Snapshot 24038
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Data Processing Agreement
Effective Date:September 30, 2026
This Data Processing Agreement (“DPA”) supplements the Services Subscription Agreement, order form, or other master agreement (the “Agreement”) entered into by and between the customer entity purchasing services (“Customer”, “you”, or “your”) and People Data Labs, Inc. (“Company”, “we”, “our”, or “us”).
This DPA governs the processing of personal data in connection with the services provided under the Agreement. Except as amended by this DPA, the Agreement remains in full force and effect. In the event of any direct conflict or inconsistency between the provisions of this DPA and the Agreement, the provisions of this DPA shall control.
Note that Sections 3 through 5 of this DPA apply solely when Company acts as a Processor of Customer Personal Data, and do not apply to the extent Company acts as a Controller as described in Section 2.2.
1. Definitions
1.1. Unless otherwise set out below, each capitalized term in this DPA shall have the meaning set out in the Agreement, and the following capitalized terms used in this DPA shall be defined as follows:
"Controller" has the meaning given in the GDPR and other Data Protection Laws that employ that term in designating between “processors” and “controllers” of personal data. “Controller” shall also have the same meaning as “business” for the purposes of the CCPA.
"Customer Personal Data" means any Personal Data contained within Customer Data, as described in Section 11.2 of the Agreement, that is Processed by Company solely in its capacity as a Processor on behalf of Customer in connection with the provision of the Services. (For avoidance of doubt, Customer Personal Data does not include any Personal Data as to which we act as a Controller).
"Data Protection Laws" means, to the extent applicable to the Processing of Customer Personal Data under the Agreement: the EU General Data Protection Regulation 2016/679 ("GDPR"), the California Consumer Privacy Act as amended by the California Privacy Rights Act (the “CCPA”), the Colorado Privacy Act (“CPA”), Connecticut’s Act Concerning Personal Data Privacy and Online Monitoring (“CT Act”), the Virginia Consumer Data Privacy Act (“VDCPA”), the Utah Consumer Privacy Act (“UCPA”), and any applicable national or state implementing legislation regarding privacy, data protection, or data security, in each case as amended, replaced or superseded from time to time and together with implementing regulations.
"Data Subject" has the meaning given in the GDPR, and shall also mean a “consumer” for purposes of Data Protection Laws using that term.
“Database” means Company’s proprietary database.
"European Economic Area" or "EEA" means the Member States of the European Union together with Iceland, Norway, and Liechtenstein.
"PDL Data” is Personal Data that Company licenses to you.
"Personal Data” has the meaning given in the GDPR, and shall include information that is “Personal Information” for the purposes of the CCPA.
"Processing" has the meaning given in the GDPR or other Data Protection Laws, and "Process" and its cognates will be interpreted accordingly.
"Processor" has the meaning given in the GDPR and other Data Protection Laws that employ that term in designating between “processors” and “controllers” of Personal Data. “Processor” shall also have the same meaning as “Service Provider” for the purposes of the CCPA.
"Security Incident" means any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, any Customer Personal Data.
"Standard Contractual Clauses" means either or both of the following, as the context requires:
i. The “EU SCCs”, meaning the Standard Contractual Clauses issued pursuant to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council (located http://data.europa.eu/eli/dec_impl/2021/914/oj.) and completed as set forth herein.
The “UK SCCs”, meaning the United Kingdom International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (located at https://ico.org.uk/media/for-organisations/documents/4019539/international-data-transfer-DPA.pdf) and completed as set forth herein.
"Subprocessor" means any Processor engaged by us who agrees to receive from us Customer Personal Data.
"Supervisory Authority" has the meaning given in the GDPR.
