Data Processing Agreement ​

Last updated October 20, 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service, or any other written agreement for the Services (the "Agreement"), between Salesmortem Inc. ("Salesmortem," "we," "us," or "our") and the customer that agrees to it ("Customer" or "you"). It applies whenever we process Customer Personal Data on your behalf to provide the Services. Terms not defined here have the meaning given in the Agreement.

1. Definitions ​

  • Data Protection Laws means the privacy and data protection laws that apply to the processing of Customer Personal Data under the Agreement, which may include Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and provincial laws such as Quebec's Act respecting the protection of personal information in the private sector; the EU General Data Protection Regulation (GDPR); the UK GDPR and Data Protection Act 2018; the Swiss Federal Act on Data Protection (FADP); and US state privacy laws, including the California Consumer Privacy Act (CCPA).
  • Customer Personal Data means personal information in Customer Data (as defined in the Agreement) that we process on your behalf, including information synced from your CRM, buyer survey responses, and comments.
  • Subprocessor means a third party we engage to process Customer Personal Data.
  • Security Incident means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
  • Controller, processor, data subject, business, and service provider have the meanings given in the applicable Data Protection Laws.

2. Roles and scope ​

For Customer Personal Data, you are the controller (or "business"), and we are your processor (or "service provider"). Where you are yourself a processor for another controller, we are your subprocessor, and you confirm that your instructions are authorized by that controller.

You are responsible for having a lawful basis, and giving any notices and obtaining any consents required by Data Protection Laws and anti-spam laws, for the Customer Personal Data you bring into the Services, including for the buyers and other contacts you sync from your CRM or survey through the Services.

Annex 1 describes the processing.

3. Our obligations ​

We will:

  • process Customer Personal Data only on your documented instructions, which are the Agreement, this DPA, and your use and configuration of the Services, unless the law requires otherwise, in which case we will tell you first unless the law prohibits it;
  • tell you if we believe an instruction infringes Data Protection Laws;
  • make sure everyone we authorize to process Customer Personal Data is bound by confidentiality;
  • not sell or share Customer Personal Data, retain, use, or disclose it outside our direct business relationship with you or for any purpose other than providing the Services, or combine it with personal information we receive from others, except as Data Protection Laws allow for service providers;
  • not use Customer Personal Data to train AI models; and
  • comply with the obligations Data Protection Laws place on processors and service providers, and provide the same level of privacy protection they require.

4. Security ​

We will implement and maintain appropriate technical and organizational measures to protect Customer Personal Data, including those described in Annex 2. We may update these measures as long as the overall level of protection does not decrease.

5. Subprocessors ​

You authorize us to engage the Subprocessors listed on our Subprocessors page. We will:

  • have a written agreement with each Subprocessor that imposes data protection obligations no less protective than this DPA;
  • remain responsible for each Subprocessor's performance of those obligations; and
  • give you at least 30 days' notice, by updating the Subprocessors page and emailing your account owner, before adding or replacing a Subprocessor.

You may object to a new Subprocessor on reasonable data protection grounds by emailing [email protected] within that notice period. We will work with you in good faith to resolve the objection. If we can't, you may terminate the affected Services, and we will refund any prepaid fees for the period after termination.

6. Security Incidents ​

If we become aware of a Security Incident, we will notify you without undue delay, and where feasible within 48 hours. We will give you the information you reasonably need to meet your own obligations, including to notify regulators and affected individuals, and we will take reasonable steps to contain and remedy the incident. Notifying you is not an admission of fault or liability.

7. Assistance ​

Taking into account the nature of the processing, we will help you to:

  • respond to requests from individuals exercising their rights under Data Protection Laws, including by forwarding any request we receive directly to you;
  • carry out data protection or privacy impact assessments, and consult regulators, where Data Protection Laws require it; and
  • meet your security obligations.

8. Deletion and return ​

When the Agreement ends, you can export your Customer Data for 30 days. After that, we will delete Customer Personal Data within a further 30 days, except where the law requires us to keep it. Copies in our backups are deleted as the backups expire, within 90 days, and are protected under this DPA until then.

9. Audits ​

We will make available the information reasonably necessary to demonstrate our compliance with this DPA, including summaries of our security practices and any third-party certifications or reports. If that information is not enough to satisfy an obligation under Data Protection Laws, you may audit our compliance once a year, with at least 30 days' written notice, during business hours, at your own cost, and subject to reasonable confidentiality and security requirements. A regulator may audit us where Data Protection Laws require it.

