Data Processing Addendum
What we do with the personal data you put through Prospen, and what we promise about it. Part of the Terms, so it already applies to you.
1. Scope and how it applies
This addendum is part of the Terms of Service. It applies automatically to every customer that is a controller of personal data processed through Prospen, from the day the account is opened. Nothing needs to be signed. If your procurement process needs a countersigned copy, email hello@tasken.ai and we will send one with the same wording.
Where this addendum and the Terms disagree on data protection, this addendum wins. Where the Standard Contractual Clauses in section 6 apply and disagree with this addendum, the Clauses win.
Definitions.“GDPR” is Regulation (EU) 2016/679. “UK GDPR” is the GDPR as it forms part of UK law, read with the Data Protection Act 2018. “Swiss FADP” is the Swiss Federal Act on Data Protection of 25 September 2020. “Data protection law” means these and any other privacy law that applies to the processing. “Personal data”, “controller”, “processor” and “processing” mean what the GDPR says they mean, or the nearest equivalent term in the law that applies. “Customer Data” is the personal data we process on your behalf. A “subprocessor” is a third party we engage that processes Customer Data.
2. Roles
For Customer Data, you are the controller (or a processor acting for your own client, as an agency often is) and we are your processor. Customer Data covers the brand knowledge you add, the people you contact through Prospen, your connected mailboxes and inbox, and any candidate you select from discovery results.
We are an independent controller for a smaller set of data that we need to run the business: account details, billing records, security logs, and the dataset of public business information we compile from public sources before any customer selects a candidate from it. The Privacy Policy covers that data. Once you select a candidate, the copy in your account is Customer Data.
Each party complies with the obligations data protection law places on it in its role.
3. Details of the processing
| Subject matter | Providing Prospen: finding, qualifying and contacting affiliates, creators, publishers and other partners for your business. |
|---|---|
| Duration | While you have an account, plus the export and deletion period in section 4. |
| Nature and purpose | Storing, searching and indexing your documents; analysing them and candidate evidence with AI models; finding and verifying contact details when you ask; sending the email you approve and receiving replies; transcribing voice input. All of it only to provide the service to you. |
| Data subjects | Your staff who use Prospen; outreach recipients such as creators, publishers, site owners and their staff; people named in documents you upload. |
| Categories of data | Contact details (names, email addresses, social handles); public profile data (follower and engagement figures, website content); message content (your sequences, AI-written opening lines, sent messages, replies, direct messages sent through the Chrome extension); documents you upload and Google Drive files you pick; conversations with Prospen Agent; usage data (approvals, rejections, delivery events). |
| Special categories | None intended. Prospen is not designed for health, biometric or other special-category data, or for data about criminal offences. |
4. Our obligations as processor
Instructions. We process Customer Data only on your documented instructions, including on transfers. Your instructions are the Terms, this addendum, the settings you choose in the app, and the actions you, your team or the AI tools you connect to Prospen (such as the MCP server or API keys) take in your account. If the law requires us to process Customer Data in another way, we will tell you first unless the law forbids it. We do not use Customer Data to train our own models.
If we think an instruction breaks data protection law, we will tell you and may pause that processing until it is resolved.
Confidentiality. Only the staff and contractors who need access to operate and support Prospen get it, and each is bound by a duty of confidentiality.
Security. The measures we take under GDPR Article 32 are:
- TLS for data in transit and encryption at rest in our database and file storage.
- Row-level access control in the database, so each organisation can read only its own data.
- OAuth tokens (for example for Google Drive) stored sealed, meaning encrypted, and personal API keys stored only as hashes. We never store mailbox passwords; our email provider holds the mailbox connection.
- Staff access to accounts only through an internal dashboard that records every action.
- No outreach is sent until a person in your team has approved it.
More detail is on the security page. We do not hold SOC 2, ISO 27001 or any other certification and do not claim to.
Helping you. You can export, correct and delete most Customer Data in the app yourself. If a data subject contacts us about Customer Data, we pass the request to you and do not answer it ourselves unless you ask us to. We will also give you the information you reasonably need for data protection impact assessments, consultations with a supervisory authority, and your own security and breach obligations. Reasonable requests cost nothing; if one would take substantial work, we will tell you the cost before starting.
