Legal
Data Processing Addendum
This addendum is between Steven Foster, a sole proprietor doing business as ContactRoll (“ContactRoll”, “we”, “us”) and the customer that has accepted ContactRoll’s Terms of Service (“you”). It forms part of the Terms whenever we process personal data for you that a data protection law protects. If you would like a signed copy, write to privacy@contactroll.com.
Words such as “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” mean what they mean in the data protection law that applies. If this addendum and the Terms disagree about personal data, this addendum wins.
1. Roles
- You act as controller where you determine the purposes and means of processing personal data. Where you process personal data on behalf of another controller, you act as processor and ContactRoll acts as your subprocessor for that processing. The parties’ roles depend on the actual processing relationship.
- “Your personal data” means the personal data you and your members put into ContactRoll, and the personal data your customers and contacts send to your organization through it. We process your personal data only to provide ContactRoll to you, for the purposes in section 11.
- For our own account, billing and security records about you and your members, we are a controller, under our Privacy Policy.
Annex 1 describes the processing.
2. Your instructions
We process your personal data only on your documented instructions. The Terms, this addendum, and how you set up and use ContactRoll are your instructions. If we believe an instruction breaks a data protection law, we will tell you. If a law requires us to process your personal data in some other way, we will tell you first, unless that law forbids it.
You are responsible for having a lawful basis for the processing, for the notices you give people, and for the accuracy of the data, including any consent you record.
3. Confidentiality
Anyone who processes your personal data for us is bound by a duty of confidentiality, and has access only as far as needed to run, secure or support ContactRoll.
4. Security
We maintain reasonable technical and organizational safeguards designed to protect personal data against unauthorized access, loss, destruction, or disclosure. Annex 2 summarizes security measures currently in place. We may update these measures as ContactRoll evolves, provided we continue to maintain reasonable safeguards appropriate to the nature of the data and the risks.
5. Subprocessors
- ContactRoll subprocessors. Subprocessors are service providers that ContactRoll engages to process customer personal data on ContactRoll’s behalf. You give us general authorization to use them. Our current subprocessors are listed in Annex 3 and in our Privacy Policy.
- We maintain a current list of our subprocessors in the Privacy Policy and this addendum. We will update the list when our subprocessors change and provide notice where required by applicable law.
- We put a written agreement in place with each subprocessor that requires it to protect your personal data as applicable law requires. We remain responsible for meeting our obligations under this addendum, including these requirements for our subprocessors.
- Customer-connected services. A service that you connect using your own account and under your own agreement is a customer-connected service, not a ContactRoll subprocessor for that processing. You direct any information sent to that service, and your use of it is governed by its own terms and privacy policy. These include your own Twilio, Google, Microsoft, QuickBooks Online, Stripe, HeyGen or GitHub account, and any destination you reach through your API keys, webhooks or an automation service such as Zapier. We are not responsible for those services.
6. Helping you
Taking into account the nature of the processing and the information available to us, we will provide reasonable assistance to help you respond to requests from individuals and meet your applicable data protection obligations, including providing information reasonably necessary for data protection assessments.
Significant or repeated assistance beyond ordinary support may be subject to reasonable fees, where permitted by law and agreed in advance.
ContactRoll lets you find, export, correct and delete a person’s data yourself. If a person sends us a request about your personal data, we will forward it to you and will not answer it ourselves unless you ask us to.
7. Personal data breaches
If we become aware of a personal data breach affecting your personal data, we will notify your organization’s Owners by email without undue delay. We will provide information about the breach as reasonably available to us and may provide further information as it becomes available. Telling you is not an admission of fault.
8. Deleting and returning data
At the end of the services, you may direct us to return or delete your personal data under our control. You may export your data during the 30 days after account closure. After that period, we delete the data under our control within a further 30 days, including files and backup copies, unless retention is required by law. Copies held outside our control, including by third-party services or in customer exports, are not covered by this deletion.
