Data Processing Terms
These Data Processing Terms ("DPA") form part of the RavenPower Terms of Service between Raven Power LLC ("RavenPower", "we") and the business customer ("you"). They apply to Customer Personal Data that we process for you.
1. Scope
This DPA covers RavenPass Connect, site contact forms, leads storage, notification emails, exports and related features (the "Services").
2. Details of processing
- Subject matter and duration: the Services, for your subscription term plus the deletion period in section 10.
- Nature and purpose: receiving, storing, displaying, exporting, emailing to you, retaining and deleting contact details that visitors choose to send you.
- Data subjects: visitors to your cards and sites.
- Categories of data: name, email, phone, company, job title, "where we met", free-text note, card identifier, consent wording version and time, and the self-reported prefill source.
- Sensitive data: none intended.
3. Instructions
We process Customer Personal Data only on your documented instructions. Those are this DPA, your settings (form on or off, retention period, email notifications), the actions you take in your account, and the standing instruction in section 7. We will tell you if we believe an instruction breaks data-protection law.
4. Confidentiality
People we authorise to process Customer Personal Data are bound by confidentiality.
5. Security
We maintain appropriate technical and organisational measures. They include encryption in transit, per-card access control, rate limiting and bot checks, keyed hashing of identifiers in rate-limit records, with automatic deletion of those records within 2 days, and plain-text notification emails with no visitor details in subject lines.
6. Subprocessors
You give general authorisation for the subprocessors listed at /legal/subprocessors. We will give at least 30 days' notice of a new or replacement subprocessor, by email and on that page. You may object on reasonable data-protection grounds. If we cannot resolve the objection, you may end the affected Service and receive a pro-rated refund of any prepaid fees for it. We impose data-protection obligations on each subprocessor that are no less protective than this DPA, and we remain responsible for them, subject to the limitation of liability in section 6B of the Terms.
7. Requests from individuals
(a) We give you self-service tools (deleting leads, export) so you can respond to requests.
(b) Standing instruction. You instruct us to delete a visitor's details, and to treat that as withdrawal of consent, when the visitor uses our verified deletion tools. Those tools are a signed link sent to the email the visitor gave, a link sent to an email or phone the visitor controls, or a request we check. A deletion may cover that visitor's details across your cards. We will show you that a deletion happened as a count, without the visitor's details.
(c) You will act on requests you receive directly, including from visitors who gave only a phone number, within 30 days of receiving them (longer only where the law allows). You can use the delete function in your account, and we will help on request.
8. Assistance
We will give reasonable help with security, breach notifications, impact assessments and consultations with regulators. That help takes into account the nature of the processing and the information available to us.
9. Personal data breaches
We will notify you without undue delay, and in any case within 72 hours of becoming aware of a breach affecting Customer Personal Data. The notice will include the information then available, and we will update it as more becomes known.
10. Deletion and return
You can export Customer Personal Data at any time. We delete it when you delete the card, person or organisation it belongs to, or 30 days after your subscription ends, unless the law requires us to keep it. Point-in-time database restore copies age out within up to 30 days after that.
11. Audits
Once a year, on written request, we will give you a written report on our compliance with this DPA, or complete a reasonable security questionnaire, together with our subprocessors' available certifications or reports. This is your full audit right; we do not offer on-site audits. Information we share is confidential.
12. Our independent-controller processing
As described in section 6A(c) of the Terms, we process limited data as an independent controller only for security, abuse prevention, records of consent wording, and legal compliance.
13. US state privacy laws
Under the CCPA/CPRA and similar laws, we are your service provider.
- We will not sell or share Customer Personal Data.
- We will not retain, use or disclose it outside our direct business relationship with you, or for any purpose other than the business purposes in this DPA.
- We will not combine it with other personal data except as the regulations permit.
- We will comply with those laws and provide the same level of privacy protection they require.
- We will tell you if we can no longer meet these obligations.
- You may take reasonable steps to stop and remediate unauthorised use.
14. International transfers
Where Customer Personal Data subject to the EU GDPR or UK GDPR is transferred to a country without an adequacy decision, the parties rely on the EU Standard Contractual Clauses (Module 2 or 3, as applicable) and the UK International Data Transfer Addendum, which are incorporated into this DPA by reference. The EU Standard Contractual Clauses are governed by the law of Ireland, with disputes before the courts of Ireland, and the UK Addendum is governed by the law of England and Wales.
15. Order of precedence
If this DPA and the Terms conflict on data protection, this DPA controls. Everything else follows the Terms, including the limitation of liability in section 6B and Florida governing law in section 7, except that the Standard Contractual Clauses and UK Addendum are governed as stated in section 14. If the Standard Contractual Clauses conflict with this DPA or the Terms, the Standard Contractual Clauses prevail.
Questions? matt@ravenpower.net