Data Processing Addendum

This Addendum forms part of the Terms of Service and applies whenever we process personal data on your behalf. It is designed to satisfy Article 28 of the GDPR and UK GDPR. If your procurement team needs a signed copy, email legal@govarova.com and we will countersign it — you do not need to negotiate it first.

1. Roles

For the data you upload and the people you choose to contact, you are the controller and we are the processor. You decide the purposes and the means; we act on your documented instructions, which are the Terms of Service plus whatever you do in the product.

For our own B2B database and our customer records, we are the controller. This Addendum does not cover that; the Privacy Policy does.

2. Subject matter, duration, nature, and purpose

Subject matter: provision of the Govarova platform. Duration: the term of your subscription, plus the deletion period below. Nature and purpose: storage, verification, enrichment, segmentation, and transmission of business contact data. Types of personal data: business contact details — name, work email, job title, employer, business phone, professional profiles. Categories of data subject: your prospects, leads, and customers, in their professional capacity.

You must not upload special category data, and the platform is not designed to hold it.

3. Our obligations

We will: process only on your documented instructions; ensure our personnel are bound by confidentiality; implement the security measures described in Security; assist you with data subject requests, DPIAs, and regulator engagement, taking into account the nature of the processing; notify you without undue delay of any personal data breach affecting your data; and, at your choice, delete or return your data at the end of the contract.

If we believe an instruction from you breaches data protection law, we will tell you, and we may decline to carry it out.

4. Sub-processors

You give general authorisation for us to use sub-processors. The current list is at /legal/subprocessors. We will give at least 30 days' notice before adding or replacing one; if you object on reasonable data-protection grounds you may terminate the affected part of the service without penalty. Every sub-processor is bound by terms no less protective than these.

5. Deletion and return

On termination we delete your data within 30 days, unless you ask for it back first or we are legally required to keep it. Backups age out on their normal cycle, within 90 days.

6. International transfers

Where your data leaves the EEA, the UK, or Switzerland, the Standard Contractual Clauses (Module Two: controller to processor) are incorporated into this Addendum by reference, together with the UK International Data Transfer Addendum and the Swiss addendum as applicable. The Annexes are populated by the sections above and by the sub-processor list.

7. Audit

We will make available the information needed to demonstrate compliance with Article 28 and allow for audits, including inspections, by you or an auditor you appoint — on reasonable notice, no more than once a year unless a regulator or a breach requires otherwise, and subject to confidentiality.

8. Contact

DPA requests and signature: legal@govarova.com.

Randoye LLC, a Wyoming limited liability company, trading as Govarova.
30 N Gould St, Ste 5275
Sheridan, WY 82801
United States
legal@govarova.com

We are a fully remote company. The address above is our registered address for legal correspondence; we do not operate a public office and cannot receive visitors.