This document is a template. It is signed separately with each partner, and the signed version may differ. Unsigned, the template creates no obligations.
1. Parties and roles
Parties: INFOCLUB LLC, EDRPOU 46356002, address […], represented by its director […] (INFOCLUB), and the partner named in the signed agreement (the Partner).
The roles depend on the data flow:
- Partner's leads. People the Partner adds or imports into the cabinet funnel are processed by the Partner as controller. INFOCLUB is the processor: it stores this data and shows it to the Partner on the Partner's instructions.
- Branch members. When a lead becomes a club member, they get an INFOCLUB account, and INFOCLUB is the controller of the account data. The Partner sees the members of its branch. [to clarify with a lawyer: whether the Partner is a separate controller or INFOCLUB's processor here].
- Duplicate check. To stop two partners working with the same person, the platform stores a hash (SHA-256) of the lead's email and phone. It also notes which partner the lead belongs to. The contact itself is not shown to other partners. [to clarify with a lawyer: the parties' roles for this register].
2. Subject, duration, nature and purpose of processing
Subject: processing personal data of leads and branch members in the partner cabinet on the INFOCLUB platform.
Nature: storage, display to the Partner, moving between funnel stages, import from a file, duplicate checks, deletion.
Purpose: to let the Partner manage its leads and branch members.
Duration: for the term of the main contract with the Partner [to clarify: contract number and date].
3. Categories of data and data subjects
- Data subjects: the Partner's leads, people it met or imported; club members in the Partner's branch.
- Lead data: name, contact (email or phone), source, funnel stage, which member of the Partner's team handles the lead, date and version of consent.
- Branch member data: name, contact, status, join date, plan and payments within the branch.
- Special categories: the Partner does not enter data on health, religion, political views or other special categories into the cabinet.
4. INFOCLUB's obligations as processor
INFOCLUB undertakes to:
- process data only on the Partner's documented instructions, meaning this agreement and the Partner's actions in the cabinet;
- give access to the data only to people bound by confidentiality;
- protect the data: each partner sees only its own leads (row-level access rules in the database), the website runs over HTTPS, and daily backups are stored encrypted;
- use only the subprocessors listed in Subprocessors and notify the Partner of changes;
- help the Partner respond to people's requests for access, correction and deletion of their data;
- notify the Partner of a personal data incident within […] hours of becoming aware of it;
- help with a data protection impact assessment if one is needed [to clarify with a lawyer].
5. The Partner's obligations
The Partner undertakes to:
- have a lawful basis for processing each lead, including consent, whose date and version the cabinet records;
- not enter unnecessary data or special categories of data;
- not send mass messages without people's consent; see the Community Guidelines;
- tell INFOCLUB about people's requests concerning data in the cabinet.
6. International transfers
Cabinet data is stored on a server in the EU (Frankfurt), and backups in Google Cloud, also in Frankfurt. Regions of other services are listed in Subprocessors.
Transfers outside the EEA rely on Standard Contractual Clauses (SCC). [to clarify: whether SCCs are signed and with whom].
INFOCLUB is a Ukrainian company. [to clarify with a lawyer: the legal basis for transferring data from the EU to Ukraine].
7. Return and deletion of data
When the contract ends, INFOCLUB, at the Partner's choice, returns the lead data or deletes it within […] days, unless the law requires longer storage. [to clarify: the return format and whether the cabinet can export leads].
Backups containing this data are kept for up to 14 days on the server and up to [to clarify] in cloud storage, and then deleted.
8. Audit
The Partner may request the information needed to verify compliance with this agreement.
Audits take place with […] days' notice, no more than […] per year, at the Partner's expense [to clarify with a lawyer].
Questions about the agreement or the data: serviceinfoclub@gmail.com.