DPA

Last updated: August 11, 2026

This DPA applies to all customers who accept our Terms of Service. No separate signature is required. A copy pre-signed on behalf of Dedupely is available for download at the top of this page.

This Data Processing Addendum ("DPA") forms part of the Terms of Service between the Customer and Dedupely Software, Inc. ("Dedupely"), under which Customer accesses the Service. It records the parties' agreement on the processing of personal data.

If the Customer entity entering into this DPA has executed an order form, statement of work or other written agreement with Dedupely (an "Ordering Document") but is not itself a party to the Terms, this DPA is an addendum to that Ordering Document and to applicable renewals.

1. Definitions

"CCPA" means the California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 et seq., as amended by the California Privacy Rights Act, and its implementing regulations.

"Customer Personal Data" means personal data contained in the records Customer syncs with the Service for deduplication.

"Data Protection Legislation" means the General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR"); the UK GDPR and the Data Protection Act 2018; the Swiss Federal Act on Data Protection of 25 September 2020; the Personal Information Protection and Electronic Documents Act (Canada); and any other applicable law relating to the processing of personal data and privacy, in each case as amended, superseded or replaced from time to time and to the extent applicable to the processing of Customer Personal Data.

"Service" means dedupe.ly and the Dedupely application at app.dedupe.ly.

"Standard Contractual Clauses" or "SCCs" means the clauses annexed to European Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor).

"UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.

"Controller", "processor", "data subject", "personal data", "processing", and "appropriate technical and organisational measures" have the meanings given in Data Protection Legislation. Other capitalised terms have the meanings given in the Terms.

2. Roles

Customer is the controller and Dedupely is the processor in relation to Customer Personal Data.

This DPA does not apply to personal data for which Dedupely is the controller, including data about Customer's account holders and users, which is covered by our Privacy Policy.

The subject matter of the processing is the Service ordered by Customer. Processing continues for the term of Customer's ordering of the Service and for the retention period set out in clause 3(9). Further details are set out in Annex 1.

3. Dedupely's obligations

In respect of Customer Personal Data, Dedupely:

