This Data Processing Agreement ("Agreement") forms Exhibit A to the Terms of Service ("TOS") between Edges Labs LLC ("Edges Labs") and the Client, and is incorporated therein by reference. Capitalized terms not defined in this Agreement have the meaning given to them in the TOS.
1. DEFINITIONS
Business and Service Provider: have the meaning given in the CCPA, to the extent applicable.
Data Controller, Data Processor, Data Security Breach, Data Subject, Personal Data, and Processing: have the meaning given in the GDPR.
Data Protection Laws and Regulations: has the meaning given in the TOS, and includes the GDPR and the CCPA/CPRA, as applicable.
Sub-Processor: means any Data Processor appointed by Edges Labs to process Personal Data on its behalf.
Supervisory Authority: has the meaning given in the GDPR and means the competent data protection authority with jurisdiction over the Processing described in this Agreement.
2. ROLE OF THE PARTIES AND PURPOSE OF THE PROCESSING
2.1. Client is the Data Controller (or, to the extent applicable, a "Business" under the CCPA) and Edges Labs is the Data Processor (or "Service Provider" under the CCPA) with respect to the Processing described in this Agreement and Appendix 1.
2.2. Edges Labs processes Personal Data on behalf of Client solely to provide Client with the Services ordered under the TOS.
3. OBLIGATIONS OF DATA PROCESSOR
3.1 The subject-matter and duration of the Processing performed by Edges Labs under this Agreement, the nature and purpose of the Processing, the type of Personal Data, and the categories of Data Subjects, are as described in this Agreement and in Appendix 1.
3.2 The obligations of Edges Labs under this Agreement are best-efforts obligations. As part of the provision of the Services, Edges Labs commits to:
(i) process Personal Data only on Client's documented instructions, as set out in the TOS and this Agreement, or as otherwise necessary to provide the Services; such instructions may be given by email or through use of the Services; this obligation does not apply where Edges Labs is required otherwise by Data Protection Laws and Regulations, in which case Edges Labs will inform Client of that legal requirement before Processing, unless the law prohibits it for important public interest reasons;
(ii) ensure that its staff members are bound by confidentiality obligations with respect to Personal Data, and that Sub-Processors are bound by confidentiality obligations no less protective than those in the TOS;
(iii) implement and maintain appropriate technical and organizational measures to protect Personal Data against a Data Security Breach, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the Processing;
(iv) provide Client with commercially reasonable assistance to implement and maintain such measures;
(v) notify Client without undue delay, and where feasible no later than seventy-two (72) hours after becoming aware of a Data Security Breach, unless the Data Security Breach is unlikely to result in a risk to the rights and freedoms of natural persons; such notification will be sent by email;
(vi) provide Client with commercially reasonable assistance to mitigate or remediate a Data Security Breach, and to comply with any obligation to notify affected Data Subjects, where required by Data Protection Laws and Regulations;
(vii) provide Client with commercially reasonable assistance in connection with a data protection impact assessment or prior consultation with a Supervisory Authority, where required by Data Protection Laws and Regulations, upon Client's written request;
(viii) provide Client with commercially reasonable assistance (through appropriate technical and organizational measures) to respond to requests from Data Subjects to exercise their rights ("Data Subject Request"); if Edges Labs receives a Data Subject Request directly, it will direct the Data Subject to Client, unless prohibited by law; Client remains responsible for responding to such requests, except where Client is unable to do so, in which case Edges Labs will address the request to the extent required by Data Protection Laws and Regulations;
(ix) comply with the "Return and Destruction of Personal Data" Section of this Agreement upon termination of Client's access to the Services; and
(x) make available to Client the information necessary to demonstrate compliance with this Agreement, in accordance with the "Audit" Section below.
3.3 Edges Labs has no obligation to assess Client Data in order to determine whether it is subject to any specific legal requirement. Edges Labs's notification of, or response to, a Data Security Breach will not be construed as an acknowledgment of fault or liability.
3.4 Client is solely responsible for its use of the Services and for any copies of Client Data it stores outside Edges Labs's or its Sub-Processors' systems, including securing its own credentials, systems, and devices, and backing up Client Data as appropriate.