2. Data Processing
2.1. When We Act as a Processor. To the extent that we receive and process Customer Personal Data solely to provide you with Services, such as solely in order to provide you with PDL Data, we are acting as a Processor. When we act as a Processor, we will only Process Customer Personal Data in accordance with your written instructions and on your behalf. We acknowledge the Agreement (subject to any changes to the Services agreed between the Parties) and this DPA as your written instructions to us in relation to the processing of Customer Personal Data. As a Processor, to the extent required by Data Protection Laws, we will:
not retain, use, or disclose Customer Personal Data outside of the direct business relationship between you and us;
not “sell” any Customer Personal Data or “share” any Customer Personal Data for purposes of targeted advertising, as such terms are defined in Data Protection Laws;
comply with any applicable restrictions under the CCPA on combining Customer Personal Data with other data; and
provide the same level of protection for the Customer Personal Data subject to the CCPA as is required under the CCPA.
2.2. When We Act as a Controller. We are each independent Controllers of PDL Data, in each case when such PDL Data is in our respective possession.
2.3. Required Notices and Consents. Where required by Data Protection Laws, you will ensure that you have provided/will provide all necessary notices and have obtained/will obtain all necessary consents for the Processing of Customer Personal Data by us in accordance with the Agreement.
3. Subprocessors
3.1. Authorized Subprocessors. You agree that we may use the following as Subprocessors to Process Customer Personal Data: Amazon Web Services, as well as any posted at https://trust.peopledatalabs.com/.
3.2. Adding New Subprocessors. You agree that we may use Subprocessors to fulfill our contractual obligations under the Agreement. We shall notify you of the identity of any new Subprocessors we engage at least thirty (30) days before the new Subprocessor commences its Processing of Customer Personal Data (the “Notice”). We will provide Notice by either (a) posting such Subprocessors at the following webpage: https://trust.peopledatalabs.com/ (not all Customer Personal Data is processed by all Subprocessors on that page), or (b) our sending of an email at the last known email address we have on file. If you reasonably object to a new Subprocessor on grounds related to the protection of Customer Personal Data, then without prejudice to any right to terminate the Agreement, the Parties shall negotiate a resolution in good faith. If the Parties cannot agree on a resolution within 30 days of notice, then you may terminate the Agreement immediately upon written notice to us and you shall be entitled to a refund of any prepaid fees for services unused as of the effective date of termination. This termination right and refund is your sole and exclusive remedy if you object to any new Subprocessor. If you do not object within thirty (30) days of receipt of the Notice, you are deemed to have accepted the new Subprocessor.
3.3. Subprocessor Agreements. We will enter into a written agreement with each Subprocessor which imposes the same obligations on the Subprocessor with regard to their Processing of Customer Personal Data, as are imposed on us under this DPA.
3.4. Liability of Subprocessors. We will at all times remain responsible for compliance with our obligations under the DPA and will be liable to you for the acts and omissions of any Subprocessor as if they were our acts and omissions.
4. Data Security and Audits
4.1. Company Security Obligations. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, we will implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including the measures set out in this DPA.
4.2. Demonstrating Compliance. Upon your reasonable request, we will make available all information reasonably necessary to demonstrate compliance with this DPA.
4.3. Security Incident Notification. If we determine there has been a Security Incident we will (a) notify you of the Security Incident within 72 hours, (b) investigate the Security Incident and provide you (and any law enforcement or regulatory official, as required by Data Protection Law) with reasonable assistance as required to investigate the Security Incident, and (c) take steps to remedy any non-compliance with this DPA.
4.4. Company Employees and Personnel. We will treat the Customer Personal Data as confidential, and shall ensure that any employees or other personnel have agreed in writing to protect the confidentiality and security of Customer Personal Data.
4.5. Audits. We will, upon your reasonable request, allow for and contribute to audits, including inspections, of our compliance with this DPA, conducted by you (or a third party on your behalf and mandated by you) provided (i) such audits or inspections are not conducted more than once per year (unless requested by a Supervisory Authority); (ii) are conducted only during business hours; and (iii) are conducted in a manner that causes minimal disruption to Company’s operations and business.
