Snapshot 56004
Normalized text
Scripts and page chrome removed; this is what change detection compares.
LA GROWTH MACHINE
DATA PROCESSING AGREEMENT
This Data Processing Agreement (hereinafter referred to as the “DPA”) is concluded between La Growth
Machine and the Client who has accepted the La Growth Machine General Terms and Conditions (hereinafter
referred to as the “Terms of Services”), by subscribing to the services available through La Growth Machine
(the “Services”).
The DPA will come into force on the same date as the Terms of Services, and for the duration of the Terms
of Services.
La Growth Machine and the Client are hereafter collectively referred to as the “Parties” and individually as a
“Party”.
In relation to the use of the Services, each of the Parties is required to process personal data in various ways.
By means of the DPA, the Parties wish to identify said processing, the rules applicable to the latter and their
respective roles with regard to the law applicable to the protection of personal data.
Article 1 DEFINITIONS
Unless otherwise expressly stated in the DPA, the terms “Personal Data”, “Data Subjects”, “Data
Controller”, “Data Processor”, and “Personal Data Breach” shall have the meaning provided for in the
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection
of natural persons with regard to the processing of personal data and on the free movement of such data
(hereinafter referred to as the “GDPR”).
In addition, it is stated that terms used in the DPA with a capital letter shall have the same meaning as in the
Terms of Services.
In addition, the following terms will have the following definitions in the DPA:
1.1 “Data Protection Law” shall mean all national, European and international laws, regulations and
other standards applicable to the Processing concerned, including in particular the GDPR and any
national laws of the Member States of the European Union adopted in addition to or in application of
the provisions of the GDPR, as well as, where applicable, the national, European and international
laws, regulations and other standards applicable to the Processing concerned;
1.2 “Data Transfer” shall mean any transfer of Personal Data to a person, entity or service of any kind
located in a third country that does not benefit from an adequacy decision of the European Commission
within the meaning of Article 45 of the GDPR, and/or any access to Personal Data by a person, entity
or service of any kind located in such country.
1.3 “Processing”: shall mean the processing of Personal Data within the meaning of the GDPR, entrusted
to La Growth Machine, limited to those described in Article 3.
Article 2 PURPOSE
The purpose of the DPA is to define the terms and conditions applicable to the Processing implemented in the
course of the Services. This Processing is related to the use by the Client of La Growth Machine.
Article 3 LIST OF PROCESSING IMPLEMENTED
In the course of the Services, the following Processing may take place:
N° Purpose Data Subjects Qualification of La Qualification of Client
Growth Machine
1 Collection and Natural persons meeting Data Processor Data Controller
extraction of the criteria defined by
Personal Data the Client within La
available through Growth Machine.
the LinkedIn
account of the Client
2 Collection and Natural persons meeting Data Processor Data Controller
extraction of the criteria defined by
Personal Data freely the Client within La
available on Internet Growth Machine.
3 Collection through Natural persons meeting Data Processor Data Controller
internal third-party the criteria defined by
tools used by the the Client within La
Client. Growth Machine.
4 Export personal data Natural persons meeting Data Processor Data Controller
to third-party tools the criteria defined by
used and designated the Client within La
by the Client. Growth Machine.
5 Automatic sending Natural persons meeting Data Processor Data Controller
of commercial the criteria defined by
prospecting the Client within La
messages via the Growth Machine.
Client account.
6 Operation and Users. Data Controller Data Controller
management of user
accounts
7 Support, Users. Data Controller N/A
maintenance and
improvement Natural persons meeting
operations the criteria defined by
the Client within La
Growth Machine.
8 Contract Natural persons Data Controller N/A
management identified in the
Agreement and/or
designated by the Client
as points of contact.
Article 4 DESCRIPTION AND METHODS OF PROCESSING CARRIED OUT
For the sole purpose of the performance of the Services, the Client - as Data Controller - authorizes La Growth
Machine - as Data Processor - to carry out the Processing on his behalf, the modalities of which are more
precisely described in Appendix A
Description and modalities of the processing. The Subprocessors are listed in Appendix B
Sub processors list.
2 / 14
Article 5 OBLIGATIONS OF THE PARTIES
5.1 Obligations of each Party
Each of the Parties undertakes to comply with all the legal obligations imposed on it pursuant to the Data
Protection Law on the Protection of Personal Data.
