OutreachConvert

Last updated 2026-09-06

Data Processing Agreement

This agreement applies where Onarvo Group processes personal data on your behalf, which is the case for all data about your connections. It forms part of the Terms of Service and applies automatically. It has not yet been reviewed by a solicitor, so treat it as a statement of how we operate rather than a finished contract.

Roles

You are the controller. We are the processor. We process personal data only on your documented instructions, which for these purposes means your use of the product's features.

Subject matter and duration

  • Subject matter: providing signal-driven outreach software.
  • Duration: for as long as your account is active, plus the retention periods in the Privacy Policy.
  • Nature and purpose: monitoring connected accounts for events, generating drafts, sending approved messages, and recording replies.
  • Categories of data subject: your professional contacts, principally your first-degree LinkedIn connections.
  • Categories of personal data: name, professional headline, employer, location, profile identifiers, email address, phone number, public post content and message content.
  • Special category data: none is requested or required. Do not put special category data into message content.

Sub-processors

We will give notice before adding a sub-processor, and you may object. If you object and we cannot offer an alternative, you may terminate.

  • Unipile SAS, France, channel gateway for connected accounts.
  • Anthropic PBC, United States, generation of message drafts.
  • Prisma Data Inc, database hosting, EU region.
  • Vercel Inc, United States, application hosting.

Security measures

  • Encryption in transit for all connections, and encryption at rest for the database.
  • Credentials for connected accounts are held by the channel gateway, not by us, so we never store a LinkedIn password.
  • Access to production data is limited to those who need it.
  • Every automated action is recorded in an audit log.
  • Secrets are held in the hosting platform's encrypted environment store and are not committed to source control.

Your rights as controller

  • We assist with data subject requests, and pass on any that reach us directly.
  • We notify you without undue delay if we become aware of a personal data breach affecting your data.
  • We make available the information needed to demonstrate compliance, and allow audits on reasonable notice.
  • On termination we delete your data, subject to the retention periods in the Privacy Policy and to suppression records, which are kept so that opt-outs continue to be honoured.

International transfers

Where a sub-processor is outside the UK, transfers rely on the UK addendum to the EU Standard Contractual Clauses or another approved mechanism.