Data processing agreement
Between the HighLevel agency that installs CRM Health (the "agency") and [legal entity] ("we"). Effective [effective date]. This agreement is part of our terms of service and applies whenever we process personal data for the agency.
Roles
The agency is the controller of the personal data in its HighLevel account, and we are its processor. Under the California Consumer Privacy Act (CCPA) and similar US state laws, the agency is the business and we are its service provider.
What we do with the data
We process the agency's personal data only to give it its CRM health scores, as the app is built and as the agency's settings direct. That is the agency's documented instruction. If we believe an instruction breaks the law, we will say so.
The details of the processing are in Annex 1.
Our people
Everyone at [legal entity] who can reach the agency's data is bound to keep it confidential, and only the few people who run the service can reach it.
Security
We keep the measures in Annex 2 in place for as long as we hold the agency's data, and we review them when the app changes. We may improve them, but we will not reduce the protection they give.
Subprocessors
The agency agrees that we use the subprocessors listed on our subprocessors page. We give at least 30 days' notice there before adding or replacing one. If the agency objects, it can uninstall the app, and its data is deleted. Each subprocessor is bound by data protection terms at least as protective as these, and we remain responsible for it.
Helping the agency
- Requests from people. If a contact or user asks us directly about their data, we pass the request to the agency within 5 working days and do not answer it ourselves unless the agency asks us to. We help the agency respond, as our privacy policy describes.
- Security, assessments and regulators. We help the agency, with information about the app, to meet its duties on security, data protection impact assessments and consultation with regulators.
Breaches
If we confirm a personal data breach affecting the agency's data, we tell the agency without undue delay, and within 48 hours of confirming it. We tell it what happened, what data and people are affected, what we have done and what it should do, and we keep it updated as we learn more.
Deletion
When the agency uninstalls the app, or the agreement ends, we delete the agency's personal data as our privacy policy describes, unless the law requires us to keep it. The retention periods are in Annex 1.
Audits
We answer the agency's reasonable written questions about how we comply with this agreement, and make available the information it needs to show compliance. Where the law requires an audit or inspection, we allow it with reasonable notice, during working hours, and with confidentiality agreed in advance.
US state privacy laws
We do not sell or share the agency's personal data, as those terms are defined in the CCPA. We do not keep, use or disclose it for any purpose other than providing the app, or outside our direct business relationship with the agency. We do not combine it with personal data from any other source. We comply with the CCPA's duties for service providers and give the same level of privacy protection it requires. The agency may take reasonable steps to stop and fix any unauthorised use. We will tell the agency if we can no longer meet these duties.
International transfers
We process the agency's data in the United States. For an agency in the European Economic Area or Switzerland, the EU Standard Contractual Clauses (Commission Decision 2021/914, module two, controller to processor) are part of this agreement, with the agency as data exporter and us as data importer. For an agency in the United Kingdom, the UK International Data Transfer Addendum is also part of it. The details the clauses need are in Annex 1 and Annex 2. If the clauses and this agreement disagree, the clauses win.
Annex 1: the processing
- Subject matter and purpose: scoring the tidiness of the agency's CRM data in HighLevel, and showing the scores and suggestions to the agency's users.
- Nature: reading through HighLevel's read-only permissions, minimising, encrypting, storing for a short time, scoring and showing.
- People whose data is processed: the agency's contacts in HighLevel, and the agency's HighLevel users.
- Personal data:
- Contacts: name, HighLevel id, owner, tags, and email addresses and phone numbers, which are read but kept only as a keyed fingerprint and a masked form.
- Opportunities: name, pipeline, stage, owner, status and when the stage last changed.
- Users: HighLevel id and name.
- The sub-account's name.
- Sensitive data: none on purpose. The app reads tag names and custom field names; the agency agrees not to put sensitive data in them.
- How long: as in the table below, which is drawn from the app's code.
- Where: the United States.
| What | Personal data in it | Kept | Removed by |
|---|---|---|---|
| HighLevel access tokens, encrypted | None, but they give access to the agency's data | Until uninstall, or 90 days after the HighLevel connection breaks | Uninstall, or the broken-connection clean-up |
| Install records, HighLevel region and white-label domain | None | Until uninstall, or 90 days after the HighLevel connection breaks | Uninstall, or the broken-connection clean-up |
| Settings and branding, and who last changed them | HighLevel user ids | Until uninstall, or 90 days after the HighLevel connection breaks | Uninstall, or the broken-connection clean-up |
| Contacts and tag variants marked as intentional | Contact ids, and the user id of who added each one | Until an admin removes it, a complete scan no longer finds the contact, or uninstall | Admin, scan, or uninstall |
| Sign-in sessions | HighLevel user id, role and sub-account list | 30 minutes, then removed by the next daily clean-up | Daily clean-up |
| Rate-limit counters | A keyed hash of the network address, never the address itself | 1 hour, then removed by the next daily clean-up | Daily clean-up |
| Install check cookie, in the browser | None | 10 minutes, during install only | The browser |
| The latest scan's minimised copy, encrypted | Contact and user names, contact and user ids, tags, masked email addresses and phone numbers, keyed hashes of them, opportunity names and stages, pipeline and custom field names, and the sub-account name | Until the next scan, or 7 days, then removed by the next daily clean-up | The next scan, the daily clean-up, or uninstall |
| The agency's hashing key, encrypted | None | Until uninstall, or 90 days after the HighLevel connection breaks | Uninstall, which makes every leftover hash meaningless |
| Scan records | The HighLevel user id of who asked for the scan | 30 days, then removed by the next daily clean-up | Daily clean-up, or uninstall |
| Score history | The sub-account name; everything else is numbers | 90 days, then removed by the next daily clean-up | Daily clean-up, or uninstall |
| Audit trail | HighLevel user ids, and contact ids for exclusions | 12 months from each event, then removed by the next daily clean-up | Daily clean-up, or a deletion request |
| HighLevel notification ids | None (event type and sub-account id) | 30 days, then removed by the next daily clean-up | Daily clean-up |
| Server logs, at our host | None by design: no names, emails, phone numbers or tokens are logged | The host's log retention for our plan | The host |
| Database backups, at our database provider | Whatever the database held at the time | The provider's backup window | The provider |
Annex 2: security measures
- Access to HighLevel: read-only permissions only, six of them, and no write permission at all.
- Separation: each agency's data is kept apart by row-level security in the database, as well as by the app. Requests for another agency's data get the same answer as data that does not exist.
- Encryption: HTTPS only, with HSTS. HighLevel tokens and scan copies are encrypted with a fresh data key each time, and the data keys are wrapped by AWS KMS. Each scan copy is bound to its own scan and sub-account.
- Minimisation: full email addresses and phone numbers are never stored. Only the fields the scores need are kept, for 7 days at most. Score history is numbers only.
- Who sees what: HighLevel's own permissions decide. Users HighLevel limits to their own contacts see scores without names.
- Sign-in: through HighLevel only, checked on our server, with 30-minute sessions held in memory, not cookies.
- Limits: rate limits on sign-in, scans, the install callback and HighLevel notifications.
- Logging: an audit trail of installs, uninstalls, sign-ins, scans, settings changes and deletions, with ids and counts only. Logs never contain names, email addresses, phone numbers or tokens.
- Deletion: automatic on uninstall, a daily clean-up of everything past its time, and a separate staff tool for requests, which records each use.
- Web security: a strict content security policy, framing allowed only inside HighLevel, and no third-party scripts, fonts or trackers.
- Testing: every measure above has automated tests, including deliberate attempts to break it, run before each change.
Contact
Privacy: [privacy email]. Security: [security email].