Data Processing Agreement

1. Roles

The Customer is the controller (or “business”) of the personal data it submits to Second Look, such as the contents of emails it checks and its vendor contact details (“Customer Personal Data”). Second Look is the processor (or “service provider”) and processes Customer Personal Data only on the Customer's behalf.

2. Scope of processing

• Purpose: to provide the Second Look service: analysing emails for signs of fraud, keeping the check log and vendor list, and related support and security.
• Data subjects: senders and recipients of emails the Customer checks, people named in those emails, the Customer's vendor contacts, and the Customer's users.
• Types of data: names, email addresses, phone numbers, job titles, email headers and message content, and any other personal data that appears in emails the Customer chooses to check.
• Duration: for as long as the Customer uses the service, plus the deletion period in section 8.

3. Our obligations

Second Look will:

• process Customer Personal Data only on the Customer's documented instructions, which are the Terms, this DPA and the Customer's use of the service's settings, unless the law requires otherwise (in which case we will tell the Customer if allowed);
• not sell Customer Personal Data, not use it for our own purposes outside providing the service, and not use it to train AI models;
• ensure anyone authorized to process it is bound by confidentiality;
• apply appropriate technical and organizational security measures (section 5);
• help the Customer respond to data subject requests and meet its obligations on security, breach notification and impact assessments, taking into account the nature of the processing.

4. Sub-processors

The Customer authorizes us to use these sub-processors:

• Render Services, Inc.: hosting of the application and database, in the United States.
• Stripe, Inc.: payment processing (billing data only, not email contents).
• Anthropic, PBC: AI review of email contents, only when the Customer's plan includes AI review and it is switched on.
• Resend: delivery of service emails such as password reset links (users' email addresses only, not email contents).
• Cloudflare, Inc.: domain name service and forwarding of messages sent to our support address (not the emails the Customer checks).

We will hold each sub-processor to data protection terms at least as protective as this DPA, and remain responsible for them. We will give at least 30 days' notice of any new sub-processor by email to the account owner. The Customer may object on reasonable data protection grounds; if we can't resolve the objection, the Customer may cancel and receive a refund of prepaid fees for the remaining period.

5. Security measures

• encryption in transit (HTTPS) for all access to the hosted service;
• logical separation of each customer's data;
• hashed passwords and hashed session tokens; rate limiting of sign-in and checks;
• automatic deletion of stored email text after the Customer's chosen retention period (30 days by default);
• refusal to store bank account numbers;
• no opening of links or attachments contained in checked emails;
• no logging of email contents in application logs.

6. Personal data breaches

We will notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data, with the information the Customer reasonably needs to meet its own obligations.

7. International transfers

Customer Personal Data is processed in the United States. Where the law requires a transfer mechanism (for example, for data from the European Economic Area, Switzerland or the United Kingdom), the parties agree to rely on the applicable Standard Contractual Clauses or another lawful mechanism, which we will provide on request.

8. Deletion

When the Customer's account ends, we will delete Customer Personal Data within 90 days, unless the law requires us to keep it. The Customer can export its check log as a CSV file before then.

9. Audits

On reasonable written request, no more than once a year, we will provide information needed to demonstrate compliance with this DPA, such as a description of our security measures.

10. Liability and order of precedence

Each party's liability under this DPA is subject to the limits in the Terms of Service. If this DPA conflicts with the Terms about personal data, this DPA applies.

11. Contact

Data protection questions: support@secondlookfinance.com.