Data Processing Agreement

This Data Processing Agreement forms part of the agreement between SalesGamez, 80A Ruskin Ave, London, DA16 3QQ, United Kingdom, as Processor, and the business customer, as Controller, for the SalesGamez service. It applies where SalesGamez processes Customer Personal Data on the Customer’s behalf. Notices under this agreement can be sent to privacy@salesgamez.com.

This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction over any dispute arising from it.

Data Protection Law means the UK GDPR, the Data Protection Act 2018, PECR where relevant, and binding replacement or supplemental UK data protection legislation. Customer Personal Data, process, controller, processor, data subject, personal data breach and supervisory authority have the meanings given by Data Protection Law.

If this Data Processing Agreement conflicts with the Agreement on processing Customer Personal Data, this Data Processing Agreement prevails.

Subject matter: provision, hosting, support and security of the SalesGamez service for customer-entered salesperson, employee and game data.

Duration: for the Agreement term. Where the account owner closes the account in the app, Customer Personal Data is deleted from active systems immediately. Where SalesGamez closes an account for another reason, it is kept for no more than 30 days so that it can be recovered or returned, then deleted. Backups rotate for no more than 90 days after active-system deletion, and billing, invoice and tax records are kept for as long as tax law requires.

Nature and purpose: receiving, recording, organising, storing, retrieving, displaying, transmitting, supporting, securing, deleting and returning Customer Personal Data as needed to provide the service and follow documented instructions.

Data subjects: customer employees, workers, contractors, salespeople, participants and any other individuals the Customer lawfully records. Some may not have a login.

Personal data: names, optional photographs, team, site and game association, sales or activity figures, leaderboard positions and game results, and limited technical identifiers connected with Customer Content.

Special categories and criminal-offence data: not intended or permitted unless the parties first agree written instructions and safeguards.

The Agreement, the Customer’s configuration and use of the service, support requests and written directions from authorised Customer contacts are documented instructions. SalesGamez will process Customer Personal Data only on those instructions, including for international transfers, unless UK law requires otherwise. Where legally permitted, SalesGamez will tell the Customer before processing required by law.

The Customer will comply with Data Protection Law and ensure its instructions are lawful; establish and document a lawful basis; provide privacy information; meet transparency duties; ensure data is adequate, relevant, accurate, limited and retained no longer than necessary; assess workplace fairness, employee-monitoring and optional-photo use; conduct any required DPIA; respond to data subjects and regulators with SalesGamez’s assistance where required; limit access; secure user accounts; choose appropriate public-link settings; and not provide prohibited data.

SalesGamez will process Customer Personal Data only on documented instructions; promptly inform the Customer if, in SalesGamez’s reasonable opinion, an instruction infringes Data Protection Law, unless prohibited from doing so; ensure people authorised to process Customer Personal Data are bound by confidentiality; implement appropriate technical and organisational measures under Article 32, taking account of the state of the art, costs, context and risks; comply with the subprocessor requirements below; taking account of the nature of processing, assist the Customer by appropriate technical and organisational measures to respond to data-subject requests; assist the Customer with security, breach notification, DPIAs and prior consultation obligations, taking account of the nature of processing and information available to SalesGamez; notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data; at the Customer’s choice, delete or return Customer Personal Data after services end and delete existing copies, unless law requires storage; make available information reasonably necessary to demonstrate compliance with Article 28; and allow and contribute to audits and inspections by the Customer or its mandated independent auditor, subject to reasonable confidentiality, security, scope and scheduling controls.

The Customer gives general written authorisation for the subprocessors listed at /subprocessors.

SalesGamez will give at least 30 days’ advance notice before a new or replacement subprocessor begins processing Customer Personal Data, including enough information for the Customer to assess the change. The Customer may object during that period on reasonable data-protection grounds. The parties will try in good faith to resolve the objection. If the objection is reasonable and unresolved, the Customer may terminate the materially affected service without penalty and receive a pro-rata refund for prepaid service not provided.

SalesGamez will impose data-protection obligations on each subprocessor that provide materially the same protection as this Data Processing Agreement, and remains responsible to the Customer for the subprocessor’s performance of those obligations.

SalesGamez will maintain the measures in Annex 1 and review them regularly. Measures may evolve, but SalesGamez will not materially reduce overall protection during the Agreement term.

The Customer is responsible for account configuration, user access, devices, networks, content choices and protecting credentials.

The notice under the Processor obligations clause will be given without undue delay after SalesGamez becomes aware of a personal data breach affecting Customer Personal Data and will, as information becomes available, describe the nature of the breach, affected data and data subjects, likely consequences, measures taken or proposed, and a contact for follow-up.

SalesGamez will investigate, mitigate, preserve reasonable evidence and provide reasonable cooperation. Notice is not an admission of fault. The Customer controls notifications to regulators and data subjects for Customer Personal Data, unless law requires SalesGamez to notify directly.

