Data processing

Your company (“you”) is the controller of the personal data Arlo processes on your behalf; we (Julian Brönnimann and David Stocker, simple partnership, Zürich) are the processor under Art. 28 GDPR and Art. 9 FADP. This agreement is part of the terms of service and prevails over them on data protection.

The subject is Arlo’s work for you: researching companies and contacts, checking addresses, writing, sending, receiving and matching emails, following up and handling replies. The agreement applies as long as your account exists and beyond that until deletion under section 10.

Data subjects are contacts at companies Arlo finds or writes to for you, people in the email exchange of your connected mailbox, and the members of your team.

The data are names, business contact details (email address, phone number, LinkedIn profile), role and company, public information about them and their company, content and metadata of emails, and notes on stop requests, objections and erasures.

We process the data only on your instructions. Instructions are these terms, your settings in Arlo, your approvals and what your team tells Arlo. If we consider an instruction unlawful, we tell you; we do not owe a legal review of your instructions.

Only people responsible for operating Arlo and bound to confidentiality have access to the data.

We protect the data with measures appropriate to the risk, in particular: server and database in Frankfurt, Germany; every customer account strictly separated from all others; encrypted connections; access credentials encrypted with a key per account; backups encrypted before they leave the server; operational access only for the founders, with two-factor sign-in; traceable logs of Arlo’s actions. We may adapt the measures as long as the level of protection does not fall.

You allow us to engage the subprocessors on the list of subprocessors. We bind them to data protection equivalent to this agreement.

We announce a new subprocessor to your account’s owners by email at least 14 days ahead, a new language-model provider at least 30 days ahead. You may object for good data-protection reasons; if we find no solution, you may terminate the contract effective at the change.

Arlo recognises stop requests, objections, erasure and access requests in replies, honours them and prepares your answer. Beyond that we assist you within reason with data subject requests, data protection impact assessments and requests from authorities. We may charge reasonable rates for effort beyond Arlo’s features.

If we become aware of a breach of data security affecting your data, we report it to you without undue delay, with what we know about it.

When an owner deletes the account, we delete all of the account’s data from the database after 14 days; it leaves the backups within another 14 days. Only a note without personal data that and when the account was deleted remains.

We give you the information you need to verify compliance with this agreement, primarily in writing. An on-site audit is possible at most once a year, with 30 days’ notice, at your cost and under confidentiality.

Data goes only to countries with adequate data protection or on the basis of the European Commission’s standard contractual clauses; the list of subprocessors names the basis for each provider.

The liability rules of the terms of service apply, as far as the law permits.