This Data Processing Addendum (this “DPA”) forms part of the Terms of Service between HeyInvest LLC (“HeyInvest”) and the Customer that has agreed to them (“Customer”). It applies only where HeyInvest processes Customer Personal Data on Customer’s behalf in providing the Services. Capitalized words not defined in this DPA have the meanings given in the Terms. Customer enters into this DPA on behalf of itself and, to the extent required by Data Protection Laws, its affiliates that are controllers of Customer Personal Data.
This DPA does not apply to personal information that HeyInvest processes as an independent controller, including account and billing information, Usage Data, the Investor Data, the deliverability and suppression signals described in Section 8.3 of the Terms, and the public profile information described in Section 9.9 of the Terms. That information is handled as described in our Privacy Policy.
Contents
- 1Definitions
- 2Roles and Scope
- 3Processing on Instructions
- 4Confidentiality of Personnel
- 5Security
- 6Sub-processors
- 7Assistance
- 8Personal Data Breaches
- 9Return and Deletion
- 10Information and Audits
- 11International Transfers
- 12US State Privacy Law Terms
- 13Liability and General Terms
- A1Annex 1: Details of Processing
- A2Annex 2: Technical and Organizational Measures
- A3Annex 3: Sub-processor Categories
1Definitions
- “Controller,” “processor,” “data subject,” “personal data,” “processing” and “supervisory authority” have the meanings given in the GDPR, and “business,” “service provider,” “sell,” “share” and “business purpose” have the meanings given in the CCPA.
- “Personal Data Breach” means a breach of security of the Services leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
- “Restricted Transfer” means a transfer of Customer Personal Data from the European Economic Area, the United Kingdom or Switzerland to a country that is not recognized as providing an adequate level of protection.
- “SCCs” means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914, and the “UK Addendum” means the International Data Transfer Addendum to those clauses issued by the UK Information Commissioner.
- “Sub-processor” means any third party engaged by HeyInvest to process Customer Personal Data.
2Roles and Scope
2.1Roles. Customer is the controller (or a processor acting for its own controller) of Customer Personal Data, and HeyInvest is Customer’s processor and service provider (or sub-processor, as applicable). Annex 1 describes the processing.
2.2Customer’s responsibilities. Customer is responsible for the lawfulness of the processing it instructs, including having a lawful basis for it, giving data subjects the notices required by Data Protection Laws (including any notice about the source of their personal data), obtaining any consents required, and the accuracy of Customer Personal Data. Customer will not instruct processing that would breach Data Protection Laws or Marketing Laws.
3Processing on Instructions
3.1Documented instructions. HeyInvest will process Customer Personal Data only on Customer’s documented instructions, unless Applicable Law requires otherwise, in which case HeyInvest will inform Customer before processing unless the law prohibits it. Customer’s complete instructions are the Terms, this DPA and the configuration and use of the Services by Customer and its Authorized Users. Additional instructions require written agreement.
3.2Unlawful instructions. HeyInvest will inform Customer if, in its opinion, an instruction infringes Data Protection Laws, and may suspend the relevant processing until Customer confirms or changes the instruction.
4Confidentiality of Personnel
HeyInvest will ensure that the people it authorizes to process Customer Personal Data are bound by appropriate obligations of confidentiality and access Customer Personal Data only as needed to provide the Services, support Customer, maintain security or comply with law.
5Security
HeyInvest will implement and maintain appropriate technical and organizational measures to protect Customer Personal Data against Personal Data Breaches, including the measures described in Annex 2. HeyInvest may update these measures, provided that updates do not materially reduce the overall level of protection. Customer is responsible for its own secure use of the Services, including protecting credentials, managing Authorized Users and configuring sharing within its Workspace.
6Sub-processors
6.1General authorization. Customer generally authorizes HeyInvest to engage Sub-processors. The categories of current Sub-processors are listed in Annex 3, and a list of their names and locations is available on request from privacy@heyinvest.ai.
6.2Changes. HeyInvest will give Customer at least fifteen (15) days’ notice, by email or in the Services, before a new Sub-processor begins processing Customer Personal Data. Customer may object on reasonable grounds relating to data protection within that period. The parties will discuss the objection in good faith, and if they cannot resolve it, Customer may terminate the affected Services as its sole remedy, with a prorated refund of prepaid fees for the terminated Services.
