Data processing addendum

1.Parties, scope and order of precedence

This addendum is between the customer (the “Controller”) and TODO(1namecard): legal entity name (“1Namecard”, the “Processor”). It forms part of the terms and applies to every plan, including the free one, whenever 1Namecard processes personal data on behalf of the customer in providing the service. It meets the requirements of Article 28(3) of the General Data Protection Regulation (EU) 2016/679 (GDPR). If it conflicts with the terms on the handling of personal data, this addendum prevails. For the personal data for which 1Namecard is itself a controller, such as account and website data, the privacy policy applies instead.

2.Subject matter, duration, nature and purpose

• Subject matter: providing the 1Namecard service to the Controller as described in the terms.
• Duration: for as long as the Controller uses the service, plus the export period of 30 days after it ends, until the data is deleted or returned (see below).
• Nature: hosting, storing, displaying, copying, backing up, transmitting and deleting data.
• Purpose: publishing the Controller’s digital cards; capturing leads and meeting requests with their consent record; counting card views and link clicks; scoring and organising leads; sending alerts and follow-up e-mails the Controller switches on; passing data to integrations the Controller connects (HubSpot, webhooks, API, Slack, Telegram); producing reports and exports.

3.Categories of personal data and data subjects

• People on the Controller’s cards (its staff): name, job title, phone number, e-mail address, social links, photo, location and short description.
• Visitors and leads: name, e-mail address, phone number, company, role, message, meeting request, consent wording and time, IP address and browser user agent of a lead form submission or meeting booking, placement code, actions taken on the card, device, browser, language and approximate location, and notes, stage, owner and score added by the Controller.
• The Controller’s users: name, work e-mail address, role and activity in the admin. For these 1Namecard is also a controller, as the privacy policy explains.

The service is not designed for special categories of personal data (Article 9 GDPR) or data about criminal convictions. The Controller will not intentionally submit them, for example in the lead message field.

4.Instructions

1Namecard processes the personal data only on the Controller’s documented instructions, which are the terms, this addendum and the Controller’s use of the features and settings of the service, unless EU or member state law requires otherwise. In that case 1Namecard tells the Controller before processing, unless the law forbids it. If 1Namecard believes an instruction breaches data protection law, it will tell the Controller without delay.

The Controller is responsible for having a lawful basis for the processing and for informing the data subjects.

5.Confidentiality of personnel

1Namecard makes sure that the people it authorises to process the personal data are bound by confidentiality and have access only as far as they need it to provide the service.

6.Security measures

1Namecard takes appropriate technical and organisational measures under Article 32 GDPR. A summary of the measures in place at the date above:

• Tenant isolation. Every record belongs to an organisation and the application scopes every query to it. Foreign keys that include the organisation stop related records, such as a lead and its card, from pointing into another organisation. An automated check in CI flags queries without an organisation filter. The database does not use row-level security.
• Encryption in transit. All traffic to the website, the app, the API and the card pages is over HTTPS. Webhook and API addresses must be HTTPS.
• Encrypted secrets. CRM credentials, such as the HubSpot token, are stored encrypted with AES-256-GCM. Passwords are stored only as salted hashes. API and MCP tokens are shown once, stored hashed and revocable; they do not expire on their own and are not revoked when their creator leaves. Webhooks are signed with HMAC-SHA256 and a timestamp, with one signing secret per organisation.
• Access control. Roles of owner, admin, member and viewer. Members see only the leads of their own cards; viewers can see all leads. A password change or a deactivation ends that person’s sessions. Sign-in with Google or Microsoft Entra ID (OpenID Connect) is available, and on Business an owner can require it for everyone. There is no SAML or SCIM.
• Rate limits per source on public forms, and per token on the API. A repeat lead from the same e-mail address within 24 hours is skipped.
• Audit log. Changes made in the admin are logged with what changed, by whom and when, never with passwords, photos or browser details.
• Privacy by design. Card views and short-link clicks are counted without cookies and without storing the visitor’s IP address. The consent wording a visitor saw is stored with each lead.
• Backups and storage. Daily backups to a private Vercel Blob store in Frankfurt. The database and storage providers encrypt data at rest.
• Erasure tools. Delete all data for this email removes that person's leads, meetings and notes from the live database. If a CRM is connected, it also asks the CRM to delete the contact, once: if the CRM is disconnected or its access has expired, that does not happen. It does not change daily backups taken before the deletion, and it cannot recall data already sent to Slack, Telegram, e-mail or webhook receivers.

1Namecard may update these measures, as long as it does not reduce the overall level of protection.

7.Sub-processors

The Controller gives general authorisation for 1Namecard to use the sub-processors below. Providers that the Controller or a user connects itself (HubSpot, Slack, Telegram) act on the Controller’s instruction and under the Controller’s own contract with them. They are listed for transparency, and 1Namecard transmits data to them only when the Controller switches the integration on.

• Vercel Inc.

  Purpose

  Application servers (serverless functions), edge network and logs, and private file storage for uploads and backups.