10. International transfers ​

We store Customer Personal Data in the United States, and our Subprocessors may process it in the locations listed on our Subprocessors page. We will only transfer Customer Personal Data in compliance with Data Protection Laws.

  • EU. To the extent this DPA covers a transfer of personal data from the European Economic Area to a country without an adequacy decision, the Standard Contractual Clauses adopted by the European Commission in Decision (EU) 2021/914 ("SCCs") are incorporated into this DPA. Module 2 (controller to processor) applies where you are a controller, and Module 3 (processor to processor) applies where you are a processor. For the SCCs: the optional docking clause in Clause 7 applies; Option 2 (general authorization) applies under Clause 9, with the notice period in section 5 of this DPA; the optional language in Clause 11 does not apply; the SCCs are governed by the laws of Ireland under Clause 17, and disputes are resolved by the courts of Ireland under Clause 18; and Annexes I, II, and III of the SCCs are completed by Annexes 1 and 2 of this DPA and our Subprocessors page.
  • UK. For transfers from the United Kingdom, the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner applies, completed with the information in this DPA, and either party may end it as allowed by its Section 19.
  • Switzerland. For transfers from Switzerland, the SCCs apply with references to the GDPR read as references to the FADP, and the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority.
  • Canada. For Customer Personal Data from Canada, including Quebec, we will give you the information you reasonably need to assess transfers outside your province or Canada, such as a privacy impact assessment under Quebec law.

If the SCCs conflict with this DPA, the SCCs prevail.

11. General ​

This DPA lasts as long as we process Customer Personal Data on your behalf. Each party's liability under this DPA is subject to the limitations of liability in the Agreement, except where Data Protection Laws or the SCCs do not allow it. If this DPA conflicts with the Agreement, this DPA prevails for the processing of Customer Personal Data. We may update this DPA to reflect changes in Data Protection Laws or our Services, and we will tell you about material changes in advance; an update will not reduce the protection of Customer Personal Data.

If your organization needs a signed copy of this DPA, email [email protected].

Annex 1: Description of the processing ​

Parties. The data exporter is the Customer, and the data importer is Salesmortem Inc., 201-460 Doyle Ave, Kelowna, British Columbia V1Y 0C2, Canada, which can be contacted at [email protected].

Data subjects.

  • the Customer's users of the Services, such as its sales team members;
  • buyers and other contacts in the Customer's CRM deals; and
  • recipients of buyer surveys sent through the Services.

Categories of personal data.

  • contact details, such as names, email addresses, and job titles;
  • company information;
  • deal information synced from the CRM, such as deal names, values, stages, outcomes, and notes;
  • buyer survey responses;
  • comments made in the Services; and
  • usage and technical data about how users use the Services.

Sensitive data. None is intended. The Customer agrees not to submit sensitive personal data, such as health or financial account information, through the Services.

Nature and purpose of the processing. Hosting, storing, syncing, analyzing, and displaying Customer Personal Data to provide the Services, including CRM synchronization, sending buyer surveys and collecting responses, and generating AI-powered insights within the Customer's workspace.

Frequency. Continuous, for as long as the Customer uses the Services.

Duration. For the term of the Agreement, and then as described in section 8.

Subprocessors. As listed on our Subprocessors page, for the purposes and in the locations described there.

Competent supervisory authority. For the SCCs, the supervisory authority determined under Clause 13 of the SCCs.

Annex 2: Security measures ​

  • Encryption. Customer Personal Data is encrypted in transit using TLS, and at rest by our hosting providers.
  • Access control. Our personnel access Customer Personal Data only when needed to provide or support the Services, using individual accounts with multi-factor authentication and least-privilege permissions.
  • Workspace separation. Each customer's data is kept logically separate, and access is restricted to users invited to that workspace.
  • User authentication. Users sign in with magic links, OAuth, or passkeys, and can use multi-factor authentication.
  • Network protection. Traffic passes through Cloudflare for DDoS protection, rate limiting, and filtering.
  • Monitoring. We monitor for errors, suspicious sign-in activity, and unauthorized access attempts, and keep security logs for 90 days.
  • Backups and resilience. Databases are backed up automatically, and backups are encrypted and kept for a limited period.
  • Maintenance. We keep our software and dependencies up to date and fix security vulnerabilities promptly.
  • Personnel. Everyone with access to Customer Personal Data is bound by confidentiality obligations.
  • Vendor management. We review Subprocessors' security and data protection practices before engaging them, and have a data processing agreement with each.
  • Incident response. We have a process to detect, investigate, contain, and report Security Incidents, and we keep a record of them.