SalesGamez keeps an internal record of personal data breaches and near misses, including the facts, effects and remedial action taken, so that the Customer can meet its own record-keeping duty. SalesGamez does not commit to a fixed number of hours for notice, because the UK GDPR standard for a processor is without undue delay, and a shorter fixed deadline could not be guaranteed for a business of this size. In practice SalesGamez aims to give first notice within 24 hours of becoming aware, and to follow up with further detail as the investigation develops.

Breach notices and queries can be sent to privacy@salesgamez.com.

If SalesGamez receives a request or complaint relating to Customer Personal Data, it will not respond substantively except on the Customer’s instructions or where law requires, and will direct the person to the Customer where appropriate. SalesGamez will provide reasonable assistance using service functionality and, where necessary, additional support.

Assistance required by Article 28, including the help the Customer needs to answer a data-subject request, is provided at no extra charge. Where a Customer asks for assistance that goes well beyond that, such as repeated bulk extractions or bespoke engineering work, SalesGamez may charge its reasonable costs, but only where it has told the Customer the basis of the charge in writing and the Customer has agreed in advance. No charge will be applied in a way that prevents or delays compliance with Article 28 or with Data Protection Law.

SalesGamez will not make a restricted transfer of Customer Personal Data without a lawful mechanism and the assessments and supplementary measures required by Data Protection Law. The Subprocessor Disclosure identifies the providers used and, on request, SalesGamez will confirm the processing countries and the transfer mechanism relied on for a particular provider.

Where the parties need a UK International Data Transfer Agreement or UK Addendum for transfers between them, the relevant terms are incorporated into this Agreement on request and signed by both parties.

During the subscription, the Customer may use available controls to delete or remove users, salesperson records, photographs, figures and games in active systems. Available controls include player deletion, photo removal, competition deletion, Scorez and Tournamentz deletion, Suspectz guest-photo storage cleanup when Suspectz participants or finished Suspectz games are deleted through the updated controls, account closure, and switching off public sharing for shared links. Competition, Scorez, Tournamentz and Spinz public links check sharing status before loading. Recipient copies, exports, browser caches and short-lived public caches cannot be recalled once already received.

On termination, the Customer may request the return of Customer Personal Data before closure, or during the 30-day period where SalesGamez closes the account. There is no automated export, so a request should be sent to privacy@salesgamez.com and SalesGamez will supply the data in a commonly used electronic format. SalesGamez will then delete or irreversibly anonymise Customer Personal Data from active systems, immediately where the account owner closes the account in the app and otherwise no later than 30 days after closure, unless law requires retention. Deleted data may remain in protected rotating backups for no more than 90 days after active-system deletion. Until backup deletion, restored data will remain protected, will not be used for ordinary business purposes and, if restored, must be deleted again.

SalesGamez will first provide existing information reasonably sufficient to demonstrate compliance with Article 28. That normally consists of a completed security questionnaire, the measures set out in Annex 1, a written description of the data flows and retention periods for the Customer’s site, and the security and compliance documentation published by the hosting, database and payment providers named in the Subprocessor Disclosure. SalesGamez does not hold its own independent audit report such as ISO 27001 or SOC 2.

If that information is insufficient, the Customer may conduct one audit each calendar year, plus additional audits after a material breach or regulator request, on reasonable notice and during normal business hours, without accessing other customers’ data or disrupting the service.

The Customer bears its own audit costs. SalesGamez may charge reasonable pre-agreed costs for extraordinary audit assistance that goes beyond Article 28 cooperation or ordinary evidence provision, unless the audit is required because of SalesGamez’s material breach. Audit requests can be sent to privacy@salesgamez.com.

Liability under this Data Processing Agreement is subject to the Agreement’s lawful limitations, but nothing limits liability that cannot be limited under Data Protection Law. A material uncured breach of this Data Processing Agreement is a material breach of the Agreement.

Technical and organisational measures include separate authorised-user accounts, authenticated access for signed-in app functions, role checks, row-level database policies, CSRF middleware for server functions, input validation on server functions, same-site sign-in redirects, signed and timestamp-checked payment webhooks, webhook deduplication, rate limiting on public board reads, noindex metadata on public link pages, public-link disablement, audit-log use for some administrative actions, hashed device and network identifiers for login-sharing checks, and local self-hosting for the core public fonts.

Access to Customer Personal Data is limited to the people who need it to run and support the service, and is removed when no longer needed. Traffic is encrypted in transit using HTTPS. Encryption at rest, data-centre physical security, redundancy and backups are inherited from the hosting, database and payment providers named in the Subprocessor Disclosure, and evidence available from those providers can be supplied on request. Dependencies are kept up to date, security reports sent to privacy@salesgamez.com are investigated promptly, and incidents affecting Customer Personal Data are notified to the Customer as set out above.

SalesGamez is a small business and does not currently hold an independent security certification such as ISO 27001 or SOC 2. Customers requiring certified assurance should take that into account before entering sensitive information.