Date of last modification: 3 April 2025
This Data Processing Agreement ("DPA") forms part of the General Terms and Conditions of Engagement and Terms and Conditions of Use of GENESY SALES SOLUTIONS, S.L. ("Genesy") and, if applicable, of any other agreement signed between you and Genesy to regulate the engagement and use of the Platform (collectively, the "Agreement").
The present DPA and the rest of the clauses of the Agreement are complementary, however, in the event of a data protection conflict, the present DPA shall prevail.
The signing of the Agreement (or the commencement of the free trial) by the Customer implies acceptance of this DPA, which shall enter into force at that time and shall be legally binding on both parties.
The person who accepts or signs the Contract independently on behalf of the Customer, declares to Genesy that he/she has the legal authority to bind the Customer and that he/she is legally capable of entering into contracts. The term of this DPA shall be the same as the term of the Contract. This means that this Assignment Agreement shall automatically terminate upon termination of the Agreement or earlier termination in accordance with the terms of this Assignment Agreement.
The following terms shall have the following meanings:
"GENESY", "we", "us", "our" refers to GENESY SALES SOLUTIONS, S.L., a Spanish company located at Avenida de la Riera de Cassoles 5, 5º-1 - Barcelona, author, creator and developer of the Platform.
"Services" or "Platform", shall be used interchangeably, and means our software developed and run on a platform whose purpose is the ability to create targeted lead lists, enrich them with verified company and contact information from market-leading tools and databases, and automate email and LinkedIn outreach campaigns within our tool.
"Controller", "processor", "data subject", "personal data", "processing" and "appropriate technical and organizational measures" "standard contractual clauses", "personal data security breach" as used in this DPA shall have the meanings ascribed to them in the GDPR.
"Customer", "you", "your" refers to the entity that contracts the Genesy Platform and whose details are set out in the Agreement.
"Data Protection Regulation" means (i) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data ("GDPR"); (ii) Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector; and (iii) any applicable national regulations, whether implementing or transposing European or international regulations.
"Sub-processors" shall have the meaning given to the term "other processor" in Article 28.4 of the GDPR.
Collection, organization, storage, communication, consultation and deletion of personal data.
A detailed description of the processing to be carried out (nature and purpose of the processing, types of personal data and categories of data subjects) can be found attached to this DPA as Appendix 1. A list of the sub-processors appointed by Genesy can be found in Appendix 2.
The Customer, in its capacity as data controller, is responsible for ensuring that its use of the Platform complies with the Data Protection Regulations and for ensuring and monitoring, throughout the processing, Genesy's compliance with the Data Protection Regulations.
In this regard, and prior to contracting the Platform or requesting the activation of additional functionalities, the Client undertakes to determine at its own expense the need to carry out a data protection impact assessment, to carry out the corresponding prior consultations and to comply with any applicable obligations in accordance with the Data Protection Regulations.
The Customer undertakes to refrain from requesting Genesy to contract or activate any functionality of the Platform for which a data protection impact assessment has given a negative result or, having given a positive result, the Customer has not implemented the measures identified in the impact assessment. Customer releases Genesy from any liability arising from Customer's failure to comply with this clause.
In its capacity as data processor, Genesy undertakes to:
(i) process the Customer's personal data only in accordance with the Customer's documented instructions (as set forth in this DPA, or as directed by the Customer via the Platform or email) for the performance of the service;
(ii) Adopt the appropriate technical and organizational measures in accordance with Article 32 of the GDPR, under the terms set forth in clause 3.3 of this DPA;
(iii) Immediately inform the Client if, in its opinion, an instruction violates the Data Protection Regulation;
(iv) make available to the Client all information reasonably requested by the Client for the purpose of demonstrating compliance with the obligations set forth in Article 28 of the GDPR and allow audits to be conducted by the Client or an auditor authorized by the Client;
In no event shall the audits require Genesy to disclose or permit Customer or its auditors or authorized representatives to access: (i) to any data or information of any other customer of Genesy; (ii) any internal accounting or financial information of Genesy; (iii) any trade secrets of Genesy; (iv) any information which, in Genesy's reasonable opinion, may compromise the security of its systems or facilities or cause Genesy to breach its obligations under the Data Protection Regulations or any other applicable regulations; or (v) any information that Customer, its auditors or its authorized representatives seek to access for any reason other than to verify Genesy's compliance with the terms of Article 28 of the GDPR.