• shall process Customer Personal Data only in accordance with Customer's documented instructions, which include the configuration Customer establishes in its account and the terms of this DPA and the Terms. Customer instructs Dedupely to process Customer Personal Data to provide, maintain, support and improve the Service. If Dedupely is required to process Customer Personal Data for another purpose under applicable law, it will inform Customer before doing so unless that law prohibits such notice on important grounds of public interest;
• shall notify Customer without undue delay if, in Dedupely's opinion, an instruction infringes Data Protection Legislation;
• shall implement and maintain the technical and organisational measures set out in Annex 2, designed to protect Customer Personal Data against unauthorised or unlawful processing and against accidental loss, destruction, damage, theft, alteration or disclosure, appropriate to the risk and to the nature of the data protected;
• may engage subprocessors to provide limited services on its behalf, subject to this clause. Subprocessors may process Customer Personal Data only to deliver the services Dedupely has retained them to provide and are prohibited from using it for any other purpose. Dedupely remains responsible for its subprocessors' compliance with this DPA and enters into written agreements with them on terms no less protective than those set out here. A current list is maintained at dedupe.ly/legal/sub-processors. Dedupely will notify Customer at the email addresses of the account's administrators at least thirty (30) days before a new subprocessor is permitted to process Customer Personal Data in production. Customer may object within that period on reasonable and documented grounds relating to that subprocessor's non-compliance with Data Protection Legislation. If Dedupely cannot resolve a legitimate objection, Customer may terminate the Terms by written notice;
• shall ensure that all personnel authorised to access Customer Personal Data are granted access on a need-to-know basis, are informed of its confidential nature, and are bound by obligations of confidentiality;
• shall assist Customer, insofar as possible and taking into account the nature of the processing, in responding to requests from data subjects exercising their rights. Where an individual contacts Dedupely directly regarding Customer Personal Data, Dedupely will not respond substantively — other than to acknowledge receipt, seek information to identify the individual, or direct them to Customer as controller — and will forward the request to Customer without undue delay;
• shall take reasonable steps to assist Customer in meeting its obligations under Articles 32 to 36 GDPR, including assistance with data protection impact assessments and prior consultation obligations where reasonably required, taking into account the nature of the processing and the information available to Dedupely. Where Customer requests assistance that goes beyond Dedupely's obligations under Data Protection Legislation or this DPA, Dedupely may charge a reasonable fee;
• shall inform Customer of any request received from a governmental authority or law enforcement body requiring disclosure of Customer Personal Data, unless prohibited from doing so by applicable law. Where possible, Dedupely will direct the requesting authority to seek the data from Customer directly, and will use commercially reasonable efforts to challenge any unlawful or overbroad request before disclosure where legally permitted;
• shall delete Customer accounts, together with all Customer Personal Data including CRM and CSV data and associated merge history, no later than twenty-four (24) months after the account ceases to have an active subscription or trial. Dedupely shall send notice to the email address on the account at least fourteen (14) days prior to such deletion. In any event, at Customer's choice, Dedupely shall delete or return such data within thirty (30) days of Customer's written request. Customer Personal Data will be returned in a commercially reasonable, commonly used electronic format. Data deleted from production systems is removed from backups within seven (7) days. Dedupely may retain a copy only to the extent required by applicable law;
• shall, on request, provide Customer with its ISO 27001, ISO 27017 and ISO 27018 certificates, a summary of its most recent penetration test, and written responses to reasonable security questionnaires, in order to demonstrate compliance with this DPA. Where this is insufficient, Dedupely shall allow Customer or an independent inspection body bound by confidentiality to conduct an audit no more than once per year, consisting of written information provided by Dedupely and interviews with Dedupely's IT personnel. All reports, documentation and questionnaire responses provided are Dedupely's confidential information. Audits will ordinarily be satisfied through the documentation described above. Where an on-site inspection is required under applicable law, Customer shall give at least sixty (60) days' advance written notice, the inspection shall be limited to processing facilities directly controlled by Dedupely, and the parties will agree reasonable scope, timing and confidentiality terms in advance. Dedupely may charge a reasonable fee for time spent on audits and inspections;
• shall, on becoming aware of any accidental, unauthorised or unlawful destruction, loss, alteration, disclosure of, or access to Customer Personal Data (an "Incident"), notify Customer without undue delay, and in any event within forty-eight (48) hours where the Incident affects personal data subject to the GDPR or UK GDPR. An Incident does not include unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, including unsuccessful login attempts, pings, port scans, and denial-of-service or other network attacks on firewalls or networked systems. For this purpose, Dedupely becomes aware of an Incident when it is confirmed as such under Dedupely's incident response process. The notification shall describe the nature of the Incident, the categories and approximate volume of data affected, the likely consequences, and the measures taken or proposed. Dedupely shall provide periodic updates and shall take action to investigate the Incident and mitigate its effects;
• shall not transfer Customer Personal Data to a recipient outside the country of processing except where the recipient is bound by appropriate safeguards under Data Protection Legislation;
• shall not send Customer Personal Data to artificial intelligence services, and shall not use it to train or develop artificial intelligence or machine learning models.

4. Customer's obligations

Customer shall:

• provide only lawful instructions to Dedupely;
• comply with its obligations under Data Protection Legislation, including in respect of data subject rights, data security and confidentiality, and ensure that it has an appropriate legal basis for the processing described in this DPA;
• provide all necessary notices to, and obtain all necessary rights, permissions and consents from, data subjects to enable Dedupely to lawfully process the Customer Personal Data it syncs with the Service. Customer is solely responsible for the content of the notices it provides; and
• be solely responsible for the accuracy, quality and legality of the Customer Personal Data and the means by which it was acquired.

5. CCPA

To the extent the CCPA applies, Dedupely acts as a service provider. Dedupely shall not: (a) sell or share Customer Personal Data as those terms are defined under the CCPA; (b) retain, use or disclose Customer Personal Data outside of its direct business relationship with Customer, other than to provide the Service and as required to comply with applicable law; or (c) combine Customer Personal Data with personal information received from or on behalf of any other party, or collected from Dedupely's own interactions with an individual. Dedupely certifies that it understands and will comply with these restrictions, and will inform Customer if it determines that it can no longer meet its obligations under the CCPA.

6. International transfers

Dedupely processes personal data in the United States. Where Customer transfers personal data subject to the GDPR, UK GDPR or Swiss data protection law to Dedupely, the SCCs (Module Two) apply and are incorporated into this DPA by reference, with:

• Clause 7 (docking clause) not applying;
• Clause 9, Option 2 (general written authorisation) applying, with the notice period set out in clause 3(4) above;
• Clause 11, the optional independent dispute resolution provision, not applying;
• Clause 17, Option 1, with the law of Ireland governing;
• Clause 18(b), the courts of Ireland;
• Annex I.A and I.B completed as set out in Annex 1 to this DPA;
• Annex II completed as set out in Annex 2 to this DPA.

