Effective 5 September 2026
Where you, the subscriber, are a controller of personal data processed through FirstAsk (for example teammates' accounts, or notes you keep about leads), this addendum forms part of the Terms and we act as your processor for that data.
Process only on your documented instructions (the service as configured by you); keep staff bound by confidentiality; apply appropriate technical and organisational measures (encryption in transit and at rest, least-privilege access, audit logs, field-level encryption of secrets); assist with data-subject requests; delete or return data at the end of the agreement; make available the information needed to demonstrate compliance.
Those listed in the Privacy Policy. We give 30 days' notice of additions; you may object on reasonable grounds.
If you export leads (CSV, API, webhooks) you become an independent controller for what you export; you agree to honour deletion requests we forward to you about a lead you exported.
We notify you without undue delay, and in any case within 72 hours, of a personal data breach affecting your data.