Data Processing Agreement (DPA)
between the customer using Sales Revolver (the "Controller") and
emit GmbH, Grabenstr. 18, 40789 Monheim, Germany, the provider of Sales Revolver (the "Processor").
Preamble
The Controller uploads contact data of its business contacts to Sales Revolver and works with it there. The Processor processes this data on behalf of the Controller. This agreement sets out the rights and duties of both parties in doing so.
This agreement supplements the Terms of Service of Sales Revolver. It is concluded when the Controller registers, in electronic form (Art. 28(9) GDPR); no signature is required. Where this agreement and section 7 of the Terms of Service differ, this agreement takes precedence. This English version and the German version (Auftragsverarbeitungsvertrag) have the same content; if they differ, the German version prevails. If you need a countersigned copy, write to hello@sales-revolver.com.
1. Subject matter and duration
1.1 The subject matter is the provision of Sales Revolver: storing, organising, displaying, synchronising, exporting and deleting the data the Controller places there. The details are in Annex 1.
1.2 The agreement applies for as long as the Controller has an account with Sales Revolver, and beyond that until all data processed on its behalf has been deleted (section 10).
2. Instructions
2.1 The Processor processes the data only on documented instructions from the Controller. The Terms of Service, this agreement and the use of the features of Sales Revolver are the instructions. The Controller gives any further individual instructions in text form.
2.2 If the Processor considers an instruction unlawful, it tells the Controller without undue delay. It may suspend carrying out the instruction until the Controller confirms or changes it.
2.3 If a law requires the Processor to process the data in another way, it tells the Controller beforehand, unless that law prohibits the notice.
3. Duties of the Processor
3.1 Confidentiality. Everyone with access to the data is bound to confidentiality or is under a statutory duty of secrecy.
3.2 Security. The Processor takes the technical and organisational measures under Art. 32 GDPR that are described in Annex 2. It may develop them further as long as the level of protection does not fall.
3.3 Assistance. The Processor gives the Controller reasonable assistance with requests from data subjects (section 6), with the security of processing, with reporting personal data breaches, with data protection impact assessments and with consulting supervisory authorities.
3.4 Personal data breaches. The Processor notifies the Controller of a breach affecting the data processed on its behalf without undue delay after becoming aware of it, and provides what the Controller needs for its own notification.
3.5 No use of its own. The Processor does not use the data for its own purposes, does not sell it and does not pass it on for advertising.
3.6 Contact. The Processor answers data protection questions at hello@sales-revolver.com.
4. Duties of the Controller
4.1 The Controller is responsible for the lawfulness of the processing. This includes having collected the contact data lawfully and being allowed to call the people concerned.
4.2 The Controller answers requests from data subjects itself and informs the Processor without undue delay if it notices errors or irregularities in the processing.
5. Sub-processors
5.1 The Controller gives general authorisation to engage sub-processors. Those currently engaged are listed in Annex 3.
5.2 The Processor announces a new or replacement sub-processor at least 14 days in advance by email or in Sales Revolver. Within that period the Controller may object on legitimate data protection grounds. If the objection cannot be resolved, the Controller may close its account.
5.3 The Processor binds every sub-processor by contract to data protection duties equivalent to those in this agreement, and remains responsible for its performance.
6. Rights of data subjects
6.1 The edit, export and delete functions in Sales Revolver are the primary means of fulfilling requests from data subjects.
6.2 If a data subject contacts the Processor directly, the Processor forwards the request to the Controller where it can identify the Controller, and does not answer it itself unless the law requires.
7. Transfers to third countries
7.1 The data is stored on servers in the European Union.
7.2 If the Processor or a sub-processor processes data outside the European Economic Area in a country without an adequacy decision, this happens only with appropriate safeguards, as a rule the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914).
8. Evidence and audits
8.1 On request, the Processor gives the Controller the information needed to demonstrate compliance with this agreement.
8.2 The Controller may check compliance. The Processor may meet this by providing written information or third-party reports. An on-site audit must be announced with reasonable notice, takes place during normal business hours, must not put other customers' data at risk, and takes place at most once a year, unless there has been a personal data breach or an authority requires it.
9. Liability
Liability is governed by Art. 82 GDPR and otherwise by the Terms of Service.
10. Deletion and return
10.1 The Controller can export its data at any time: the call results as a CSV file, all account data as one file.
10.2 When the Controller deletes data or its account, or when the service ends, the Processor deletes the data from its live systems, and from backups within 30 days, unless a law requires it to be kept.
11. Final provisions
11.1 German law applies. Changes and additions require text form.
11.2 If a provision is invalid, the remaining provisions stay in force.
Annex 1 — Details of the processing
| Subject matter and purpose | Providing Sales Revolver: keeping contact lists, showing contacts one after another for calling, recording outcomes and notes, planning callbacks, statistics, working together in a team. |
|---|---|
| Nature of the processing | Storing, organising, displaying, synchronising between devices, exporting, deleting. |
| Types of data | Company, website, first and last name, phone and mobile number, email address, position, notes, call outcomes, callback times, call log entries. Special categories of personal data (Art. 9 GDPR) are not intended. |
| Data subjects | Business contacts and prospects of the Controller. |
| Duration | The life of the account, plus the deletion period in section 10. |
| Place of processing | Servers in the European Union (Netherlands). |
Annex 2 — Technical and organisational measures
Confidentiality
- Physical access: the servers are in data centres of the hosting provider in the EU; the provider secures physical access.
- System access: passwords are stored only as salted hashes (scrypt). Signing in is possible with a password or a link that works once; a two-factor sign-in with an authenticator app can be added. Sessions are stored only as hashes and expire after 30 days. Sign-in attempts are limited per address and per account.
- Data access: in teams, roles (owner, admin, member) govern who may import, delete and export contacts and manage members. Access to the production systems is limited to the people who operate them.
- Separation: the data of each account and each team is logically separated; every query is restricted to the user's own workspace. Test and production environments are separate.
Integrity
- Transfer: all connections are encrypted (HTTPS with HSTS); the connection to the database is encrypted as well.
- Encryption: secrets that must be readable again (for example for two-factor sign-in) are encrypted with AES-256-GCM; the key is kept outside the database.
- Traceability: a security log records sign-ins, changes to password, email address and two-factor sign-in, changes in the team, exports and deletions for 12 months. The call log shows who entered which outcome.
- Protection of the application: requests from other websites are refused; a content security policy allows only the application's own content. The application contains no advertising and no analytics or tracking services.
Availability and resilience
- Regular backups of the database; they are kept for at most 30 days.
- Operation is monitored automatically; a failed service is restarted, and a new version only goes live after passing its check.
- The Controller can export its data itself at any time.
Regular review
- Every change to the software runs through automated tests, including tests of the access rules and the security functions.
- Software libraries in use are checked for known vulnerabilities and updated.
- Sub-processors are bound by contract to data protection. The measures are reviewed at least once a year.
Annex 3 — Sub-processors
| Company | Service | Place of processing |
|---|---|---|
| Railway Corporation, USA | Hosting of the application and the database | European Union (region EU West, Netherlands) |
| Brevo (Sendinblue SAS), France | Sending service emails, for example team invitations | European Union |
For access from outside the EU, the European Commission's Standard Contractual Clauses are agreed with Railway.