3.5 Edges Labs will immediately inform Client if, in its opinion, an instruction from Client infringes Data Protection Laws and Regulations, and may refuse to perform any Processing it believes would violate such laws.
4. USE OF SUB-PROCESSORS
4.1 Client provides Edges Labs with a prior, general authorization to appoint Sub-Processors to assist in providing the Services and Processing Personal Data, subject to the terms of this Section.
4.2 Edges Labs will ensure that its Sub-Processors are bound by obligations at least equivalent to those set out in this Agreement, and remains liable to Client for the acts and omissions of its Sub-Processors.
4.3 Edges Labs maintains a current list of Sub-Processors in Appendix 2 to this Agreement. Edges Labs will update this list at least thirty (30) days before a new Sub-Processor begins Processing Personal Data.
4.4 If Client objects to a newly appointed Sub-Processor, Client may terminate the TOS and this Agreement in accordance with the "How Do the Services End?" Section of the TOS.
4.5 Client expressly authorizes Edges Labs to transfer Personal Data outside the European Economic Area in connection with the use of Sub-Processors, subject to appropriate transfer safeguards as described in Section 9 below.
4.6 Providers of Third-Party Services (as defined in the TOS) are not Sub-Processors. Client remains solely responsible for its use of Third-Party Services.
5. AUDIT
5.1 "Auditor" means Client or a third-party auditor mandated by Client to conduct an audit or inspection under this Section.
5.2 Edges Labs will make available to the Auditor the information reasonably necessary to demonstrate compliance with this Agreement, provided that:
(i) Client ensures the Auditor is bound by confidentiality obligations at least equivalent to those in the TOS;
(ii) the Auditor is not a competitor of Edges Labs;
(iii) Client gives Edges Labs at least thirty (30) days' prior written notice, and the Parties mutually agree in writing on the scope, timing, and duration of the audit;
(iv) the audit does not disrupt Edges Labs's operations, and Client indemnifies Edges Labs for any damage resulting from the audit;
(v) the audit is limited to Edges Labs's own premises and systems (not those of its Sub-Processors), is conducted during regular business hours, and only by Auditor personnel who provide reasonable evidence of identity and authority; and
(vi) the audit is conducted reasonably and in good faith.
5.3 All costs of the audit are borne by Client. Any assistance requested from Edges Labs under this Section beyond two (2) hours will be billed at Edges Labs's then-current hourly rate (currently $200 USD/hour).
6. OBLIGATIONS OF DATA CONTROLLER
Client agrees that:
(i) Client is solely responsible for the accuracy of Personal Data and the lawfulness of the means by which it is acquired, and for providing Edges Labs with instructions that comply with this Agreement and Data Protection Laws and Regulations;
(ii) Client will document in writing any additional Processing instructions given to Edges Labs;
(iii) Client guarantees that its Processing instructions comply with Data Protection Laws and Regulations, including that Data Subjects have been informed of the Processing and, where required, have given their consent;
(iv) Client will not submit any special category of Personal Data (within the meaning of Article 9 GDPR) to the Services unless expressly agreed in writing with Edges Labs.
7. RETURN AND DESTRUCTION OF PERSONAL DATA
During the Subscription Term, Edges Labs erases Client Data in the ordinary course in accordance with Section 3.6 of the TOS (i.e., three (3) months after the date of extraction).
Upon termination of Client's access to and use of the Services, Client may export any remaining Client Data, at its own expense, for up to thirty (30) days following such termination, in accordance with the capabilities of the Services. Following that period, Edges Labs will delete any remaining Client Data in accordance with its deletion policies. Client acknowledges that Client Data will no longer be accessible after the expiry of that thirty (30) day period.
8. DURATION
This Agreement remains in force for as long as Edges Labs processes Personal Data on behalf of Client under the TOS.