4.6. Remediation Right. You retain the right, upon reasonable notice, to take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data.
5. Access Requests and Compliance Assistance
5.1. Government Disclosure. We will notify you of any request for the disclosure of Customer Personal Data by a governmental or regulatory body or law enforcement authority (including any data protection supervisory authority) unless otherwise prohibited by law or a legally binding order of such body or agency.
5.2. Assistance Generally. Solely to the extent and in the manner required under Data Protection Laws, we provide reasonable assistance to you for your compliance with such laws, including, without limitation, as set forth in this Sections 5.3 and 5.4.
5.3. Data Subject Rights. To the extent required under Data Protection Laws, and taking into account the nature of the Processing, we will use reasonable endeavors to assist you by implementing appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of your obligation to respond to requests for exercising Data Subject rights laid down in Data Protection Laws.
5.4. Data Protection Impact Assessments; Prior Consultations. To the extent required under Data Protection Laws, we will provide you with reasonably requested information regarding our Services to enable you to carry out data protection impact assessments or prior consultations with any Supervisory Authority, in each case solely in relation to Processing of Customer Personal Data and taking into account the nature of the Processing and information available to us. We shall provide reasonable assistance to you in the cooperation or prior consultation with the Supervisory Authority in the performance of its tasks relating to this Section, to the extent required under Data Protection Laws.
6. Controller Obligations
6.1. In the course of acting as a Controller, each Party shall:
Limit its use of Personal Data received from the other Party to the limited and specific purposes set forth in the Agreement or any applicable work order, and (without limitation of the foregoing) to purposes that it reasonably believes an average consumer would reasonably expect.
Comply with its own obligations under Data Protection Laws applicable to it as a Controller, including as to any data subject rights for Personal Data (as such terms are defined in Data Protection Laws).
Notify the other Party about all valid data subject requests, as and to the extent required by Data Protection Laws. Without limitation of the foregoing, Company shall make such data subject requests available at [https://api.peopledatalabs.com/v5/person/subjectrequest.], or an updated version thereof, and to the extent you continue to hold any PDL Data you agree to log in to that database no less than once every 30 days, and apply all such applicable subject data requests to any PDL Data you continue to hold.
As to any Personal Data received from the other Party, implement and maintain reasonable security procedures, as appropriate to the level of sensitivity and confidentiality applicable to such Personal Data.
Provide the other Party with reasonable assurances, in writing, as may be necessary to permit the other Party to ensure that it has employed Personal Data subject to the Agreement as contemplated by the Agreement.
Notify the other Party if it determines that it is no longer able to comply with this DPA or Data Protection Laws.
For Personal Data subject to the CCPA, provide the same level of protection to the Personal Data as the Party providing the Personal Data is required to provide under the CCPA.
6.2. The Party providing the Personal Data retains the right, upon reasonable notice, to (a) take reasonable and appropriate steps to ensure that the other Party uses Personal Data consistent with Data Protection Laws, and (b) stop and remediate any unauthorized Processing of Personal Data, including any Processing not authorized under this DPA.
6.3. Where one Party licenses Personal Data to the other Party that is subject to the CCPA (i.e., where the Personal Data pertains to a California resident), the provisions set forth at Section 6.4 shall apply.
6.4. The Parties agree to the following, with respect to Personal Data provided to the other Party:
Notwithstanding the more specific requirements set forth below, each Party has taken and during the term of the Agreement will take commercially reasonable steps to ensure that consumers as to whom the Personal Data pertains (“Consumers”) were provided with legally sufficient notice that their personal information would be shared and used for the purposes contemplated herein;
Each Party will provide Consumers with legally sufficient disclosures as required by applicable law, including a way to “opt out” of selling or sharing of data for commercial purposes that is visible and prominent in its posted privacy policy and (where legally required) on its home page,
Each Party, to the extent legally required, will provide a legally sufficient “notice at collection” accessible to California residents, in compliance with the State Privacy Laws, including the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), as well as a “Your Privacy Choices” or similar link on its home page;
Neither Party will provide the other Party with any Personal Data in a manner it has been notified is contrary to any “opt out” preference expressed by a Consumer;
To the extent a Party has not collected the Personal Data itself, but rather obtained it as a third party,such Party represents that it has taken commercially reasonable steps (including as appropriate through contractual provisions and periodic audits) to ensure that its data sources have taken the steps set forth in subsections (i) through (iv) above;
Each Party will provide to Customer all “opt out” or “deletion” requests it receives from any Consumer under the State Privacy Laws, as legally required, and shall reasonably assist in the implementation of any API or other method through which it communicates same.
