Data Processing Agreement
The contract under article 28 GDPR between the client and Teory: what we handle on the client’s behalf, how, and with whom.
1. The parties
This agreement is the contract under article 28 GDPR between the client, the controller («you»), and Ismael Eduardo Gomez (MDS Digital), the processor («Teory»). It is the annex to the Terms of Service: it is part of them and is accepted with them, in writing and in electronic form (article 28.9). If we sign a separate processing agreement with you, that one governs; and, if you ask, we give you this one signed.
2. What we handle and why
We handle personal data on your behalf to provide the service in the Terms: searching for people on LinkedIn with your criteria and judging whether they fit and whether they say yes, interacting with what they post, inviting them, writing to them and answering them, copying your accounts’ inboxes into Teory, translating a conversation for your team, turning their voice notes into text, sending the email a contact asks for, writing whoever says yes into your CRM and recognising their bookings in your Calendly. The data subjects and the data, in annex I. It lasts as long as the contract.
To give support and to diagnose and fix faults, whoever operates the service may review the content of your workspace, and does not use it for anything else.
3. Your instructions
We handle the data only on your documented instructions, including on transfers: those you give in the product — campaigns, criteria, lists and what you ask Teory AI — and those you give us in writing, at contact@teory.ai. If one seems to us to break the law, we tell you at once and may refuse to follow it. If a law obliges us to handle the data otherwise, we tell you before handling it, unless that law forbids it.
4. What is ours to do
- Confidentiality: whoever handles this data on our side is bound to secrecy, also afterwards.
- Security: the measures in annex II, under article 32.
- Data subjects’ rights: we help you answer them as far as the product allows, and if one writes to us, we pass the request on to you within 5 days and do not decide for you. Today the product cannot delete a person, but it can keep them out of every campaign: no campaign in your workspace writes again to anyone on your workspace’s do-not-contact list until you take them off it. Whoever asks not to be written to again goes on it by themselves, and so does anyone you ask us to put on it. Whoever only says they are not interested is not written to again by any campaign in your workspace for the following 6 months, and after that Teory does not prevent it on its own.
- An impact assessment or a prior consultation with the authority: we give you the information we have.
- A breach affecting data handled on your behalf: we tell you within 48 hours of learning of it, with what we know — what happened, whom it affects, what consequences it may have and what we are doing —, so that you can notify the authority within the 72 hours of article 33.
5. Sub-processors
You give us a general authorisation to engage the sub-processors in annex III. If we add or replace one, we tell you by email, at the latest on the day it starts handling data on your behalf; if you object on reasonable data-protection grounds and we find no solution, you may end the contract without penalty for what has not been provided. We impose on each the same obligations this agreement imposes on us, and we answer to you for it as for ourselves.
6. Transfers
What leaves the European Economic Area leaves with the safeguard its row in annex III states; where that is the standard contractual clauses of Decision (EU) 2021/914, you authorise us to enter into them on your behalf with the sub-processor concerned.
7. When it ends
When the contract ends, whoever ends it, we delete the data handled on your behalf or return it to you, as you choose — if you do not choose, we delete it —, within the following 30 days, except what a law obliges us to keep; today it is done by hand. Backups keep it until they expire, as annex II says.
8. What is yours to do, and audits
It is yours to have a legal basis to contact whoever you decide to contact, and to be able to prove it; to inform those people within the time limits of article 14(3) GDPR and to handle their rights and their objection; not to put into Teory data obtained unlawfully, special categories or minors’ data; and to give us lawful instructions. You answer for your instructions, and we for following them and keeping to this agreement.
We give you the information needed to show we keep to it, and accept audits and inspections by you or an auditor you appoint, with 30 days’ notice, once a year save after an incident, in working hours and without disrupting the service; each party bears its own costs.
On data protection, where this agreement and the Terms differ, this agreement governs.
Annex I. Details of the processing
| What | Detail |
|---|---|
| Data subjects | The people with a LinkedIn profile you decide to search for, invite or contact; your LinkedIn connections; and whoever writes to your connected accounts, even if in no campaign. |
| Data | Their public profile — name, headline, job title, company, location, photo, identifier and address —, what they post, whether you are connected, what is sent to them and what they answer — with files, voice notes, transcripts and translations —, the email they give and the emails sent to them, and the judgement of whether they fit and whether they have said yes; and, of whoever says yes, the email, phone and company website LinkedIn shows, their record in your CRM and their bookings in your Calendly. |
| Special categories | None: the Terms prohibit handling them, and if you put them in an instruction, a file or a list anyway, you do so on your own responsibility. |
| Operations and purpose | Those in clause 2, to provide you with the service. |
| Duration | That of the contract; how long each thing lasts, in the retention table of the Privacy Policy. |
Annex II. Security measures
Those applied today, one by one:
- LinkedIn cookies, proxy credentials and the email, CRM and Calendly keys live in an encrypted secrets store, never in a column, a log or a response; and the LinkedIn session also lives on the engine’s encrypted disk.
- Everything travels encrypted, and the database is encrypted at rest.
- Each LinkedIn account has its own IP, shared with no other, and its own browser fingerprint.
- Each client sees only their own, and a member only what belongs to their accounts: the database enforces it, row by row.
- The LinkedIn password is neither collected nor stored, and what is typed when signing in is not logged.
- There are backups: the database’s, under its provider’s plan, and a daily snapshot of the engine’s disk, kept for five days.
- Whoever runs the service has access to production, also through artificial intelligence tools.
Annex III. Sub-processors
Those who touch data handled on your behalf, by category, with where they are and with what safeguard:
| Category | Who | Where | If the data leaves the EEA |
|---|---|---|---|
| Hosting and database | Supabase | Singapore; the data, in Ireland, in the EU. | The 2021 standard contractual clauses. |
| Hosting and database | Vercel | US; the product runs in Dublin, in the EU. | The 2021 standard contractual clauses. |
| Hosting and database | Fly.io | US, with the machines in Frankfurt, in the EU. | The EU-US Data Privacy Framework. |
| Artificial intelligence | Anthropic | US: it offers no storage in the EU. | The 2021 standard contractual clauses. |
| Artificial intelligence | OpenAI | US and Ireland. | The 2021 standard contractual clauses. |
| IP addresses | IPRoyal | United Arab Emirates. | The 2021 standard clauses in its processing agreement. |
The full list — who each one is, their address, their contact, what they do for us, where they handle the data and with what safeguard — we send you by email when you start, with every change and whenever you ask for it.