal data of team members the Customer invites.

Netwarm as independent controller. Netwarm is an independent controller, not a processor, for:

• the public professional profile and engagement data it collects about people who engage with tracked LinkedIn profiles, as described in the Netwarm Privacy Policy
• the Customer’s own account, billing and usage data

This DPA doesn’t apply to that data.

3. Customer’s obligations

The Customer:

• has a valid legal basis for the Customer Personal Data it adds to or collects through Netwarm, and gives data subjects the information the law requires
• only gives instructions that comply with data protection law
• is responsible for how it uses the data, including any contact it makes with data subjects

4. Netwarm’s obligations

Netwarm:

• processes Customer Personal Data only on the Customer’s documented instructions. The Terms, this DPA and the Customer’s use of Netwarm’s features are those instructions. If Netwarm believes an instruction breaks data protection law, it tells the Customer.
• makes sure everyone authorized to process Customer Personal Data is bound by confidentiality
• applies the security measures in Annex 2
• doesn’t sell Customer Personal Data or use it for its own purposes, except to provide, secure and support the service

5. Sub-processors

The Customer gives Netwarm general authorization to use sub-processors. The current list is in Annex 3.

Netwarm:

• binds each sub-processor to data protection obligations at least as protective as this DPA
• remains responsible to the Customer for its sub-processors
• informs the Customer by email at least 30 days before adding or replacing a sub-processor

The Customer may object to a new sub-processor on reasonable data protection grounds within those 30 days by writing to max@netwarm.com. If the parties can’t resolve the objection, the Customer may cancel its subscription before the change applies.

6. International transfers

Netwarm’s sub-processors are located in the United States, outside the European Economic Area. Netwarm makes sure each transfer is covered by an adequacy decision, including the EU–US Data Privacy Framework where the recipient is certified, or by the European Commission’s Standard Contractual Clauses.

7. Helping the Customer

Data subject requests. Netwarm gives the Customer the tools to answer data subject requests itself: editing and deleting people, notes and contact details, exporting data as CSV, and deleting all captured data. If Netwarm receives a request about Customer Personal Data directly, it forwards it to the Customer without delay and doesn’t answer it on the Customer’s behalf, unless the request also concerns data Netwarm controls.

Other assistance. Netwarm provides reasonable help with the Customer’s security obligations, data protection impact assessments and consultations with supervisory authorities, taking into account the nature of the processing and the information available to Netwarm.

8. Personal data breaches

Netwarm notifies the Customer without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting Customer Personal Data. The notification describes, as far as known at the time:

• the nature of the breach, the categories and approximate number of people and records affected
• its likely consequences
• the measures taken or proposed to address it

Netwarm sends further information as it becomes available, and takes reasonable steps to contain the breach and limit its effects.

9. Deletion and return

During the subscription, the Customer can export or delete Customer Personal Data at any time from Settings.

When the Customer closes its account, Netwarm deletes Customer Personal Data within 30 days, unless the law requires Netwarm to keep it. Backups are overwritten in their normal cycle, within 30 days.

10. Audits

On request, Netwarm makes available the information needed to show compliance with this DPA, including answers to reasonable security questionnaires.

If that information isn’t enough, the Customer may carry out an audit, itself or through an independent auditor bound by confidentiality, with at least 30 days’ written notice, no more than once a year, during business hours and without disrupting the service. The Customer bears the cost of the audit. A supervisory authority may audit at any time.

11. Liability

Each party’s liability under this DPA is subject to the limits in the Terms, except where the law doesn’t allow those limits.

12. Term

This DPA applies for as long as Netwarm processes Customer Personal Data. Sections 8 and 9 continue to apply until all Customer Personal Data has been deleted.

13. Law

This DPA is governed by French law. The courts named in the Terms have jurisdiction.

14. Contact

SIREN 942232950 · max@netwarm.com

Annex 1: Details of processing

Annex 2: Security measures

• Encryption: data is encrypted in transit (TLS) and at rest
• Access control: data is separated by workspace, with role-based access and row-level security in the database. Server-only keys are never exposed to the browser.
• Staff access: production data is accessible only to the people who need it to run and support the service
• Authentication: password or Google sign-in. API keys and AI assistant connections are scoped by permission and can be revoked at any time.
• Signed links: Reveal download links and unsubscribe links are signed and expire
• Monitoring: errors and unusual activity are tracked
• Backups: regular database backups, stored with the same protections
• Hosting: databases hosted in the US
• Vendors: sub-processors are chosen for their security practices and bound by contract

Annex 3: Sub-processors