In addition, audits will be limited to once a year, unless Genesy has suffered a personal data security breach in the previous twelve (12) months that has affected the personal data processed on behalf of the Customer.
(v) Assist the Customer in ensuring compliance with the obligations set forth in Articles 35 and 36 of the GDPR, taking into account the nature of the processing and the information available to Genesy;
(vi) Assist the Customer, taking into account the nature of the processing, through appropriate technical and organizational measures, whenever possible, to enable the Customer to comply with its obligation to respond to requests aimed at exercising the rights of data subjects set forth in Chapter III of the GDPR;
(vii) Ensure that Genesy personnel who are to have access to personal data processed on behalf of the Customer have undertaken to respect confidentiality or are subject to a confidentiality obligation of a statutory nature;
(viii) Notify the Client of personal data security breaches affecting personal data processed on behalf of the Client. The notification shall take place in the terms indicated in Clause 3.6 of this DPA;
(ix)At the Client's option, delete or return all personal data upon termination of the provision of the processing services, and delete existing copies unless the retention of personal data is required under Union or Member State law;
(x) Promptly notify the Client of any requests it receives from the data subject. It will not respond to such a request itself, unless it has been authorized to do so by the controller. In addition, Genesy will assist Customer in fulfilling its obligations in responding to requests from data subjects to exercise their rights, considering the nature of the processing.
In the event of a breach of security of personal data processed by Genesy, Genesy will notify Customer without undue delay and in any event within 48 hours of Genesy becoming aware of the breach. Such notification shall include at a minimum: (i) a description of the nature of the security breach (including, where possible, the categories and approximate number of data subjects and data records affected); (ii) details of a contact point from which further information about the personal data security breach can be obtained; and (iii) its likely consequences and the steps taken or proposed to be taken to remedy the security breach, including steps taken to mitigate any adverse effects. Where, and to the extent that, not all information can be provided at the same time, the initial notification will provide the information that is available at that time and, as it is gathered, additional information will be provided without undue delay.
Genesy has a general authorization from Customer to engage sub-processors listed in Appendix 2. Genesy will specifically inform Customer in writing of any additions or substitutions of sub-processors s in such list at least 10 days in advance so that Customer has sufficient time to object to such changes before the sub-processors(s) in question are engaged. Genesy will provide Customer with the necessary information to enable Customer to exercise its right to object at.
Genesy guarantees that international transfers of personal data carried out on personal data processed on behalf of the Customer will be carried out in accordance with Chapter V of the GDPR.
If Genesy makes any international transfer for which the transfer mechanism employed is no longer valid under the GDPR, Customer shall allow Genesy a reasonable period to remedy the non-compliance to identify what additional safeguards or other measures can be taken to ensure its compliance with the Data Protection Regulation.
Customer acknowledges and agrees that, as part of providing the Platform, Genesy is entitled to use data related to or obtained in connection with the operation, support or use of the Platform for its legitimate internal business purposes, such as supporting billing processes, administering the Platform, improving, benchmarking and developing our products and services, complying with applicable laws (including law enforcement requests), ensuring the security of our Platform and preventing fraud or mitigating risk.
In relation to the personal data processed, Genesy warrants that it will not use it for its own purposes unless it has aggregated and anonymized the data so that it does not identify the Customer or any other person, in particular End Users.
This DPA is subject to applicable law and to the conditions of jurisdiction of the Agreement. Notwithstanding the foregoing, to the extent permitted by applicable law, all liability arising under this DPA shall be governed by the limitations of liability (including caps on liability) in the Agreement.
Appendix 1
(Processing description)
Categories of data subjects to which the data refers
Personal data refers to the professional emails of leads that are sent to the Platform.
Categories of personal data
The personal data processed may include the following categories of data:
Special categories of data
Purpose of treatment
Personal data is processed for the purpose of providing access to and use of the Platform in accordance with the Agreement.
Types of treatment
Appendix 2.
LIST OF SUB-PROCESSORS