Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms & Conditions between LinkedMinds (“Processor”) and the customer (“Controller”). It applies where the Controller uses the Service to process personal data to which the GDPR, the UK GDPR, or India’s Digital Personal Data Protection Act applies.

For contact data and outreach content the Controller uploads, imports, captures or otherwise processes through the Service, the Controller is the controller and LinkedMinds is the processor. For account and billing data about the Controller itself, LinkedMinds is the controller and its Privacy Policy applies.

It takes effect automatically when the Controller accepts the Terms. No signature is required. A counter-signed copy is available on request from support@linkedminds.in.

The Controller warrants that it will:

• have a valid lawful basis for every processing operation it instructs;
• provide any privacy notice required of it, including notice under Article 14 of the GDPR where personal data is obtained from a source other than the data subject - which includes profile data captured through the Service;
• not instruct processing that would put LinkedMinds in breach of applicable law or of a third-party platform’s terms; and
• not submit special-category data as defined in Article 9 of the GDPR.

LinkedMinds will:

• process personal data only on the Controller’s documented instructions, which the Terms and normal use of the Service constitute, except where required by law - in which case it will inform the Controller unless legally prohibited;
• ensure personnel authorised to process the data are bound by confidentiality;
• implement the technical and organisational measures described in Section 5;
• not sell personal data, use it for advertising, or use it to train generalised artificial-intelligence models; and
• make available the information reasonably necessary to demonstrate compliance with Article 28.

• Encryption in transit (TLS) and encryption at rest for credentials and session data;
• Row-level security isolating each customer’s data within shared databases;
• Role-based access control and least-privilege service credentials;
• Audit logging of automation actions taken on a customer’s behalf;
• Content moderation and rate limiting to reduce misuse; and
• Regular dependency and configuration review.

The Controller gives general written authorisation for LinkedMinds to engage sub-processors. The current list is published at linkedminds.in/sub-processors. LinkedMinds imposes data-protection obligations on each sub-processor no less protective than this DPA and remains liable for their performance. Customers may request advance notice of additions by email.

Taking into account the nature of the processing, LinkedMinds will assist the Controller by appropriate technical and organisational measures in fulfilling its obligation to respond to data subject requests, and will assist with data protection impact assessments and prior consultations where required.

If LinkedMinds becomes aware of a personal data breach affecting the Controller’s data, it will notify the Controller without undue delay and provide the information reasonably available to it to support the Controller’s own notification obligations.

The Controller may delete data at any time through the Service. Deleting an account schedules erasure of the Controller’s personal and operational data after a 30-day grace period, after which it is permanently erased.

Two exceptions apply. First, financial records such as invoices are retained where tax law requires it, as permitted by Article 17(3)(b) of the GDPR. Second, LinkedMinds maintains a shared directory of professional profile records that is not specific to any one customer; removing a customer account detaches that customer’s references to those records but does not delete the records themselves. A data subject may request erasure from that directory by contacting support@linkedminds.in.

LinkedMinds and its sub-processors may process personal data outside the country in which the Controller is established. Where such a transfer requires a safeguard under applicable law, the parties rely on the European Commission’s Standard Contractual Clauses, which are incorporated into this DPA by reference, together with any supplementary measures reasonably necessary.

On reasonable written request, and no more than once in any twelve-month period unless required by a supervisory authority, LinkedMinds will make available information necessary to demonstrate compliance with this DPA. Any on-site audit will be at the Controller’s expense, subject to reasonable notice, confidentiality undertakings, and conduct that does not disrupt the Service or compromise other customers’ data.

Each party’s liability under this DPA is subject to the limitations and exclusions of liability in the Terms. In the event of a conflict between this DPA and the Terms concerning the processing of personal data, this DPA prevails.

Data protection enquiries: support@linkedminds.in.