Data processing agreement
The terms on which we process personal data on your behalf. This forms part of the Terms of Service and applies automatically — you do not need to sign anything.
In plain English
When you use Hellofew to contact people, those people's data is yours, not ours. You decide who gets contacted; we only do what you instruct. This page is the contract that says so, and it is what you hand to a customer's legal team when they ask.1. Roles
You are the controller of the personal data of the people you research and contact through Hellofew. Hellofew is the processor. We process that data only on your documented instructions, which are given by your use of the product and by these terms.
For your own account and billing data we are the controller — that is covered by the Privacy Policy, not this agreement.
2. Subject matter and scope
| Subject matter | Providing the Hellofew outbound service |
| Duration | For as long as your subscription is active, plus the retention periods below |
| Nature and purpose | Identifying prospects, enriching them from public sources, generating message drafts, sending approved messages, and recording what was sent |
| Categories of data | Name, job title, employer, public profile URL and headline, public professional history, message content and replies |
| Categories of data subject | Business contacts your workspace targets, and people who reply to them |
| Special category data | None requested or required. Do not put it into an ICP or a message. |
3. Our obligations
- Process personal data only on your documented instructions, including on transfers.
- Ensure everyone with access is bound by confidentiality. Today that is one person; if that changes, this stays true.
- Apply the security measures in section 6.
- Not engage a new sub-processor without the notice described in section 5.
- Help you respond to data subject requests, and act on ones that reach us directly.
- Help you with security, breach notification and impact assessments, proportionate to what a business of our size can do.
- Delete or return the data when you leave, per section 7.
- Make available what you need to show we are meeting these obligations.
4. Your obligations
- Have a lawful basis for contacting each person. In the EEA and UK that usually means legitimate interest, which requires a documented assessment and a genuinely easy opt-out.
- Provide the privacy notice your own lawful basis requires.
- Do not upload special category data or anything you have no right to process.
- Honour objections and removal requests, and do not work around a suppression.
5. Sub-processors
You give general authorisation for the sub-processors listed on the sub-processors page. We will give at least 30 days' notice by email before adding one that handles personal data, and you may object on reasonable data-protection grounds; if we cannot resolve it, you may cancel and we will refund the unused part of your period. Each sub-processor is bound by obligations no weaker than these.
6. Security measures
- Tenant isolation enforced in the database itself, not only in application code.
- No LinkedIn credentials, two-factor codes or session cookies held by us at any point — those stay with Unipile, and we hold only an opaque identifier.
- Encryption in transit; the database is not reachable from the public internet.
- Credential-shaped fields stripped from logs before they are written.
- An append-only ledger of every action taken on a customer's behalf.
- Encrypted backups, 30-day retention, restores tested.
- Access to production limited to the operator, on named accounts.
7. Retention and deletion
| Data | Kept for |
|---|---|
| Account and workspace records | For as long as the account exists |
| ICP and drafts | For as long as the account exists |
| Prospect records (name, headline, employer, public profile) | While the lead is active, then 12 months |
| Provider payloads fetched from LinkedIn | 30 days |
| Activity ledger (what was sent, when, to whom) | 24 months |
| Warning and error logs | 14 days |
| Resolved incidents | 90 days |
| Aggregate daily counters (no personal data) | Indefinitely |
| Suppression list (do-not-contact) | Indefinitely, by design |
| Backups | 30 days |
On termination we delete your workspace data within 30 days, backups included. The exception is the global suppression list: deleting a do-not-contact record would re-expose someone who asked to be left alone, so we keep the minimum needed to keep honouring it.
8. Data subject requests
If a request reaches us that is really for you, we will pass it on without undue delay and help you answer it. Where the request is to stop being contacted, we act on it ourselves immediately and globally — across every Hellofew customer — because someone who has asked to be left alone should not have to ask each of our customers in turn.
9. Breach notification
We will tell you without undue delay, and in any case within 48 hours of becoming aware, of any breach affecting your data, with what we know, what we are doing, and what we recommend.
10. International transfers
The application and database run in Germany. Transfers to sub-processors outside the EEA rely on Standard Contractual Clauses, noted per vendor on the sub-processors page. Where the EU SCCs apply, they are incorporated into this agreement by reference: Module Two (controller to processor), with you as data exporter and us as data importer.
11. Audit
We will answer reasonable written questions about our processing, once a year, and provide the documentation we have. Given the size of the business, on-site audits are not practical; if your compliance programme requires one, tell us before you subscribe so we can be honest about whether we are a fit.
12. Precedence
Where this agreement and the Terms of Service conflict on personal data, this agreement wins.