5.2 Obligations of the Client
As the person responsible for the Processing, the represents and warrants the Processing implemented is/are:
(i) carried out in a fair and lawful manner;
(ii) carried out for specific, explicit and legitimate purposes;
(iii) strictly limited to Personal Data that is (a) adequate, relevant and not excessive in relation to the
purposes of the Processing, (b) accurate, complete and, where applicable, up to date;
(iv) on an adequate legal basis within the meaning of the GDPR.
In addition, the Client undertakes to comply with its obligation to inform the Data Subjects.
5.3 Obligations of La Growth Machine
5.3.1 Processing on documented instructions from the Client
La Growth Machine undertakes to process Personal Data solely upon documented instructions of the Client,
including in relation to Data Transfers
Notwithstanding the foregoing, La Growth Machine may proceed with any other processing when required by
the European authorities or the applicable law to which it is subject. In such a situation, La Growth Machine
undertakes to inform the Client of this obligation to process Personal Data, before proceeding with this
Processing, unless the relevant law limits such information.
The Parties expressly agree that the DPA, as well as the Terms of Services, constitute documented instructions
from the Client in the sense of the previous paragraph.
5.3.2 Assistance provided for the Client
In accordance with the Data Protection Law on the Protection of Personal Data, La Growth Machine undertakes
to fulfill its obligation(s):
(i) to assist the Client in responding to requests to exercise the rights of the Data Subjects and to comply,
where appropriate, with such requests;
(ii) relating to the security of the Processing implemented and the confidentiality of the Personal Data
collected and processed;
(iii) to notify Personal Data Breaches;
(iv) to carry out prior impact studies and to consult, where necessary, the Supervisory Authorities prior to
the implementation of a Processing.
5.3.3 Processing’s security
La Growth Machine commits itself to take and maintain all appropriate technical and organizational measures
with regard to the risks presented by the concerned Processing in order to ensure an adequate level of security
of the concerned Processing and to protect the Personal Data collected and processed in the framework of
the implementation of said Processing.
5.3.4 Confidentiality of Personal Data
La Growth Machine undertakes to implement procedures to ensure that any third party to whom it allows
access, to the extent permitted by the DPA, to the relevant Personal Data, including its employees,
subcontractors, and other partners, is bound by appropriate obligations of confidentiality in relation to the
relevant Personal Data.
3 / 14
5.3.5 Right to audit
Within the limit of one (1) per year, the Client may carry out or have carried out, at his own expense, an audit
of La Growth Machine in order to ensure that the latter complies with the stipulations of the DPA, in the
situation where the Client notices that La Growth Machine does not comply with its commitments.
If the Client wishes to call upon a third party to carry out the audit, this third party shall not be a competitor
of La Growth Machine and shall (i) be subject to confidentiality obligations at least as restrictive as those
mentioned in the DPA or in the Terms of Services; and (ii) respect the hygiene and security measures of La
Growth Machine. The Client vouches for that its auditors to comply with the provisions of this article.
The Client shall notify La Growth Machine in writing, with a minimum of fifteen (15) working days beforehand,
of its decision to proceed with an audit, specifying its scope and its methods. The Client will try to conduct the
audits in such a way as to cause the minimum of disturbances and interruptions to the activities of La Growth
Machine. The audits can only be conducted during the working hours of La Growth Machine’s offices. La
Growth Machine will endeavor to cooperate in the audit. If the duration and/or conduct of the audit affects
the activities of La Growth Machine by extending beyond one (1) day, La Growth Machine may charge the
Client for the costs incurred by La Growth Machine on the basis of the time spent by its employees and/or
service providers to participate in the audit. If the audit affects the provision of the services, La Growth Machine
will not be liable for any credit or responsibility whatsoever.
The audit can only concern the last twelve (12) months of activity before the beginning of the audit. During
the audit, the Client will not have access to (i) data or information about other clients and prospects of La
Growth Machine; (ii) any internal data that La Growth Machine considers to be proprietary (e.g., cost structure,
financial data, accounting information); or (iii) any other Confidential Information of La Growth Machine that
is not directly and strictly relevant to the purpose of the audit.