9. INTERNATIONAL DATA TRANSFERS
To the extent the Processing of Personal Data under this Agreement involves a transfer of Personal Data from the European Economic Area, the United Kingdom, or Switzerland to Edges Labs (whether by remote access, storage, or otherwise, and regardless of the physical location of the underlying hosting infrastructure), the Parties agree that such transfer is governed by the Standard Contractual Clauses adopted by the European Commission (Module Two: Transfer Controller to Processor, Implementing Decision (EU) 2021/914), which are incorporated into this Agreement by reference, with Client as "data exporter" and Edges Labs as "data importer."
The Annexes to the Standard Contractual Clauses are set out in Appendix 3 to this Agreement. In the event of a conflict between this Agreement and the Standard Contractual Clauses, the Standard Contractual Clauses will prevail with respect to the international transfer of Personal Data.
10. GOVERNING LAW AND DISPUTES
Any dispute arising from this Agreement will be resolved in accordance with the Dispute Resolution and Venue provision under the Final Clauses of the TOS.
11. LIMITATION OF LIABILITY
The liability of each Party under this Agreement is subject to the "What Is the Responsibility of Each Party?" Section of the TOS.
APPENDIX 1 TO THE DPA — DETAILS OF PROCESSING
1.1 Duration of Processing
Personal Data is processed for the duration of the Subscription Term, as provided in Section 7.1 of the TOS and this Agreement.
1.2 Subject-Matter of Processing
Edges Labs processes Personal Data constituting Client Data, as defined in the TOS.
1.3 Purpose of Processing
The purpose of the Processing is to provide the Services under the TOS, namely enabling Client to access, extract, enrich, and automate actions on LinkedIn-related data through the Platform.
1.4 Categories of Data Subjects
Depending on Client's use of the Services, Data Subjects may include: (a) Client's own personnel and End Users authorized to use the Services; and (b) individuals whose data is made available on Third-Party Services (in particular LinkedIn profiles, company pages, and related public or semi-public content) and which Client extracts, enriches, or interacts with through the Services (e.g., LinkedIn members, business contacts, and company representatives).
1.5 Categories of Personal Data
Depending on Client's use of the Services, Personal Data may include: name, professional title, employer/company, LinkedIn profile URL and identifiers, professional experience and skills, location, publicly available contact details, and engagement or activity data (such as posts, reactions, connections, and similar signals) available through the Third-Party Service and extracted via the Services; as well as, with respect to Client's own personnel, first and last name, business email address, and account activity data.
1.6 Contact Details
For any question regarding Client Data in connection with this Agreement, Client may contact Edges Labs at gdpr@edges.run.
APPENDIX 2 TO THE DPA — SUB-PROCESSORS LIST
Edges Labs' current Sub-Processors are:
- Google LLC (Google Cloud Platform) — infrastructure hosting, in the European Union (Belgium, region europe-west1).
- Twilio Inc. (Segment) — product and website analytics.
- Intercom Inc. — customer support and ticketing.
- Stripe, Inc. — payment processing.
Additional Sub-Processors, if any, are available upon written request to gdpr@edges.run.
APPENDIX 3 TO THE DPA — INTERNATIONAL TRANSFER MECHANISM
The Standard Contractual Clauses referenced in Section 9 above (Module Two: Transfer Controller to Processor, as adopted by European Commission Implementing Decision (EU) 2021/914) are incorporated into this Agreement by reference in their entirety, completed as follows:
Data exporter: Client, as identified in the Client Account or Sales Quote.
Data importer: Edges Labs LLC, 3500 South DuPont Highway, Dover, DE 19901, United States — contact: gdpr@edges.run.
Description of transfer: as set out in Appendix 1 to this Agreement (categories of data subjects, categories of personal data, purpose, and duration).
Competent supervisory authority (Clause 13): the supervisory authority of the EU/EEA member state in which the data exporter is established, or, where the data exporter is not established in the EU/EEA, the supervisory authority of the member state in which its EU representative is established or, absent a representative, the member state where the relevant Data Subjects are predominantly located.
Sub-processing (Clause 9): general written authorization, as set out in the "Use of Sub-Processors" Section of this Agreement.
The full text of the Standard Contractual Clauses is available on the European Commission's website and is deemed incorporated herein; a signed copy will be provided upon written request to gdpr@edges.run.