At the end. When your account closes, you can export your data for 30 days. We delete Customer Data within 90 days of closure or of your deletion request, and copies in backups are overwritten as the backups cycle out after that. We keep data beyond this only where a law requires it, and only for that purpose.
Showing compliance. We will make available the information you need to show that we meet Article 28, as described in section 8.
5. Subprocessors
You give us general authorisation to use subprocessors. The current list, with what each does and where, is on the subprocessors page. Requests to AI models go through OpenRouter, which routes them to model providers; the list explains this.
Before we add or replace a subprocessor, we email your account owner at least 30 days ahead. You may object within those 30 days, by email, on reasonable data protection grounds. We will try to find a fix with you. If we cannot, you may end the affected service, and we refund any prepaid fees for the unused period, pro rata.
Each subprocessor works under written data protection terms that bind it to protect Customer Data as data protection law requires. We remain responsible to you for what our subprocessors do with Customer Data.
6. International transfers
We and most of our subprocessors process data in the United States. When Customer Data from the European Economic Area, the UK or Switzerland comes to us, these apply:
- EU. The Standard Contractual Clauses approved by Commission Decision (EU) 2021/914, Module 2 (controller to processor), and Module 3 (processor to processor) where you act for your own client. They are incorporated into this addendum by reference, with you as data exporter and us as data importer. Clause 7 (docking) applies. Under Clause 9 we use the general authorisation and 30 days’ notice in section 5. The optional wording in Clause 11 does not apply. The supervisory authority under Clause 13 is the one competent for you. Clauses 17 and 18: the law and courts of the EU member state where you are established, or Ireland if you are not established in the EU. Annex I is section 3 of this addendum and Annex II is the security list in section 4.
- UK. The International Data Transfer Addendum issued by the UK Information Commissioner, applied to the Clauses above. Its tables are filled in from this addendum.
- Switzerland.The same Clauses, with the Swiss FADP in place of the GDPR, the Federal Data Protection and Information Commissioner as the supervisory authority, and “member state” read to include Switzerland so Swiss data subjects can enforce their rights there.
Where a subprocessor is certified under the EU-US Data Privacy Framework, we may rely on that certification for its part of the processing. ClicksRocket, LLC is not certified under the Data Privacy Framework and does not claim to be.
7. Personal data breaches
If we become aware of a breach affecting Customer Data, we tell you without undue delay and within 72 hours, by email to your account owner. The first notice says what we know at that point: what happened, the kinds of data and roughly how many people are affected, the likely consequences, what we are doing about it, and who to contact. We keep you updated as we learn more. We will not notify your data subjects or a supervisory authority about a breach of Customer Data without speaking to you first, unless the law requires us to.
8. Audits
Once a year, you may send us a written security questionnaire, and we will answer it within 30 days. That is how we expect most customers to check our compliance.
On-site or remote audits happen only where data protection law or a supervisory authority requires one. You pay for it, give us 30 days’ notice, hold it during business hours, and keep what you learn confidential. Audit rights under the Standard Contractual Clauses are exercised this way.
9. Your obligations
- You have a lawful basis for the personal data you bring into Prospen and for the outreach you send through it, and you give any notices the law requires.
- Your instructions to us are accurate and lawful.
- You do not put special-category data into Prospen.
- You set up your never-email list and your approval steps, and you are responsible for what you approve.
- You follow the Acceptable Use Policy.
10. Liability and term
Each party’s liability under this addendum is subject to the limits in the Terms. Those limits do not reduce any right a data subject has under the Standard Contractual Clauses.
This addendum lasts as long as we process Customer Data, which can be longer than the Terms. The deletion, confidentiality and breach notification commitments continue until all Customer Data has been deleted.
11. Contact and changes
Questions, objections and requests go to hello@tasken.ai. A person answers within one business day.
We may update this addendum. A change that reduces the protection it gives you will be emailed to your account owner at least 30 days before it takes effect. Other changes take effect when posted here with a new effective date. No change can reduce the protection of the Standard Contractual Clauses.