DATA PROCESSING

Data Processing Terms

Effective 14 October 2026

These terms apply where we process personal data on your behalf when we provide Swops. They form part of our Terms of Service and meet the requirements of Article 28 of the GDPR.

1. Roles and definitions

• “Customer personal data” means the personal data in the content you and your members add to Swops or that Swops generates for you, as described in section 2.
• For customer personal data, you are the controller (or a processor acting for your own controller) and we are your processor (or sub-processor). If you act for another controller, you confirm that you have its authority to agree to these terms.
• “GDPR” means Regulation (EU) 2016/679. Terms such as “controller”, “processor”, “processing”, “data subject” and “personal data breach” have the meanings given in the GDPR. Other capitalised terms have the meanings given in our Terms of Service.

2. Details of the processing

• Subject matter and purpose: providing the Service to you under the Terms of Service.
• Nature: receiving, reading (including AI reading of card photos), storing, organising, researching, displaying, exporting and deleting data, sending follow-up emails in your name to the people whose business cards you scan, only when you have switched them on and only with the message you wrote, and the other operations needed to provide Swops.
• Duration: while you use Swops, and afterwards until the data is deleted under section 3.8.
• Types of personal data: contact details (such as name, job title, company, email address, phone and mobile numbers, website, LinkedIn address, postal address and country); card photos and anything printed on the card; notes and ratings; research briefs, which may contain information from public sources about people connected with a business; your company context; your follow-up messages; and the names and email addresses of workspace members and invitees.
• Categories of data subjects: your business contacts and other people whose details you add; people named in public sources about the businesses you research; and your workspace members and invitees.

3. Our obligations

3.1 Instructions

We process customer personal data only on your documented instructions, including with regard to transfers outside the EEA, unless EU or member state law requires us to do otherwise; in that case we will tell you before processing unless that law prohibits it. Our Terms of Service, these terms and your use and settings of the Service are your complete instructions. Switching on follow-up emails is your instruction to send them on your behalf; we stop sending them as soon as you switch them off. Further instructions require our written agreement. We will tell you if, in our opinion, an instruction infringes data protection law.

3.2 Confidentiality

We ensure that the people we authorise to process customer personal data are bound by confidentiality.

3.3 Security

We take the measures required by Article 32 of the GDPR, as described in Annex 1. We may update these measures as long as the overall level of protection is not reduced.

3.4 Sub-processors

You give us general authorisation to engage sub-processors. Annex 2 describes what our sub-processors do and where. Anyone can ask us for the current list of sub-processors by emailing [email protected]. If you ask, we will also tell you by email about any intended addition or replacement at least 14 days before the new sub-processor starts processing customer personal data. You may object on reasonable data protection grounds by emailing us within that period. If we cannot reasonably accommodate your objection, your only remedy is to stop using Swops and cancel your plan. We impose on each sub-processor, by contract, data protection obligations that provide sufficient guarantees in line with Article 28 of the GDPR, and we remain responsible to you for their performance of those obligations, subject to section 7.

3.5 Data subject requests

Swops lets you view, correct, export and delete customer personal data, which you can use to respond to requests from data subjects. If we receive a request about customer personal data, we will pass it on to you where we can identify you and will not respond ourselves, except to refer the person to you. Further assistance is at your cost.

3.6 Other assistance

Taking into account the nature of the processing and the information available to us, we will assist you in meeting your obligations under Articles 32 to 36 of the GDPR (security, personal data breaches, data protection impact assessments and prior consultation). Assistance beyond the information and features we make available generally is at your cost.

3.7 Personal data breaches

We will notify you without undue delay after becoming aware of a personal data breach affecting customer personal data, and will provide the information reasonably available to us that you need to meet your own obligations. Our notification is not an admission of fault or liability.

3.8 Deletion at the end

You can export customer personal data as described in clause 15 of our Terms of Service. When the retention periods set out there end, we delete the customer personal data concerned, unless EU or member state law requires us to keep it. Copies in backups are removed as backups are replaced in the normal course.

3.9 Information and audits

We make available the information reasonably necessary to demonstrate compliance with Article 28 of the GDPR, including these terms, the list of sub-processors and a description of our security measures. If that information is not sufficient, or if a supervisory authority requires it, you or an independent auditor bound by confidentiality may audit our compliance, on at least 30 days’ written notice, no more than once in any 12 months (unless required by a supervisory authority or following a personal data breach), during normal business hours, in a way that does not disrupt our business or give access to other customers’ data or to our sub-processors’ facilities, and at your cost.

4. Your obligations

• You are responsible for the lawfulness of the processing of customer personal data, including having a legal basis for it and giving data subjects the information required by Articles 13 and 14 of the GDPR.
• Your instructions must comply with data protection law.
• You will not add special categories of personal data, personal data relating to criminal convictions or offences, or personal data of children to Swops.
• You are responsible for your members’ use of Swops.

5. Transfers outside the EEA

Some sub-processors process customer personal data outside the EEA, as shown in Annex 2. You authorise these transfers. We ensure that each transfer is covered by an adequacy decision of the European Commission (including the EU–US Data Privacy Framework where the recipient is certified under it) or by the European Commission’s standard contractual clauses.

6. Order of precedence

For the processing of customer personal data, these terms prevail over the Terms of Service if they conflict. In all other respects, the Terms of Service apply.

7. Liability

Each party’s liability arising out of or relating to these terms is subject to the exclusions and limitations of liability in our Terms of Service, and counts towards the single overall limit set there. This does not limit any party’s liability to data subjects under the GDPR.

Annex 1: Security measures

• Encryption in transit (HTTPS/TLS) between the app, our servers and our sub-processors.
• Customer personal data is stored in the EU (Ireland) with our database provider, which encrypts it at rest.
• Card photos are kept in private storage and are shown only through short-lived links issued after an access check.
• Every request for customer personal data is authenticated and checked against workspace membership and role; browsers have no direct access to the database.
• Personal spaces and company workspaces are kept separate from each other.
• Administrative access is limited to authorised personnel.
• Our error monitoring is designed to exclude the content of contacts.

Annex 2: Sub-processors

Last updated 14 October 2026

For the current list of sub-processors by name, email [email protected].