Company may take reasonable and appropriate steps to ensure that the Customer uses the Database solely as set forth above and solely in compliance with the CCPA. Upon reasonable notice, Company may take reasonable and appropriate steps to remediate Customer’s unauthorized use of the Database. Further, each Party shall protect Personal Data received from the other Party according to the protocols set forth in this DPA.
Each Party shall notify the other within seven (7) business days should it determine that it can no longer meet its legal obligations under the CCPA, with respect to the licensed portions of the Database.
7. Data Transfers.
7.1. Transfer Mechanisms. To the extent that the Processing of Personal Data involves the transmission of such Personal Data to a country or territory outside the country from which such Personal Data was provided to the Party receiving the data (the “data importer”), the Parties will comply with any requirements under Data Protection Laws regarding such transfers. To the extent required by Data Protection Laws, the data importer shall ensure that a lawful data transfer mechanism is in place prior to engaging in any onward transfers of Personal Data from one country to another.
7.2. EU SCCs. Only to the extent legally required, upon entering into this DPA, the Parties will sign Exhibit C - Standard Contractual Clauses: Restricted Transfers of Customer Data.
7.3. UK SCCs. Only to the extent legally required, upon entering into this DPA, the Parties will sign Exhibit C - Standard Contractual Clauses: Restricted Transfers of Customer Data.
7.4. Swiss Data. Only to the extent legally required, upon entering into this DPA, the Parties will sign Exhibit C - Standard Contractual Clauses: Restricted Transfers of Customer Data.
8. Termination
8.1. Deletion of Data. Subject to the Retention terms below, we will, at your election:
allow Customer to prevent Customer Personal Data from being retained when using API products by using a Company feature that prevents customer Personal Data inputs from being logged at the time of input (e.g. “blind logging”);
or
delete all Customer Personal Data Processed by us or any Subprocessors within 90 (ninety) days of the date of termination of the Agreement.
8.2. Retention. We and our Subprocessors may retain Customer Personal Data to the extent required by applicable laws and only to the extent and for such period as required by applicable laws and always provided that we ensure the confidentiality of all such Customer Personal Data and shall ensure that such Customer Personal Data is only Processed as necessary for the purpose(s) specified in the applicable laws requiring its storage and for no other purpose.
Exhibit C: Standard Contractual Clauses
Restricted Transfers of Customer Data
The Exhibit supersedes all other references to Standard Contractual Clauses in this Agreement.
"EU SCCs" means the contractual clauses annexed to the European Commission's Implementing Decision 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council and completed as set forth herein.
The “UK SCCs”, meaning the United Kingdom International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (located at https://ico.org.uk/media/for-organisations/documents/4019539/international-data-transfer-DPA.pdf) and completed as set forth herein.
1.1. EU SCCs. To the extent legally required, by entering into this DPA, the Parties are deemed to have signed the EU SCCs and its Annexes, which form part of this DPA and and take precedence over the rest of this DPA to the extent of any conflict. Except as described in Sections 1.2 and 1.3 below, the EU SCCs are deemed completed as follows:
Module 1 applies to transfers of Personal Data where both Parties are independent Controllers (as described in Section 2.2 of the DPA). Module 2 of the EU SCCs applies to transfers of Customer Personal Data from Customer (the Controller) to us (the Processor).
