Data Processing Agreement

This agreement forms part of our Terms of Service and applies whenever Striker processes personal data on your behalf. You are the controller of that data and Striker is your processor. It meets the requirements of Article 28 of the UK GDPR and, where it applies, the EU GDPR.

• Subject matter and purpose: researching companies, identifying contacts, drafting, sending and tracking outreach, coaching deals and syncing to tools you connect, as you instruct through Striker.
• Duration: while your account is open, and until deletion under section 9.
• Data subjects: your prospects, their colleagues and contacts, and members of your team who use Striker.
• Personal data: names, job titles, employers, business email addresses, sending and reply history, and notes you or Striker add about accounts and deals.
• Special category data: none. You must not put special category or criminal offence data into Striker.

We process the data only on your documented instructions, which are given by these terms and by how you use Striker, unless the law requires otherwise; if it does, we will tell you first unless the law forbids that. We will tell you if we believe an instruction breaks data protection law.

You are responsible for having a lawful basis for the data you process with Striker, for giving prospects the information the law requires, and for complying with PECR and other marketing rules when you send.

Everyone at Striker who can access the data is bound by a duty of confidentiality.

We keep appropriate technical and organisational measures in place, including:

• TLS encryption for all connections, and encryption at rest for the database;
• AES-256-GCM encryption for integration credentials;
• passwordless sign-in and server-side checks that each request only reaches its own account's data;
• rate limits, suppression of opted-out addresses and least-privilege access to production systems.

You give general authorisation for us to use the sub-processors listed on our sub-processors page. We bind each of them to data protection terms that offer the same level of protection as this agreement, and we remain responsible for them. We will update that page at least 14 days before adding or replacing a sub-processor; if you object on reasonable data protection grounds and we cannot address the concern, you may close your account.

Where data is transferred outside the UK, we make sure a safeguard recognised under UK GDPR is in place, such as the UK Extension to the EU-US Data Privacy Framework or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

We will help you respond to requests from individuals exercising their rights, including through the export and deletion tools in Striker, and pass on to you any request we receive directly.

We will notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information you need to meet your own reporting duties. We will also help you with data protection impact assessments and consultations with regulators where they relate to Striker.

You can export your data at any time from Account. When you delete your account, we erase the personal data we process for you from our live systems, unless the law requires us to keep it. Opted-out email addresses stay on the suppression list so they are never contacted again.

We will make available the information reasonably needed to show we meet this agreement, and allow audits by you or an auditor you appoint, on reasonable notice, at most once a year unless a regulator requires more, and subject to confidentiality.

Striker is operated from the United Kingdom. Company registration is in progress; the registered company name, number and address will be published here as soon as it is complete. Data protection questions: hello@getstriker.io.