Annex 1: Data Processing Agreement (DPA)
This Data Processing Agreement (“DPA”) supplements the Terms of Use of the Opener service (the “Terms”) and governs the processing of personal data under Art. 28 of Regulation (EU) 2016/679 (“GDPR”). It is accepted electronically together with the Terms (Art. 28(9) GDPR).
- Controller: the Customer under the Terms.
- Processor: AMG Ascenta Management Group s.r.o., Company ID (IČO) 07958749, Radlická 663/28, 150 00 Prague 5, registered with the Municipal Court in Prague, Section C, Insert 310525 (“we”).
Terms used in this DPA have the meaning given to them in the GDPR and the Terms.
1. Subject matter, nature and purpose
1.1 We process personal data contained in Customer Data solely to provide the Service to the Customer under the Terms: storage, display, search, processing by AI features (if the Customer turns them on), sending email reminders to Users, backup, security and support.
1.2 Details of the processing are set out in Schedule A.
2. Controller’s instructions
2.1 We process personal data only on documented instructions from the Customer. The instructions are: the Terms, this DPA, the Workspace settings (for example turning on AI, the extension, MCP or collaboration with a call team) and actions taken by Users in the Service.
2.2 If EU or Member State law required us to process personal data beyond the instructions, we will inform the Customer in advance, unless that law prohibits it.
2.3 If we consider that an instruction infringes the GDPR, we will notify the Customer.
2.4 We do not use personal data for our own purposes. In particular, we do not combine it across Workspaces and we do not use it to enrich other customers’ data or to train AI models. Aggregated anonymous statistics under Art. 6.4 of the Terms are not personal data and this DPA does not apply to them.
3. Confidentiality
Persons at our company who have access to personal data are bound by confidentiality or are subject to a statutory duty of confidentiality. They have access only to the extent necessary for operation and support.
4. Security
4.1 We implement the technical and organisational measures under Art. 32 GDPR described in Schedule B.
4.2 We may change the measures provided that the level of protection is not reduced.
5. Subprocessors
5.1 The Customer gives us general authorisation to engage the subprocessors listed in Annex 2 and further subprocessors in accordance with this article.
5.2 We will give notice of any intended addition or replacement of a subprocessor at least 30 days in advance in the application and by email to the Workspace Admin. The Customer may raise a reasoned objection until then. If we do not reach agreement, the Customer may terminate the Agreement without penalty before the change takes effect.
5.3 We enter into a contract with each subprocessor imposing the same data protection obligations as this DPA. We are liable to the Customer for the subprocessor’s performance as for our own.
5.4 In exceptional cases (security, supplier outage) we may replace a subprocessor immediately and will inform the Customer without undue delay.
5.5 Integrations turned on by the Customer (for example AI applications connected via MCP by a User) are not our subprocessors. Transfer of data to them is an instruction of the Customer.
6. Transfers outside the EEA
6.1 We store personal data in the EU (database in Frankfurt, files in storage with EU jurisdiction). Embeddings for semantic search are also computed in Frankfurt.
6.2 Some subprocessors may process data outside the EEA (Annex 2 states where). A transfer takes place only with a safeguard under Chapter V GDPR: an adequacy decision (including the EU-US Data Privacy Framework for certified recipients) or the Commission’s standard contractual clauses (SCC), with supplementary measures where applicable.
7. Assistance to the controller
7.1 Data subject requests: through the Service we provide tools to search, rectify, export and erase data about a contact. If a request reaches us directly, we will forward it to the Customer within 10 business days and will not respond to it on the merits ourselves.
7.2 We assist the Customer in meeting its obligations under Art. 32 to 36 GDPR (security, incidents, impact assessment, prior consultation) to the extent of the information available to us. We may charge for assistance beyond the usual scope subject to prior agreement.
8. Personal data breach
8.1 We will notify the Workspace Admin of a personal data breach affecting Customer Data without undue delay, and no later than 48 hours after becoming aware of it.
8.2 The notification contains what we know: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken, and a contact point. We provide further information on an ongoing basis.
8.3 Notification to the supervisory authority and to data subjects is made by the Customer as the controller, unless we agree otherwise.
9. End of processing
9.1 After the Agreement ends, Customer Data remains in read-only mode for 90 days; the Customer may export it (Art. 12.3 of the Terms). The same applies when a Workspace enters read-only mode for another reason under the Terms.
9.2 After this period expires, we will delete the personal data, including copies held by subprocessors. Backup copies expire in the regular cycle no later than 30 days thereafter. This does not apply to data that we are required by law to retain.
9.3 On request, we will confirm the deletion in writing.
10. Information and audit
10.1 On request, we will provide the information necessary to demonstrate compliance with this DPA (in particular a description of the measures, the list of subprocessors, and the results of security reviews).
10.2 We will allow an audit or on-site inspection upon at least 30 days’ prior notice, no more than once a year (unless it concerns an incident or a request of a supervisory authority), during business hours, subject to the auditor’s confidentiality and at the Customer’s expense.
11. Liability and term
11.1 Liability is governed by the Terms and Art. 82 GDPR.
11.2 This DPA remains in force for the term of the Agreement and thereafter for as long as we process the Customer’s personal data.
Schedule A: Description of processing
| Item | Description |
|---|---|
| Data subjects | the Customer’s contacts (business contacts, candidates, people at companies), the Customer’s Users to the extent of their work with contacts, callers of the Customer’s call team |
| Categories of data | name, form of address, job title and headline, company, LinkedIn profile URL and its identifier, location, work email and phone number, “do not contact” flag and legal basis, history of activities and relationship status, notes, follow-ups, tasks, labels, custom fields, team and personal messages, emails logged via the copy (BCC) address, call and meeting logs, documents (e.g. CVs, profile PDFs) and the career history derived from them, record of callers’ work |
| Special categories | not processed intentionally; may occur in content uploaded by the Customer (e.g. in CVs) |
| Processing operations | storage, organisation, search (including full-text and vector search), display, modification, export, AI processing on instruction, transfer to a call team on instruction, follow-up reminders by email to Users, backup, erasure |
| Duration | for the term of the Agreement and until deletion under Art. 9 |
| Location | EU (Frankfurt, R2 EU); subprocessors as listed in Annex 2 |
Schedule B: Technical and organisational measures
Status as of version 2026-10-25:
- Customer separation: each Workspace is separated in the database by row-level security rules (RLS); the application accesses data using a role without the right to bypass these rules. Privacy of individual relationships within a Workspace is enforced by a single controlled layer that is tested automatically.
- Encryption: transmission only over HTTPS (TLS 1.2 or higher, enforced redirect); data at rest is encrypted by the database and storage provider.
- Access: sign-in via Google or a one-time code sent by email, without passwords; short-lived signed sessions with revocation; rate limiting of attempts; roles and permissions within the Workspace; extension tokens revocable by the User and by the Workspace Admin.
- Application protection: CSRF protection, a strict content security policy (CSP), security headers, parameterised queries, type checking of uploaded files.
- Logging: audit of sign-ins and administrative actions; a record of every action a caller takes on a contact; operational logs without the content of Customer Data.
- Backup and recovery: automatic database backup before every schema change (retained for 30 days), database history at the provider.
- Minimisation: IP addresses are not stored; the extension does not read message text or pages in the background; AI is turned off by default.
- Development: code review, automated tests including Workspace isolation tests before every deployment; regular security audit.
- People: access to the production database is limited to a restricted group of persons; access credentials are kept in a vault.