Snapshot 64077
Normalized text
Scripts and page chrome removed; this is what change detection compares.
SALESHUB NPS SURVEY – CX OPERATING SYSTEM – DATA PROCESSING ADDENDUM
SalesHub, LLC
Data Processing Addendum
Last Updated: June 2025
Effective Date : June 1, 2025
saleshub.info | privacy@saleshub.info | 1-833-733-2468
1853 Piedmont Rd Suite 301, Marietta, GA 30066, USA
Recitals
This Data Processing Addendum ('DPA') is entered into between SalesHub, LLC ('Processor' or
'SalesHub') and the entity identified as the customer on the applicable order form or service
agreement ('Controller' or 'Customer').
This DPA forms part of and is subject to the terms of the Master Subscription Agreement or
other written agreement between the parties governing the use of SalesHub's services (the
'Agreement'). In the event of a conflict between this DPA and the Agreement, this DPA shall
prevail with respect to data protection matters.
The parties agree as follows:
Article 1 - Definitions
In this DPA, the following terms have the meanings set forth below:
• "Controller" means the entity that determines the purposes and means of Processing of
Personal Data.
• "Processor" means the entity that Processes Personal Data on behalf of the Controller.
• "Personal Data" means any information relating to an identified or identifiable natural
person.
• "Processing" means any operation performed on Personal Data.
• "Data Subject" means the natural person to whom Personal Data relates.
• "Sub-processor" means any third party engaged by SalesHub to process Personal Data.
• "Data Protection Law" means all applicable privacy and data protection laws, including
GDPR, UK GDPR, and CCPA/CPRA as applicable.
SalesHub, LLC | saleshub.info | privacy@saleshub.info | 1-833-733-2468
1
1853 Piedmont Rd Suite 301, Marietta, GA 30066, USA
SALESHUB NPS SURVEY – CX OPERATING SYSTEM – DATA PROCESSING ADDENDUM
• "GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the
Council.
• "Services" means the SalesHub NPS Survey Application and related services as defined
in the Agreement.
Article 2 - Processing of Personal Data
2.1 Scope and purpose
SalesHub shall process Personal Data only as necessary to provide the Services and only on
documented instructions from Customer, unless required to do so by applicable law.
2.2 Nature of processing
SalesHub processes Personal Data in the following ways:
• Storing survey response data within Customer's own Salesforce org (data never leaves
Customer's Salesforce environment)
• Transmitting open-text survey responses to the Anthropic Claude API for AI sentiment
analysis (transient, stateless processing — data is not retained by Anthropic)
• Processing Customer business contact information for account management and
support
2.3 Instructions
Customer's instructions to SalesHub are set forth in the Agreement and this DPA. Customer
may issue additional reasonable instructions during the term of the Agreement. SalesHub will
promptly inform Customer if it believes an instruction infringes applicable Data Protection Law.
Article 3 - Obligations of SalesHub
SalesHub agrees to:
1. Process Personal Data only on Customer's documented instructions
2. Ensure that personnel authorized to process Personal Data are subject to confidentiality
obligations
3. Implement and maintain appropriate technical and organizational security measures as
described in Annex B
4. Not engage any new Sub-processor without providing Customer at least 30 days' prior
notice and the opportunity to object
5. Assist Customer, insofar as reasonably practicable, in fulfilling its obligations to respond
to Data Subject requests
6. Assist Customer in ensuring compliance with security, breach notification, impact
assessment, and prior consultation obligations
7. At Customer's choice, delete or return all Personal Data upon termination of services
8. Make available all information necessary to demonstrate compliance with this DPA
SalesHub, LLC | saleshub.info | privacy@saleshub.info | 1-833-733-2468
2
1853 Piedmont Rd Suite 301, Marietta, GA 30066, USA
SALESHUB NPS SURVEY – CX OPERATING SYSTEM – DATA PROCESSING ADDENDUM
9. Notify Customer without undue delay, and within 72 hours where feasible, upon
becoming aware of a Personal Data breach
Article 4 - Sub-processors
4.1 Authorization
Customer provides general authorization for SalesHub to engage Sub-processors. SalesHub's
current Sub-processors are listed in Annex C.
4.2 New Sub-processors
SalesHub will notify Customer at least 30 days before engaging a new Sub-processor or making
material changes to existing Sub-processor arrangements. Customer may object to a new Sub-
processor on reasonable grounds related to data protection within 14 days of notice. If
Customer objects and the parties cannot reach a resolution, Customer may terminate the
relevant services without penalty.
4.3 Sub-processor obligations
SalesHub imposes data protection obligations on Sub-processors equivalent to those set out in
this DPA. SalesHub remains liable to Customer for the performance of Sub-processors'
obligations.
Article 5 - Data Subject Rights
SalesHub shall, to the extent legally permitted, promptly notify Customer of any request
received directly from a Data Subject. SalesHub shall not respond to Data Subject requests
without Customer's documented instruction, unless required by law.
Because the majority of Personal Data is stored within Customer's Salesforce org, Customer (as
Controller) is best positioned to manage Data Subject requests directly through Salesforce
administration. SalesHub will provide reasonable assistance upon request.
Article 6 - Security
SalesHub shall implement and maintain the technical and organizational measures set out in
Annex B, which provide a level of security appropriate to the risk. SalesHub shall regularly test
and evaluate the effectiveness of these measures.