All information disclosed or exchanged in the course of conducting an audit, as well as the results thereof,
constitutes Confidential Information.
5.3.6 Subcontracting
La Growth Machine can call upon any sub-processor to carry out specific processing activities. In this case, it
shall inform the Client in advance and in writing of any changes envisaged concerning the addition or
replacement of other sub-processors.
The sub-Processor is obliged to comply with the obligations hereunder on behalf of and on instructions from
the Client. It is the La Growth Machine responsibility to ensure that the sub-processor provides the same
sufficient guarantees to implement appropriate technical and organizational measures in such a manner that
processing meets the requirements of the GDPR. Where the sub-processor fails to fulfill its data protection
obligations, La Growth Machine remains fully liable with regard to the Client for the sub-processor’s
performance of its obligations.
The Client has a maximum of seven (7) days from the date of receipt of this information to present its
objections under the conditions set forth in the Terms of Services. In the event that no agreement can be
reached on the identity of the subsequent sub-processor to be recruited, and performance of the Agreement
cannot be pursued as a result, the Client shall have the right to terminate the Terms of Services.
5.3.7 Deletion/restitution of Personal Data
La Growth Machine undertakes, at the end of the Terms of Services, to proceed to the definitive and irreversible
deletion of all the Personal Data still in its possession or to return all the Personal Data to the Client.
In the absence of documented instructions from the Client, La Growth Machine will prioritize the deletion of
the Personal Data concerned, according to the previous paragraph.
5.3.8 Duty to inform
In case La Growth Machine considers that a documented instruction of the Client concerning the entrusted
Processing could be considered as illicit with regard to the Data Protection Law or could lead to a breach or
violation of the latter, La Growth Machine undertakes to inform the Client.
4 / 14
In the event of a Personal Data Breach, La Growth Machine will (i) inform the Client within a reasonable delay
after being aware of the Personal Data Breach, in order to provide the Client with all relevant information; and
(ii) update the Client regarding any remediation action implemented in order to correct the Personal Data
Breach and mitigate the associated risks; and (iii) provide the Client with any reasonable assistance it may
require while handling such Personal Data Breach, as the case may be under conditions agreed upon between
the Parties.
5.3.9 Data Protection Officer
La Growth Machine has appointed a Data Protection Officer (“DPO”) who can be contacted by e-mail at the
following address privacy@lagrowthmachine.com. The DPO is the Client’s main contact for any questions
relating to the personal data protection.
Article 6 PREVALENCE
In the event of a conflict between the provisions of the DPA and the Terms of Services, the Parties agree that
the former shall prevail.
5 / 14
APPENDIX A
DESCRIPTION AND MODALITIES OF THE PROCESSING
1. PROCESSING N°1
Purposes of the Processing Enable the Client to proceed with automated prospecting campaigns
Collection of the data La Growth Machine collects LinkedIn data at the client's request and
through its LinkedIn account
List of Data Subjects Natural persons holding a position within a prospect of the Client
List of the Personal Data Name, first name(s), business e-mail address, occupation, previous
concerned professional experiences, phone number (when available), date of birth
(when available), geographical position (when available), profile picture
(when available), biography, sent and received messages on relevant
channels (e.g., LinkedIn, X, e-mail)
List of special categories of N/A
Personal Data concerned
Means of data collection La Growth Machine platform
Exhaustive list of sub- MongoDB; Scaleway; Amazon Web Services; Bright Data; Macstadium;
processors Microsoft; Google
Data Transfer Yes (Appendix B)
Retention period 3 years from collection
Fate of the Personal Data Definitive deletion
concerned at the end of the
Terms of Services
2. PROCESSING N°2
Purposes of the Processing Enable the Client to proceed with automated prospecting campaigns
Collection of the data La Growth Machine collects data of Data Subjects at the Client's request
and through various websites, when the data is freely available.
List of Data Subjects Natural persons meeting the profile sought by the Client
6 / 14
List of the Personal Data Name, first name(s), business e-mail address, occupation, previous
concerned professional experiences, phone number (when available), date of birth
(when available), geographical position (when available), profile picture
(when available), biography.