Clause 7 (the optional docking clause is included.
Clause 9 of Module 2 (Use of sub-processors): The Parties select Option 2 (General written authorization). The initial list of Subprocessors and the procedures for updating such list are set forth in Sections 3.1 and 3.2 of this DPA.
Clause 11, the optional language will not apply.
Clause 17 (Option 1), the EU SCCs will be governed by Irish law.
Clause 18(b), disputes shall be resolved before the courts of the Republic of Ireland.
Annex I is completed as set forth in Exhibits C-1 and C-2 of this DPA. Annex II is completed as set forth in Section 4 of this DPA. Annex III is not applicable because the Parties have chosen General Authorization under Section 3 of this DPA
1.2. UK SCCs. To the extent legally required, by entering into this DPA, the Parties are deemed to be signing the UK SCCs, which form part of this DPA and take precedence over the rest of this DPA as set forth in the UK SCCs. The Tables within the UK SCCs are deemed completed as follows:
Table 1: The Parties’ details shall be the Parties and their affiliates to the extent any of them is involved in such transfer, and the Key Contact shall be the contacts set forth in Exhibits C-1 and C-2 of this DPA, as applicable.
Table 2: The Approved EU SCCs referenced in Table 2 shall be the EU SCCs as executed by the Parties and completed above.
Table 3: Annex I is set forth in Exhibits C-1 and C-2 of this DPA. Annex II is set forth in Section 4 of this DPA. Annex III is inapplicable.
in Table 4. We may end this Agreement as set out in Section 19 of the UK SCCs.
1.3. Swiss Data. For transfers of Personal Data that are subject to the Swiss Federal Act on Data Protection (“FADP”), the EU SCCs form part of this Agreement as set forth above, but with the following differences to the extent required by the FADP:
References to the GDPR in the EU SCCs are to be understood as references to the FADP insofar as the data transfers are subject exclusively to the FADP and not to the GDPR, and references to personal data in the EU SCCs also refer to data about identifiable legal entities until the entry into force of FADP revisions that eliminate this broader scope.
The term “member state” in the EU SCCs shall not be interpreted in such a way as to exclude data subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence (Switzerland) in accordance with Clause 18(c) of the EU SCCs.
The relevant supervisory authority is the Swiss Federal Data Protection and Information Commissioner (for transfers subject to the FADP and not the GDPR), or both such Commissioner and the supervisory authority identified in the EU SCCs (where the FADP and GDPR apply, respectively).
Exhibit C-1: Controller-to-Processor
Schedule 1: List of Parties (Data Exporter & Data Importer)
For Customers in The European Economic Area Sending Customer Personal Data to People Data Labs
Data Exporter
Name, Address, and Contact details
The Customer entity name, address, and contact details specified in the Agreement, applicable Order Form or provided via Customer account.
Activities relevant to the data transferred under these Clauses:
Use of Customer Data and Customer Sourced Data pursuant to the Agreement.
Role:
Controller
Signature and date:
The Parties agree that execution of the Agreement, signing of an applicable Order Form, or the Customer’s electronic acceptance of the terms online (including by clicking "Sign Up" or checking an assent box) shall constitute execution and acceptance of these Clauses by the Data Exporter.
Data Importer
Name:
People Data Labs, Inc.
Address:
455 Market St Ste 1940, PMB 25778, San Francisco, CA 94105
Contact details
Privacy Manager
privacy@peopledatalabs.com
Activities relevant to the data transferred under these Clauses:
Use of Customer Data and Customer Sourced Data pursuant to the Agreement.
Signature and date:
The Parties agree that execution of the Agreement, signing of an applicable Order Form, or the Customer’s electronic acceptance of the terms online (including by clicking "Sign Up" or checking an assent box) shall constitute execution and acceptance of these Clauses by the Data Exporter.
