Our role
When you upload a list, connect HubSpot or send addresses through the dashboard or the API, you decide which people's data is checked and why. For that data you are the controller and SimpleCold is your processor: we process it only to verify it for you, on your instructions, under our Data Processing Agreement (DPA).
For your account, billing, our website, security logs and the verification result cache described below, SimpleCold is the controller. The privacy policy covers that data.
What we process for you
| Details | |
|---|---|
| People concerned | The people whose email addresses are in the lists and requests you send us |
| Personal data | Email addresses, and any other columns in files you upload (such as names or company). From HubSpot: contact ID, email, first and last name |
| What we do with it | Check syntax, domain, mail servers, throwaway and role addresses, catch-all behaviour and whether the mailbox exists, then return a category and reason |
| Special categories | None. Our terms don't allow them in uploads |
| How long | For as long as your account exists, unless you ask us to delete it sooner (see below) |
Your lawful basis
As controller, you need a lawful basis for holding a list and for emailing the people in it. For business prospecting this is often legitimate interests, backed by a balancing test; for newsletters it is usually consent. The rules for sending marketing email (ePrivacy rules and laws such as the UK PECR) apply on top of the GDPR and vary by country.
Verifying a list you already hold lawfully, to avoid emailing addresses that don't exist, is generally treated as part of keeping data accurate. It doesn't create a basis to email people you otherwise couldn't.
Our own lawful bases
- Running your account and the service, and billing: performing our contract with you.
- Keeping records required by tax and accounting law: legal obligation.
- Security, abuse prevention and the verification result cache: our legitimate interests in a secure service and in accurate, efficient results.
The verification result cache
When we check an address, we keep its result against that address and may return it if the same address is checked again within a limited window (30 days for a confirmed mailbox, 14 days for risky, 60 days for undeliverable; unconfirmed results are never reused). This means fewer requests to mail servers and faster answers for everyone.
The cache holds only the address and what we found about it. It does not record which customer checked it, which list it came from or any other column from your file. We treat it as our own processing, under our privacy policy, and we delete an address from it on request.
Data subject rights
If someone in your list asks you to access, correct or delete their data, we help you respond. You can download any job's results from the dashboard yourself; for deletion of files, results or your account, email [email protected] and we complete it within 30 days.
If a person contacts us directly about data in a customer's list, we tell them to contact that customer, and we pass the request on where we can identify the customer. We remove the address from our result cache when asked.
For your own data as a SimpleCold user, see "Your rights" in the privacy policy.
International transfers
SimpleCold's database and storage are in the United States (Neon on AWS us-east-2 and DigitalOcean, with files in New York). If you are in the EEA, the UK or Switzerland, using SimpleCold involves transferring personal data to the United States.
For these transfers, the DPA includes the European Commission's Standard Contractual Clauses (controller to processor), with the UK addendum and the Swiss amendments where they apply. Where a vendor is covered by an adequacy decision, such as certification under the EU-US Data Privacy Framework, that may be relied on instead.
Subprocessors
We use a short list of vendors to host, store and verify your data and to send service email. The subprocessors page lists each one, what it receives and where. Under the DPA we tell customers before we add or replace a subprocessor, so you can object.
Security and breaches
The security page describes the measures we use, such as encryption in transit, private file storage with expiring download links and hashed API keys. If we become aware of a personal data breach affecting your data, we tell you without undue delay, with the information you need to meet your own obligations.
Deletion
We don't delete data automatically yet. Files, results and account data stay available until you ask us to delete them at [email protected]. We then delete them within 30 days, except for records the law requires us to keep, such as invoices.
Signing the DPA
Our DPA forms part of our terms for customers whose use of SimpleCold involves personal data covered by the GDPR, UK GDPR or Swiss law, so it applies without a signature. If you need a signed copy for your records, download the DPA, fill in your details, sign it and email it to [email protected]. We'll countersign it and send it back.