9. Audits
We will first respond to reasonable written questions or questionnaires about our compliance with this addendum. If the information provided is not sufficient, you may conduct a reasonable assessment of our compliance once in any 12-month period, at your own cost, with at least 30 days’ written notice. An assessment must take place during normal business hours, must not unreasonably disrupt the service, and must protect the confidentiality of other customers’ information. Assessments of our subprocessors rely on the reports and certifications they publish.
10. International use
ContactRoll is designed for US-based business customers. Its database and files are in the United States; Annex 3 says where each subprocessor works. ContactRoll does not currently provide EU or UK international data transfer terms as part of its standard service. You must not use ContactRoll for a transfer requiring such terms unless ContactRoll has agreed to the applicable terms in a separate written agreement.
11. US state privacy laws
US state privacy laws. Where applicable, we process personal data on your behalf for these business purposes:
- Hosting, storing, organizing, displaying, searching, transmitting, receiving, exporting, and deleting your records.
- Providing ContactRoll’s CRM, support inbox, help center, phone, and marketing-email functions that you enable.
- Providing customer-authorized integrations and related support.
- Maintaining service security, preventing fraud and abuse, and troubleshooting service problems.
- Maintaining backups and meeting legal obligations.
We do not sell or share your personal data. We will not retain, use, or disclose it outside our direct business relationship with you or for purposes other than those listed above, except as permitted by applicable law. We will notify you if we can no longer meet these obligations. You may take reasonable steps to stop and remediate any unauthorized use of your personal data.
12. Liability, and how long this lasts
Each party’s liability under this addendum is subject to the limits in the Terms, except where a data protection law does not allow a limit. This addendum lasts as long as we process your personal data.
Annex 1: The processing
| Subject matter | Providing ContactRoll: a CRM, shared support inbox and help center, phone system and marketing email, and the optional features and integrations you enable |
|---|---|
| Duration | While your account is open, and until deletion under section 8 |
| Nature and purpose | Storing, organizing, displaying, searching, sending, receiving, exporting and deleting your personal data, as you direct through ContactRoll, for the purposes in section 11 |
| People | Your members; your customers, contacts and prospects; people who email, call or sign up with you; people you send email to; people who appear in the mail and calendar of a member who connects them |
| Kinds of data | Names, email addresses, phone numbers, company details, messages and attached files, notes, call records, recording and transcript text where you switch them on, marketing consent, unsubscribe and click records, the subject, time and link of email and meetings synchronized from a connected mailbox, accounting figures from a connected QuickBooks company, and anything else you choose to put in |
| Sensitive data | ContactRoll is not designed or intended to process sensitive personal data described in section 15 of the Terms of Service. You must not intentionally submit such data. If it is submitted inadvertently, you are responsible for removing it. We may process it only as reasonably necessary to secure, operate, or remove it from ContactRoll. |
| Frequency | Continuous |
Annex 2: Security measures
- Each organization’s data is kept apart by the database itself, and this is checked by automated tests on every change.
- Data is encrypted in transit. Stored access keys for services you connect are encrypted.
- Files are kept in private storage, and download links expire after 60 seconds.
- Roles and permissions limit what each member can see and do; two-factor sign-in is available, and an Owner can require it.
- Changes in your organization are recorded in its audit log.
- Access by ContactRoll is limited to running, securing and supporting the service.
- Daily backups of the database, kept for seven days. Files are not in them.
- Email is authenticated with SPF, DKIM and DMARC.
- Dependencies are checked for known security issues on every change and on a schedule.
Annex 3: Subprocessors
| Subprocessor | What it does | Where |
|---|---|---|
| Supabase (on Amazon Web Services) | Database, attached files and sign-in | United States |
| Cloudflare | Hosting, email forwarding, sign-in security checks | Global network |
| Resend (on Amazon Web Services) | Sending and receiving email | United States |
| Stripe | Payment for ContactRoll’s paid plans | United States |
| Anthropic, PBC | The AI assistant’s answers, for an organization that has switched it on | United States |