Role:
Processor
Schedule 2: Customer Data
This Schedule 2 describes Customer Data transferred by Data Exporter and the purposes for which that Customer Data may be Processed by the Data Importer
Categories of data subjects whose personal data is transferred:
Customers, prospective customers, end-users, employees, or other individuals whose personal data is included in the datasets uploaded, queried, or accessed by the Customer via the Services.
Categories of personal data transferred:
Personal data relating to individuals provided by or accessed by Customer pursuant to the Agreement, which may include: name, professional contact details (email, phone), job title, employer, employment history, educational background, social media profiles, and any other data categories specified in an applicable Order Form or queried by Customer via the platform interface.
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialized training), keeping a record of access to the data, restrictions for onward transfers or additional security measures:
None anticipated. The Customer is strictly prohibited under the Agreement from submitting or querying sensitive personal data (e.g., health data, financial account numbers, government IDs, or biometric data) via the Services.
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis):
Continuous basis for the duration of the Agreement, depending on the Customer’s utilization of the platform APIs, user interface, or delivery schedule specified in an Order Form.
Nature of the processing:
Processing pursuant to the Agreement
Purpose(s) of the data transfer and further processing:
The Data Importer will provide Customer Data for the Data Exporter to use in the Services pursuant to the Agreement.
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period:
For as long as the Agreement is in force.
Exhibit C-2: Controller-to-Controller
Schedule 1: List of Parties (Data Exporter & Data Importer)
For People Data Labs Sending Personal Data to Customers
Data Exporter
Name:
People Data Labs, Inc.
Address:
455 Market St Ste 1940, PMB 25778, San Francisco, CA 94105
Contact details:
Privacy Manager
privacy@peopledatalabs.com
Activities relevant to the data transferred under these Clauses:
Providing the services (including PDL Data, as defined in the DPA) to data exporters in accordance with the Agreement and the DPA.
Signature and date:
The Parties agree that execution of the Agreement, signing of an applicable Order Form, or the Customer’s electronic acceptance of the terms online (including by clicking "Sign Up" or checking an assent box) shall constitute execution and acceptance of these Clauses by the Data Exporter.
Role:
Controller
Data Importer
Name, Address, and Contact details
The Customer entity name, address, and contact details specified in the Agreement, applicable Order Form or provided via Customer account.
Activities relevant to the data transferred under these Clauses:
Receiving the services (including PDL Data, as defined in the DPA) provided by the data importer in accordance with the Agreement and the DPA.
Signature and date:
The Parties agree that execution of the Agreement, signing of an applicable Order Form, or the Customer’s electronic acceptance of the terms online (including by clicking "Sign Up" or checking an assent box) shall constitute execution and acceptance of these Clauses by the Data Exporter.
Role:
Controller
Schedule 2: PDL Data
This Schedule 2 delineates the PDL Data transferred by the Data Exporter and specifies the purposes for which the Data Importer serves as an independent controller.
Categories of data subjects whose personal data is transferred:
Individuals residing in the EEA, UK, or Switzerland whose professional, educational, or public profile data is contained within the datasets or database records provided or made available to the Customer via the Services.
Categories of personal data transferred:
PDL Data (as defined in the DPA), which may include the following categories of Personal Data: first name, last name, email address, phone number, home address, date of birth, contact information, sex, education and work history provided in resumes, as well as other data set forth in the following: https://www.peopledatalabs.com/data-fields.
Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialized training), keeping a record of access to the data, restrictions for onward transfers or additional security measures:
No Sensitive Data, as categorized by relevant statutory frameworks, shall be transmitted to the data importer.
The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis):
Continuously for the duration of the Agreement.
Nature of the processing:
Recruitment, market research, workforce planning, and other similar
business-to-business purposes as permitted under the Agreement.
Purpose(s) of the data transfer and further processing:
Data importer’s receipt of services (including PDL Data) provided by data exported under the Agreement.
The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period:
For as long as the Agreement is in force.
For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing:
Same as above