List of special categories of N/A
Personal Data concerned
Means of data collection La Growth Machine platform
Exhaustive list of sub- MongoDB; Scaleway; Amazon Web Services; Bright Data
processors
Data Transfer Yes
Retention period 3 years from collection
Fate of the Personal Data Definitive deletion
concerned at the end of the
Terms of Services
3. PROCESSING N°3
Purposes of the Processing Enable the Client to proceed with automated prospecting campaigns
Collection of the data La Growth Machine collects data at the client's request and through
internal third-party tools used by the Client.
List of Data Subjects Natural persons holding a position within a prospect of the Client
List of the Personal Data Name, first name(s), business e-mail address, occupation, previous
concerned professional experiences, phone number (when available), date of birth
(when available), geographical position (when available), profile picture
(when available), biography, sent and received messages on relevant
channels (e.g., LinkedIn, X, e-mail)
List of special categories of N/A
Personal Data concerned
Means of data collection La Growth Machine platform
Exhaustive list of sub- MongoDB; Scaleway; Amazon Web Services; Bright Data; Macstadium,
processors Microsoft, Google;
Data Transfer Yes (Appendix B)
7 / 14
Retention period 3 years from collection
Fate of the Personal Data Definitive deletion
concerned at the end of the
Terms of Services
4. PROCESSING N°4
Purposes of the Processing Enable the Client to proceed with automated prospecting campaigns
Collection of the data La Growth Machine collects data at the client's request in order to export
personal data to third-party tools used and designated by the Client.
List of Data Subjects Natural persons holding a position within a prospect of the Client
List of the Personal Data Name, first name(s), business e-mail address, occupation, previous
concerned professional experiences, phone number (when available), date of birth
(when available), geographical position (when available), profile picture
(when available), biography, sent and received messages on relevant
channels (e.g., LinkedIn, X, e-mail)
List of special categories of N/A
Personal Data concerned
Means of data collection La Growth Machine platform
Exhaustive list of sub- MongoDB; Scaleway; Amazon Web Services; Bright Data; Macstadium,
processors Microsoft, Google;
Data Transfer Yes (Appendix B)
Retention period 3 years from collection
Fate of the Personal Data Definitive deletion
concerned at the end of the
Terms of Services
5. PROCESSING N°5
Purposes of the Sending automatic messages to the Data Subjects.
Processing
Collection of the data La Growth Machine collects data of Data Subjects at the Client's request
and through various websites in order to enrich its data base.
8 / 14
List of Data Subjects Natural persons holding a position within a prospect of the Client.
List of the Personal Data Name, first name(s), business e-mail address, occupation, previous
concerned professional experiences, phone number (when available), date of birth
(when available), geographical position (when available), profile picture
(when available), biography.
List of special categories of N/A
Personal Data concerned
Means of data collection La Growth Machine Platform
Exhaustive list of Sub- Amazon Web Services; Google Suite; Drop contact; Genderapi; OpenAI.
processors
Data Transfer Yes
Retention period 3 years from collection
Fate of the Data concerned Definitive deletion
at the end of the Terms of
Services
6. PROCESSING N°6
Purposes of the Operation and management of user accounts
Processing
Collection of the data La Growth Machine collects data of Data Subjects from the Client.
List of Data Subjects Natural persons holding a position within the Client.
List of the Personal Data Name, first name(s), business e-mail address, occupation, geographical
concerned position (when available), profile picture (when available).
List of special categories of N/A
Personal Data concerned
Means of data collection La Growth Machine Platform
Exhaustive list of Sub- Amazon Web Services; Google Suite; OpenAI, MongoDB, Stripe,
processors Intercom.
Data Transfer Yes
9 / 14
Retention period Duration of the Subscription Plan.
Fate of the Data concerned Definitive deletion of personal data (anonymous usage data are kept)
at the end of the Terms of
Services
7. PROCESSING N°7
Purposes of the Support, maintenance and improvement operations
Processing
Collection of the data La Growth Machine collects data of Data Subjects from the Client.
List of Data Subjects Natural persons holding a position within the Client.
List of the Personal Data Name, first name(s), business e-mail address, occupation, geographical
concerned position (when available), profile picture (when available), use of
Services and Software.
List of special categories of N/A
Personal Data concerned
Means of data collection La Growth Machine Platform
Exhaustive list of Sub- Amazon Web Services; Google Suite; OpenAI, Intercom.
processors
Data Transfer Yes
Retention period Duration of the Subscription Plan.
