Data Processing Agreement

This is our standard agreement. It is written to be read; have your own counsel review it if you need to. It is part of every Sales Secret service agreement and applies whenever Sales Secret processes personal data on a client's behalf.

Who is who

The client is the controller: it decides why and how its customers' and visitors' data is used. Sales Secret is the processor: it handles that data only to provide the service the client bought, and only on the client's instructions, which are the service agreement, the settings the client chooses in the Sales Secret app and written instructions the client sends.

What data, about whom

Website visitors (pages viewed, taps, approximate location from an IP address, a browser id, device type, written visit summaries), customers and leads (name, phone, email, messages, call recordings and transcripts, bookings and orders the client's systems share), and the client's staff users (name, email, role).

What Sales Secret does and does not do

Sales Secret processes the data to run the client's visitor tracking, inbox, AI receptionist, chat and text assistants, reports and analytics. Sales Secret does not sell the data, does not use it to advertise, and does not use it to train AI models. Visit summaries are produced through an AI provider that keeps no copy of the input or output.

Security

Data is encrypted in transit and at rest. Access is limited to Sales Secret staff who need it for support, under confidentiality duties. Secrets are rotated and access is logged. Sales Secret tells the client without undue delay, and within 72 hours, if it learns of a breach affecting the client's data, with what it knows and what it is doing.

Sub-processors

Sales Secret uses the providers described on its sub-processors page; the named list is attached to the client's signed agreement. Sales Secret tells clients of additions at least 30 days before use (by email to the account owner). A client may object in writing within that period; if the objection cannot be resolved, the client may end the affected service.

Helping the client

Sales Secret helps the client answer people exercising their rights (access, copy, correction, deletion, objection, portability) through the tools in the app and, where needed, by hand within 10 business days of a request. It helps with data protection impact assessments and authority enquiries on request.

Where data goes

Sales Secret stores data in the United States. For data about people in the European Economic Area, the United Kingdom or Switzerland, the parties rely on the European Commission's standard contractual clauses (module two, controller to processor; module three where Sales Secret acts for another processor) and the UK addendum, which are incorporated here, with Sales Secret's sub-processor list and this security description as the annexes.

When the service ends

At the end of the service Sales Secret deletes or returns the client's data within 30 days, except what the law requires it to keep, which it keeps only for that reason and that long.

Audits

Once a year, with 30 days' notice, the client may ask for Sales Secret's current security description and evidence of the controls, or arrange a review at the client's cost, in a way that does not expose other clients' data.

Contact

privacy@salessecret.com