Article 7 - Personal Data Breach
In the event of a Personal Data Breach involving Personal Data processed under this DPA,
SalesHub shall:
SalesHub, LLC | saleshub.info | privacy@saleshub.info | 1-833-733-2468
3
1853 Piedmont Rd Suite 301, Marietta, GA 30066, USA
SALESHUB NPS SURVEY – CX OPERATING SYSTEM – DATA PROCESSING ADDENDUM
10. Notify Customer without undue delay and, where feasible, within 72 hours of becoming
aware of the breach
11. Provide Customer with sufficient information to allow Customer to meet its own breach
reporting obligations
12. Cooperate with Customer and take reasonable steps to mitigate the effects of and to
remediate the breach
Breach notifications will be delivered to the email address on file for the Customer account and
will include: the nature of the breach, categories and approximate number of records involved,
likely consequences, and measures taken or proposed.
Article 8 - International Transfers
Where the Services involve a transfer of Personal Data to a country outside the European
Economic Area (EEA) or UK, SalesHub shall ensure that such transfer is subject to appropriate
safeguards in accordance with applicable Data Protection Law.
Specifically: all data stored within the SalesHub Application resides in Customer's Salesforce
org in the region selected by Customer. The only cross-border transfer that may occur is the
transient transmission of open-text survey responses to the Anthropic Claude API (US), which is
subject to Anthropic's data processing terms. Customers may disable this feature to eliminate
any cross-border transfer.
Article 9 - Term and Termination
This DPA is effective as of the date the Agreement is executed and remains in force for the
duration of the Agreement. Upon expiration or termination of the Agreement, SalesHub shall, at
Customer's election, delete or return all Personal Data and delete existing copies, except where
retention is required by law.
Article 10 - Liability
Each party's liability under this DPA is subject to the limitations of liability set out in the
Agreement. Nothing in this DPA limits either party's liability to Data Subjects or to supervisory
authorities under applicable Data Protection Law.
Article 11 - Governing Law
This DPA is governed by the laws of the State of Georgia, USA, unless required otherwise by
applicable Data Protection Law. For customers subject to GDPR, this DPA incorporates the
Standard Contractual Clauses (SCCs) issued by the European Commission where required by
applicable law.
SalesHub, LLC | saleshub.info | privacy@saleshub.info | 1-833-733-2468
4
1853 Piedmont Rd Suite 301, Marietta, GA 30066, USA
SALESHUB NPS SURVEY – CX OPERATING SYSTEM – DATA PROCESSING ADDENDUM
Agreed and Accepted
Data Processor — SalesHub, LLC
Signature: ___________________________
Name: Rashed Chowdhury
Title: Managing Partner, SalesHub LLC
Date: June 1 / 2025
SalesHub, LLC | saleshub.info | privacy@saleshub.info | 1-833-733-2468
5
1853 Piedmont Rd Suite 301, Marietta, GA 30066, USA
SALESHUB NPS SURVEY – CX OPERATING SYSTEM – DATA PROCESSING ADDENDUM
Annex A - Details of Processing
Field Details
Subject matter Processing of customer feedback survey data (NPS, CSAT, CES)
and related Salesforce records
Duration For the duration of the Agreement, plus any legally required retention
period
Nature of processing Collection, storage, transmission, analysis, classification, and
automated workflow triggering
Purpose Delivery of SalesHub NPS Survey Application features as described
in the Agreement
Categories of data subjects Customer's customers, contacts, employees, and other individuals
whose feedback is collected via the Application
Categories of personal data Names, email addresses, company names, NPS/CSAT/CES scores,
open-text feedback, Salesforce record IDs
Sensitive data None collected by design. Customers must not collect special
category data through the Application without prior agreement.
SalesHub, LLC | saleshub.info | privacy@saleshub.info | 1-833-733-2468
6
1853 Piedmont Rd Suite 301, Marietta, GA 30066, USA
SALESHUB NPS SURVEY – CX OPERATING SYSTEM – DATA PROCESSING ADDENDUM
Annex B - Technical and Organizational Security Measures
SalesHub implements the following security measures:
Encryption:
• All data encrypted in transit via TLS 1.2 or higher
• Data at rest encrypted via Salesforce platform encryption (AES-256)
Access control:
• Role-based access control enforced via Salesforce Permission Sets and Permission Set
Groups
• Field-Level Security (FLS) applied to all PII and sensitive fields
• No SalesHub employee has access to data stored in Customer Salesforce orgs
• API integrations use Named Credentials — no hardcoded API keys
Application security:
• Application has passed Salesforce AppExchange Security Review
• All external API calls use secure authentication (OAuth / API keys managed via
Salesforce Named Credentials)
• Code is reviewed against Salesforce security best practices (CRUD/FLS compliance)
Organizational measures:
• Access to internal systems limited to personnel with a business need
• Vendor agreements include data processing obligations
• Incident response procedures documented and tested
• Annual review of security and privacy policies
SalesHub, LLC | saleshub.info | privacy@saleshub.info | 1-833-733-2468
7
1853 Piedmont Rd Suite 301, Marietta, GA 30066, USA
SALESHUB NPS SURVEY – CX OPERATING SYSTEM – DATA PROCESSING ADDENDUM
Annex C - Approved Sub-processors
Sub-processor Purpose Location DPA / Compliance
Salesforce, Inc. CRM platform and data Customer's selected SOC 2 Type II, ISO
storage Salesforce region 27001.
trust.salesforce.com
Anthropic PBC AI sentiment analysis United States API data not stored or
(transient/stateless) used for training.
anthropic.com/privacy
SalesHub, LLC | saleshub.info | privacy@saleshub.info | 1-833-733-2468
SalesHub, LLC | saleshub.info | privacy@saleshub.info | 1-833-733-2468
8
1853 Piedmont Rd Suite 301, Marietta, GA 30066, USA