Fate of the Data concerned Definitive deletion of personal data (anonymous usage data are kept).
at the end of the Terms of
Services
8. PROCESSING N°8
Purposes of the Contract management
Processing
Collection of the data La Growth Machine collects data of Data Subjects from the Client.
List of Data Subjects Natural persons holding a position within the Client.
10 / 14
List of the Personal Data Name, first name(s), business e-mail address, occupation.
concerned
List of special categories of N/A
Personal Data concerned
Means of data collection La Growth Machine Platform
Exhaustive list of Sub- Amazon Web Services; Google Suite, MongoDB, Stripe, Intercom
processors
Data Transfer Yes
Retention period One (1) year after expiry or termination of the Agreement
Fate of the Data concerned Archival for legal reasons.
at the end of the Terms of
Services
11 / 14
APPENDIX B
SUB PROCESSORS LIST
Name of Processing Data Transfer Country Transfer
Subprocessor warranty
Outside EU
MongoDB Platform operation, Yes Processing: Ireland MongoDB use
enrichment of the data standard
base Head office: New-York contractual
clauses and
have a
certification to
the EU-US
Data Privacy
Framework,
the US
Extension to
the EU-US
DPF, and the
Swiss US DPF.
Scaleway Platform operation N/A Processing : France N/A
Head office: 8, rue de la
Ville de l’Evêque, 75008,
Paris France
Amazon Web Platform operation, N/A Processing: France / N/A
Services maintenance, support, Luxembourg
Head office: 31 place des
Corolles, Tour Carpe Diem,
92400, Courbevoie,
France.
Bright Data Platform operation N/A Processing: Israel N/A
Head office: 4
Hamachshev St.; Netanya
4250713; Israel
Macstadium Platform operation, N/A Processing: Ireland N/A
LinkedIn automation
Head office 3525 Piedmont
Road, NE, Building 7, Suite
700, Atlanta, GA 30305.
Google Suite Client communication, N/A Processing: France N/A
reporting, analysis,
technical improvement Head office:8, rue de
Londres, 75009, Paris,
France
Drop Contact E-mail enrichment on N/A Processing: France N/A
Client’s instructions
Head office: 7, place de
l’Hôtel de Ville, 93600,
12 / 14
Aulnay-sous-Bois, France.
Genderapi Gender enrichment on N/A Processing: Germany N/A
Client’s instructions
Head office: Markus Perl IT
Solutions - Hermann-
Mayrhofer-Str. 3 - 94036
Passau - Germany
OpenAI Platform operation; e- Yes (Residual) Processing: European Use standard
mail prospection: Union contractual
automatically suggest clauses.
messages to be sent. Head office: 548 Market
Street; PMB 97273; San
Francisco, California
94104-5401; United States
Microsoft Platform operation, Yes (Residual) Processing: France Implemented
LinkedIn automation relevant
Head office: 37 Quai du contractual
Président Roosevelt, undertakings
92130 Issy-les-Moulineaux
Stripe Platform operation; N/A Processing: Ireland
payment processor
Head office:
1 Grand Canal Street Lower,
Grand Canal Dock,
Dublin D02 H210, Ireland
Intercom Platform operation, Yes (Residual) Processing: Ireland
support operation
Head office: 55 2nd
Street, 4th Floor,
San Francisco, CA 94105;
United States
13 / 14
APPENDIX C
SECURITY MEASURES
All treated information is protected in transit using the HTTPS protocol.
All servers are located in the EU in order to be fully GDPR compliant.
All the backups are encrypted usingAES 256. In order to ensure a high availability of our service, we track
everything with alert monitoring tools that contacts the development team in case of failure. Our uptime can
be consulted here : https://status.lagrowthmachine.com/
Our web hosts (MongoDB, AWS and Scaleway) are certified by leading third-party cybersecurity auditors.
Databases are built with multi-layer security including encrypted passwords, 2FA, intrusion detection systems,
and VPC with strict firewall settings.
Integrated SaaS Services are authorized securely with OAuth2 and credentials are not stored for those services.
Our IT infrastructure is replicated via AWS High Availability which guarantees zero downtime.
Automatic data backup is performed several times a day, with a maximum 24-hour RTO and RPO.
14 / 14