6.3Sub-processor obligations. HeyInvest will impose on each Sub-processor data protection obligations that are no less protective in substance than those in this DPA, and remains responsible to Customer for its Sub-processors’ performance of those obligations to the extent required by Data Protection Laws.
6.4Services Customer chooses. Third-Party Services that Customer chooses to connect, such as its own LinkedIn account or Google mailbox, are not Sub-processors. Data that Customer exchanges with them is governed by Customer’s own agreements with those providers.
7Assistance
7.1Data subject requests. If HeyInvest receives a request from a data subject relating to Customer Personal Data, it will refer the data subject to Customer where it can identify Customer and will not otherwise respond, except to confirm the referral or as required by law. Taking into account the nature of the processing, HeyInvest will provide reasonable assistance, primarily through the functionality of the Services, to help Customer respond to data subject requests.
7.2Assessments. HeyInvest will provide reasonable assistance with any data protection impact assessment or prior consultation with a supervisory authority that Data Protection Laws require of Customer in relation to the Services, to the extent Customer cannot reasonably obtain the information itself. HeyInvest may charge reasonable fees for assistance beyond what the Services provide.
8Personal Data Breaches
HeyInvest will notify Customer without undue delay, and where feasible within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notice will describe, to the extent known, the nature of the breach, the categories and approximate volume of data affected, the likely consequences and the measures taken or proposed. HeyInvest will take reasonable steps to contain and remediate the breach and will provide information Customer reasonably needs to meet its own notification obligations. Notifying Customer is not an admission of fault or liability.
9Return and Deletion
Customer may export Customer Data using the Services during its Subscription. Within thirty (30) days after the Services end, HeyInvest will delete Customer Personal Data from its active systems, except where Applicable Law requires retention or where it is needed to establish, exercise or defend legal claims. Copies in backups will be deleted on HeyInvest’s normal backup cycle, and until then they remain protected by this DPA and are not actively processed. On written request, HeyInvest will confirm deletion.
10Information and Audits
HeyInvest will make available to Customer information reasonably necessary to demonstrate compliance with this DPA, such as responses to reasonable security questionnaires, summaries of its security measures and any third-party certifications or reports it holds. If that information is not sufficient to meet a requirement of Data Protection Laws, or a supervisory authority requires it, Customer may conduct an audit no more than once in any twelve (12) month period, on at least thirty (30) days’ written notice, during business hours, at Customer’s expense, subject to reasonable confidentiality and security requirements, and without access to other customers’ data.
11International Transfers
11.1Location of processing. HeyInvest and its Sub-processors may process Customer Personal Data in the United States and in other countries where they operate.
11.2EEA transfers. For a Restricted Transfer from the European Economic Area, the SCCs are incorporated into this DPA by reference and apply as follows: Module Two (controller to processor) applies where Customer is a controller, and Module Three (processor to processor) applies where Customer is a processor; the optional docking clause in Clause 7 does not apply; Option 2 of Clause 9(a) applies, with the notice period in Section 6.2 of this DPA; the optional language in Clause 11 does not apply; Clause 13 is completed by reference to the supervisory authority competent for Customer; the SCCs are governed by the law of Ireland and disputes are resolved by the courts of Ireland under Clauses 17 and 18; and Annexes I to III of the SCCs are completed with the information in Annexes 1 to 3 of this DPA.
11.3UK and Swiss transfers. For a Restricted Transfer from the United Kingdom, the UK Addendum is incorporated by reference and completed with the information in Section 11.2 and the Annexes, and either party may end it as permitted by its Section 19. For a Restricted Transfer from Switzerland, the SCCs apply as described in Section 11.2, with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority where that Act governs the transfer.
11.4Conflict. If the SCCs or the UK Addendum conflict with this DPA or the Terms, the SCCs or the UK Addendum prevail to the extent of the conflict.
12US State Privacy Law Terms
Where the CCPA or another US state privacy law applies to Customer Personal Data, HeyInvest, as Customer’s service provider or processor, will:
- not sell or share Customer Personal Data;
- not retain, use or disclose Customer Personal Data for any purpose other than the business purposes specified in the Terms (providing, securing and supporting the Services), or as otherwise permitted for service providers by the CCPA and its regulations;
- not retain, use or disclose Customer Personal Data outside its direct business relationship with Customer;
- not combine Customer Personal Data with personal information it receives from or on behalf of others, or collects from its own interactions with individuals, except as the CCPA and its regulations permit, such as to detect security incidents or protect against fraudulent or illegal activity;
- comply with the CCPA and provide the same level of privacy protection that it requires of businesses;
- notify Customer if it determines that it can no longer meet its obligations under the CCPA; and
- allow Customer, on reasonable notice, to take reasonable and appropriate steps to stop and remediate any unauthorized use of Customer Personal Data.