Where personal data is subject to the UK GDPR, the UK Addendum applies to the SCCs as completed above. Where personal data is subject to Swiss law, references to the GDPR are read as references to the Swiss Federal Act on Data Protection and the competent authority is the Swiss Federal Data Protection and Information Commissioner.

By accepting the Terms, Customer and Dedupely are deemed to have signed the SCCs and the UK Addendum.

7. Liability

Dedupely shall not be liable for any claim brought by a data subject arising from or related to Dedupely's processing of Customer Personal Data, to the extent Dedupely was acting in accordance with Customer's instructions.

8. Conflict

Where Dedupely and Customer have entered into a separately negotiated data processing agreement, that agreement prevails to the extent of any conflict with this DPA. The Standard Contractual Clauses incorporated under section 6 continue to apply unless the negotiated agreement provides its own transfer mechanism. Otherwise, to the extent of any conflict between this DPA and the Terms regarding the processing of personal data, this DPA prevails. To the extent of any conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses prevail.

9. Changes to this DPA

We may update this DPA from time to time. Changes take effect when we post the revised DPA here, or when we give notice as required by law, whichever is later. If we make material changes, we'll notify you by email or with a notice on our website.

Annex 1 — Details of the processing

Parties. Data exporter: Customer, acting as controller. Data importer: Dedupely Software, Inc., 11871 Horseshoe Way #1103, Richmond, BC V7A 5H5, Canada, acting as processor. Contact: compliance@dedupe.ly.

Categories of data subjects. The prospects, customers, end users and other individuals whose details appear in the records Customer chooses to sync with the Service.

Categories of personal data. Customer determines the scope by selecting which objects to sync. This may include contacts, companies, deals, tickets and custom objects. Dedupely processes the full record for each selected object, including native and custom fields, record identifiers and metadata. In practice this commonly includes names, email addresses, phone numbers, postal addresses, social profile URLs, city, region and country, and creation and modification timestamps.

Nature and purpose of processing. Identification of duplicate records, presentation of matches for Customer's review, application of merges Customer approves or configures, and providing, maintaining, supporting and improving the Service.

Sources. Customer Personal Data is received from Customer's CRM records, through integrations with CRM, and through CSV files uploaded by Customer.

Frequency of transfer. Continuous, for the duration of Customer's use of the Service.

Location of processing. United States — Amazon Web Services (North Virginia region) and Google Cloud.

Duration. For as long as Customer's account is active, and thereafter as set out in clause 3(9).

Subprocessors. As listed at dedupe.ly/legal/sub-processors.

Competent supervisory authority. Determined by Customer's place of establishment or, where Customer is not established in the EEA, by its Article 27 representative.

Annex 2 — Technical and organisational measures

Certification. Dedupely maintains certification against ISO/IEC 27001:2022, ISO/IEC 27017 (cloud security) and ISO/IEC 27018 (protection of personal data in the cloud). Certificates are available on request.

Encryption. Customer Personal Data is encrypted in transit and at rest.

Access control. Access to Customer Personal Data is limited to authorised personnel who require it to operate the Service and support Customer. Access is granted on a role basis and requires authentication. Passwords are stored encrypted and hashed.

Authentication. The Service supports two-factor authentication, session timeouts, federated sign-in, and IP allowlisting. Customer controls user roles and permissions within its own account.

Tenant separation. Customer Personal Data is logically segregated so that each customer's records are accessible only within that customer's account. Internal services operate on a least-privilege basis, and production is separated from development and test environments.

Integration security. Connections to Customer's CRM use OAuth when available. OAuth tokens are rotated on a continuous basis, and permissions are scoped to those required to deliver the Service. When CRM doesn’t use OAuth, Customer connects using their private API keys and are responsible for their rotation.

Logging. Dedupely maintains activity logs recording merges and user actions.

Backups. Encrypted infrastructure backups are maintained by a subprocessor and retained for seven (7) days.

Business continuity. Dedupely maintains documented business continuity and disaster recovery procedures, periodically tests recovery capabilities, and maintains backup processes appropriate to the risks presented.

Physical security. Production infrastructure is hosted with Amazon Web Services and Google Cloud, which are responsible for physical access controls at their data centres.

Security testing. Independent penetration testing and security scanning are performed against a staging environment that mirrors production. Testing providers do not have access to production Customer Personal Data.

Incident response. Dedupely maintains a documented incident response plan aligned to its ISO certifications, covering detection and severity classification, containment, investigation and root cause analysis, notification, remediation, post-incident review, and logging for audit purposes.

Personnel. Personnel with access to Customer Personal Data are bound by confidentiality obligations and receive regular data protection and security training.