Data processing agreement

For Customer Personal Data, the Customer is the controller and Talented is its processor (a “service provider” or “contractor” under US state privacy laws). For the accounts of people who sign in to Ember, Talented is a controller, as our privacy policy describes.

• People: visitors to the Customer’s websites, the Customer’s leads and customers, and people who book with it.
• Data: contact details, booking details, purchase value, form answers, ad and campaign data, and visit details, as the privacy policy describes each, from the tracking script and the booking tools, CRMs and webhooks the Customer connects.
• Purpose: matching the Customer’s leads, bookings and sales to its Meta ads, reporting on its funnels, and showing the Customer its leads.
• Duration: while the Customer uses Ember, then until deleted as described below.
• The Customer must not send us special categories of data, such as health, biometric or financial account data.

The Customer’s instructions are these terms, the settings it chooses in Ember, and the requests its people make there or through an AI assistant they connect. We tell the Customer if we believe an instruction breaks the law. We do not use Customer Personal Data for any other purpose, including our own advertising or AI training, and never combine it with another customer’s data.

• Everyone at Talented with access is bound to confidentiality, and access is limited to those who need it.
• Traffic uses HTTPS. Email addresses and phone numbers are encrypted with AES-256-GCM and matched by keyed hashes. IP addresses are never stored.
• In Ember, only people who reach the ad account see its data.
• AI requests go only to providers that may not train on them, and, except for transcription, keep no prompts or responses.

The Customer authorizes the subprocessors on our subprocessors page. Each is bound by a written contract with data protection terms at least as protective as these. We will update that page and email the Customer at least 14 days before a new subprocessor processes Customer Personal Data. If the Customer objects on reasonable data protection grounds and we cannot address the objection, the Customer may stop using Ember. We remain responsible for our subprocessors.

We pass on any request we receive from the Customer’s visitors or leads, and help the Customer answer it, including by deleting a lead’s data. We give the Customer the information it reasonably needs for data protection impact assessments and consultations with regulators.

We notify the Customer without undue delay, and within 72 hours of confirming it, of a breach of security affecting Customer Personal Data. We say what happened, what data is affected, and what we are doing about it, and keep the Customer updated.

When the Customer asks, or closes its account, we delete Customer Personal Data within 30 days, as the data deletion page describes. Before that, the Customer may ask for a copy. Deleted data leaves our database provider’s recovery history within 30 days.

We answer the Customer’s reasonable security and privacy questionnaires, once a year or after an incident, and give the information needed to show we meet this DPA.

Ember runs in the United States. Where Customer Personal Data comes from the EEA, the UK or Switzerland, the European Commission’s Standard Contractual Clauses (module two, controller to processor, with the UK addendum and Swiss amendments) apply and are incorporated by reference, with Maryland as the place for disputes where the clauses allow and Ireland’s supervisory authority otherwise.

We do not sell or share Customer Personal Data, keep, use or disclose it outside our direct business relationship with the Customer or for any purpose other than providing Ember, or combine it with personal data from other sources except as the law allows. We comply with the California Consumer Privacy Act and tell the Customer if we can no longer meet it.

Where this DPA and the terms differ on personal data, this DPA controls; where the Standard Contractual Clauses apply, they control. The limits of liability in the terms apply to this DPA. Questions go to privacy@scout-talented.com.