HeyInvest certifies that it understands and will comply with these restrictions.
13Liability and General Terms
Each party’s liability arising out of or relating to this DPA is subject to the limitations and exclusions of liability in the Terms. This DPA remains in effect for as long as HeyInvest processes Customer Personal Data. If this DPA conflicts with the Terms, this DPA prevails as to the processing of Customer Personal Data. HeyInvest may update this DPA to reflect changes in Data Protection Laws or the Services, provided the update does not materially reduce the protection of Customer Personal Data.
A1Annex 1: Details of Processing
| Item | Description |
|---|---|
| Parties | Data exporter: Customer (controller or processor). Data importer: HeyInvest LLC (processor), contact privacy@heyinvest.ai. |
| Subject matter and duration | Provision of the Services under the Terms, for the term of the Subscription and the deletion period in Section 9. |
| Nature of processing | Hosting and storage; organizing and matching contacts against Customer’s raises; analysis by AI Features; synchronizing with Connected Accounts; sending, scheduling and tracking Outreach on Customer’s instructions; support and security. |
| Purpose | To provide, secure and support the Services for Customer. |
| Categories of data subjects | Prospective investors and other contacts in lists Customer imports; recipients of Customer’s Outreach and people who reply; Customer’s LinkedIn connections and correspondents; individuals named in Customer’s raise materials, such as team members. |
| Categories of personal data | Names, job titles, employers and professional profile links; email addresses and telephone numbers; city and country; LinkedIn profile information such as headline, photo and connection status; message content and metadata such as subject lines, timestamps and reply, bounce and unsubscribe status; notes and investment preferences; content of pitch decks and raise materials. |
| Sensitive data | None intended. Customer must not submit sensitive or special category data (Terms Section 8.6). |
| Frequency | Continuous, for as long as Customer uses the Services. |
| Transfers to Sub-processors | For the same nature, purpose and duration as above. |
A2Annex 2: Technical and Organizational Measures
- Encryption. Data is encrypted in transit using TLS and encrypted at rest by our hosting and database providers. OAuth tokens for connected mailboxes are additionally encrypted at the application level with AES-256-GCM and stored separately from other mailbox data.
- Logical separation. Customer Data is scoped to the Customer’s Workspace. Sensitive tables are protected by database row-level security and are reachable only by server-side code after the caller’s Workspace has been checked.
- Access control. Access to production systems is restricted to authorized personnel. Contact details in the Investor Data are withheld until a user unlocks them, and only the person who connected a mailbox can send from it.
- Credential handling. HeyInvest does not store passwords, two-factor secrets or session cookies for connected LinkedIn accounts; they are passed directly to the LinkedIn automation provider.
- Application security. Server-side input validation, protection against open redirects, and framework protections against cross-site request forgery.
- Monitoring and logging. Logging of account activity such as sign-ups, unlocks, invitations and page views, used to investigate abuse such as scraping or unusual sending, together with sending limits and pacing for outreach.
- Availability. Managed infrastructure with provider-managed backups.
- Personnel. Confidentiality obligations for personnel with access to Customer Personal Data.
- Vendor management. Review of Sub-processors’ security and privacy commitments before engagement.
- Incident response. A process to investigate, contain and remediate security incidents and to notify affected customers.
- Data minimization and deletion. Collection limited to what the Services need; outreach emails store short excerpts rather than full message bodies; deletion of Customer Personal Data as described in Section 9.
A3Annex 3: Sub-processor Categories
| Category | Purpose | Location |
|---|---|---|
| Cloud hosting and delivery | Running the HeyInvest application and website | United States |
| Database, authentication and file storage | Storing Customer Data and managing sign-in | United States |
| LinkedIn automation infrastructure | Operating Customer’s connected LinkedIn account for HeyIntro, on Customer’s instructions | United States and other countries where the provider operates |
| AI model providers and routing | Matching, classification, summaries and drafting for AI Features | United States and other countries where the provider operates |
Names and locations of current Sub-processors are available on request from privacy@heyinvest.ai.