  Location

  Application servers and the private Blob store for uploads and backups in Frankfurt, Germany (region fra1). The global edge network terminates connections and caches public pages close to each visitor, so requests can pass through edge locations outside the EU. Company in the United States.

  When

  Always

  Transfers

  EU-US Data Privacy Framework and standard contractual clauses

• Neon, Inc.

  Purpose

  The Postgres database that holds cards, leads, meetings and accounts.

  Location

  Frankfurt, Germany (AWS eu-central-1). Company in the United States.

  When

  Always

  Transfers

  EU-US Data Privacy Framework and standard contractual clauses for any support access from outside the EEA

• Resend, Inc.

  Purpose

  Transactional e-mail: sign-up verification, invitations, password resets and the follow-up e-mails a customer switches on.

  Location

  United States

  When

  Only when e-mail is enabled for the service

  Transfers

  EU-US Data Privacy Framework and standard contractual clauses

• Stripe, Inc.

  Purpose

  Payments for paid plans bought online: the billing contact, the subscription and the payment.

  Location

  Where Stripe operates, including the United States

  When

  Only when an organisation pays for a plan online

  Transfers

  EU-US Data Privacy Framework and standard contractual clauses

• HubSpot, Inc. (HubSpot Ireland Limited in the EU)

  Purpose

  The customer’s own CRM. We send contacts, companies, deals, notes and meetings to it.

  Location

  As set in the customer’s HubSpot account

  When

  Only when a customer connects HubSpot

  Transfers

  Set by the customer’s contract with HubSpot

• Slack (Slack Technologies, a Salesforce company)

  Purpose

  Lead and meeting alerts posted to a channel through an incoming webhook the customer sets up.

  Location

  As set in the customer’s Slack workspace

  When

  Only when a customer connects Slack

  Transfers

  Set by the customer’s contract with Slack

• Telegram (Telegram Messenger)

  Purpose

  Lead and meeting alerts sent to a person who links their own Telegram account to our bot.

  Location

  Outside the EEA

  When

  Only when a user links Telegram

  Transfers

  Chosen by the user who links the account. TODO(1namecard): confirm the transfer basis

1Namecard imposes on each sub-processor data protection obligations no less protective than these, and remains responsible to the Controller for their performance. 1Namecard will tell the Controller’s account owners by e-mail at least 30 days before adding or replacing a sub-processor. The Controller may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Controller may end the affected service and receive a refund of prepaid fees for the rest of the period.

8.International transfers

The application servers (Vercel Functions), the database (Neon Postgres) and the private Vercel Blob store for uploaded files and daily backups are all in Frankfurt, Germany (AWS eu-central-1, Vercel region fra1). Customer and lead data is stored and processed in the EU. Vercel's global edge network terminates connections and caches public pages close to each visitor, so a request can pass through an edge location outside the EU on its way to Frankfurt. Services a customer connects, such as HubSpot, Slack and Telegram, and our e-mail and payment providers process data where they operate. Where personal data is transferred outside the EEA, 1Namecard relies on the EU-US Data Privacy Framework for certified providers and on the European Commission’s standard contractual clauses (Decision 2021/914) otherwise, with supplementary measures where needed. Copies are available on request.

9.Assistance

1Namecard will, taking into account the nature of the processing and the information it has:

• pass on to the Controller, without undue delay, any request it receives from a data subject about the Controller’s data, and not answer it itself except as the Controller instructs;
• help the Controller answer data subject requests, with tools such as exports, correction in the admin and deletion by e-mail address;
• help with security, breach notification, data protection impact assessments and consultations with authorities (Articles 32 to 36 GDPR), on reasonable request.

Personal data breaches

1Namecard will tell the Controller without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting the Controller’s data. The notice will describe what happened, the data and people concerned, the likely consequences and what is being done, as far as known, and will be updated as more is learned.

10.Deletion or return

When the service ends, the Controller can export its data for 30 days, and 1Namecard returns a full export on request. After that period 1Namecard deletes the personal data, and existing copies, unless EU or member state law requires storage. Backups taken before then are not changed by the deletion. The Controller can delete data earlier at any time in the service.

11.Information and audits

1Namecard will give the Controller the information needed to show that it meets this addendum, including answers to reasonable security questionnaires sent to privacy@1namecard.com. It will allow and contribute to audits by the Controller or an auditor the Controller appoints, no more than once a year unless there has been a breach or an authority requires it. The audit needs at least 30 days’ notice, takes place in business hours, does not give access to other customers’ data, is covered by confidentiality and is at the Controller’s cost. 1Namecard may meet the request first by sharing independent reports and sub-processor certifications.

12.Liability and governing law

Liability under this addendum follows the terms, including the carve-outs that can never be excluded, and does not limit the rights of data subjects under Article 82 GDPR. The governing law and courts are those of the terms. This addendum lasts as long as 1Namecard processes the Controller’s personal data.

Questions: privacy@1namecard.com