Data Processing Addendum

1. Roles

For the channel data you import, you are the controller and VAR Conduit is the processor. We process that data only on your documented instructions — i.e. to provide the service.

2. Scope of processing

• Subject matter: providing the VAR Conduit service.
• Duration: for the term of your subscription.
• Data subjects: your reseller personnel (reps, managers, leaders), people named on CRM opportunities you sync (for example, opportunity owners), partner reps named on the deal registrations you bring in, and your authorized users of the service.
• Data types: for reseller personnel, name, job title, work email, work phone, region and segment, and, if you import them, LinkedIn URL and free-text notes; for synced CRM opportunities, the opportunity owner's name; for partner deal registrations (synced from your CRM, pushed through the API, uploaded, or entered by hand), the partner's name, the partner rep's name and email, the end customer's name and domain, the amount, product and status dates, and any free-text notes; for authorized users, name, email, session metadata, and your workspace's audit-log entries (actor, action, IP address, user agent, timestamp). Also the account and org-tree records you upload. No special-category data is required or intended.

3. Subprocessors

We use the subprocessors listed in our Privacy Policy; the same list is Annex A of the countersigned DPA. The website and marketing vendors listed separately there never receive your data. We will give notice of any new subprocessor, and the opportunity to object on reasonable data-protection grounds, as set out in the countersigned DPA, and we remain responsible for our subprocessors' compliance.

4. Security measures

We maintain technical and organizational measures including HTTPS, managed at-rest storage controls, organization-scoped authorization, database constraints, and audit logging — detailed on our Security & Trust page. We ensure that everyone we authorise to process your data — employees and contractors — has committed to confidentiality or is under an appropriate statutory obligation of confidentiality (GDPR Art. 28(3)(b)).

5. Data subject rights

Taking into account the nature of the processing, we assist you in responding to data-subject requests under GDPR Articles 15–22 (access, rectification, erasure, restriction, portability, and objection) and the equivalent CCPA rights. The product gives you self-service tools to export a person's record as JSON or your whole workspace as streamed NDJSON (access & portability), and to delete a person or wipe the workspace (erasure) — each audited. For anything outside that self-service scope, email privacy@varconduit.com and we respond without undue delay.

6. Personal data breach

We will notify you without undue delay — and in any event within 72 hours — after becoming aware of a personal data breach affecting your data, with the information you need to meet your own notification obligations (for example, under GDPR Article 33).

7. Return & deletion

On your request or on termination, you may export your data, after which we delete your personal data within the period set in the countersigned DPA and confirm the deletion in writing, unless retention is required by law.

8. International transfers

Our primary application and database hosting is configured in the United States, and there is no EU-region option today; other subprocessors may process data in their configured service regions. Where personal data is transferred from the EEA, UK, or Switzerland, an appropriate transfer mechanism (such as the EU Standard Contractual Clauses and the UK Addendum) will be agreed in the countersigned DPA.

9. Audit

On reasonable request, we will make available the information necessary to demonstrate compliance with this DPA, including third-party reports where available.

Contact

To execute a countersigned DPA: legal@varconduit.com.