Data Processing Agreement
Last updated: October 13, 2026
Version: 1.0
This Data Processing Agreement (the "DPA") is part of the Terms of Service (the "Terms") between Kranz & Gupta, Indiepal GbR, Brunnenstr. 11, 53123 Bonn, Germany ("Preb") and the Customer. It applies whenever Preb processes personal data on behalf of the Customer in the course of providing the Service. The Customer accepts this DPA by accepting the Terms. A countersigned copy is available on request at hello@preb.co.
Capitalised terms have the meaning given in the Terms. "GDPR" means Regulation (EU) 2016/679. "Data Protection Law" means the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, the national laws implementing them, and the US state privacy laws listed in Section 13, in each case as applicable to the Customer Data. "Customer Data" in this DPA means the personal data in Customer Data and Results as defined in the Terms. "Sub-processor" means a third party engaged by Preb to process Customer Data.
1. Scope, precedence and term
1.1 This DPA governs the processing of Customer Data by Preb. It does not govern Preb's processing of account, billing, support, website or usage data of the Customer and its Users, for which Preb is the controller and which is described in the Privacy Policy.
1.2 In case of conflict concerning the protection of personal data, this DPA prevails over the Terms. Where Standard Contractual Clauses apply under Section 7, they prevail over this DPA.
1.3 This DPA starts with the Terms and remains in force until Preb has deleted all Customer Data in accordance with Section 10.
2. Roles
2.1 The Customer is the controller of Customer Data and determines the purposes and means of the processing. Where the Customer uses the Service on behalf of its own clients (for example as a recruiting agency), the Customer acts as processor for those clients and warrants that it has the authority to instruct Preb as a further processor and that its own agreements allow this.
2.2 Preb is the processor of Customer Data and processes it only on the Customer's documented instructions.
3. Details of the processing
The subject matter, nature and purpose of the processing, the types of personal data, the categories of data subjects and the duration are set out in Annex 1.
4. Preb's obligations as processor
4.1 Instructions. Preb processes Customer Data only on documented instructions from the Customer, including with regard to transfers to a third country, unless Union or Member State law requires otherwise. In that case Preb informs the Customer of the legal requirement before processing, unless the law prohibits this on important grounds of public interest. The Customer's instructions are given through the functions of the Service (uploading or entering contacts, choosing the fields to find, starting, stopping, exporting and deleting Lists and Workspaces, and the settings of the Workspace), through the Terms and this DPA, and, where needed, by email to hello@preb.co. Preb informs the Customer without delay if, in its opinion, an instruction infringes Data Protection Law, and may suspend the instruction until it is confirmed or changed.
4.2 Confidentiality. Preb ensures that every person authorised to process Customer Data has committed to confidentiality or is under an appropriate statutory obligation of confidentiality, and processes Customer Data only on instruction. Access is limited to the persons who need it for the Service.
4.3 Security. Preb implements the technical and organisational measures in Annex 2 and keeps them up to date with the state of the art, so that the processing meets the requirements of Art. 32 GDPR. Preb may change individual measures provided the overall level of security is not reduced.
4.4 Sub-processors. Preb engages Sub-processors only under the conditions of Section 6.
4.5 Data subject rights. Taking into account the nature of the processing, Preb assists the Customer with appropriate technical and organisational measures, as far as possible, in responding to requests from data subjects to exercise their rights, as set out in Section 9.
4.6 Further assistance. Taking into account the nature of the processing and the information available to Preb, Preb assists the Customer in meeting its obligations regarding security of processing, notification of personal data breaches, data protection impact assessments and prior consultation of supervisory authorities (Art. 32 to 36 GDPR).
4.7 Deletion and return. At the end of the provision of the Service, Preb deletes or returns Customer Data as set out in Section 10.
4.8 Information and audits. Preb makes available all information necessary to demonstrate compliance with Art. 28 GDPR and allows for and contributes to audits as set out in Section 11.
4.9 Records. Preb keeps a record of the processing activities carried out on behalf of the Customer as required by Art. 30 (2) GDPR.
5. Customer's obligations
5.1 The Customer is responsible for the lawfulness of the processing of Customer Data, in particular for having a lawful basis to enrich and contact each data subject, for providing the information required by Art. 13 and 14 GDPR and comparable laws, for the accuracy of Customer Data, and for its instructions complying with Data Protection Law.
5.2 The Customer will not upload or request processing of special categories of personal data (Art. 9 GDPR), data relating to criminal convictions, data about children, or data it has no right to use.
5.3 The Customer responds to data subjects, supervisory authorities and third parties concerning Customer Data. Preb supports it as described in this DPA.
5.4 The Customer informs Preb without delay if it becomes aware of errors or irregularities in the processing of Customer Data by Preb.
6. Sub-processors
6.1 General authorisation. The Customer gives Preb a general authorisation to engage the Sub-processors listed in the Sub-processor List (Annex 3), including the providers those Sub-processors use for the processing of Customer Data, as named in that list. The current list is published at preb.co/sub-processor and provided with this DPA.
6.2 Changes. Preb informs Owners and Admins of the Customer's Workspace by email at least 30 days before adding or replacing a Sub-processor. If a Sub-processor gives Preb less notice of a change in its own sub-processors, Preb passes on that notice without delay. The notice names the new Sub-processor, its location and its activity.
6.3 Objection. The Customer may object to a change on reasonable data protection grounds within 14 days of the notice by email to hello@preb.co. Preb will then try to find a solution, for example by not using the new Sub-processor for the Customer's data where that is technically possible. If no solution is found within 30 days, the Customer may terminate the affected Subscription with immediate effect and Preb refunds the pro-rated fees for the unused part of a prepaid period. If the Customer does not object within 14 days, the change is deemed accepted.
6.4 Flow-down and liability. Preb imposes on each Sub-processor by written contract data protection obligations that are at least as protective as those in this DPA, in particular regarding security, confidentiality, instructions and sub-processing. Where a Sub-processor fails to fulfil its obligations, Preb remains fully liable to the Customer for the performance of that Sub-processor's obligations.
6.5 Chain transparency. Because Preb's enrichment Sub-processor relies on further providers to find and verify contact data, the Sub-processor List also names those providers as published by the Sub-processor. Preb updates the list when it learns of a change and does not use providers that the Sub-processor has not disclosed.
7. International transfers
7.1 Preb's location. Preb is established in Germany. For a Customer established in the EEA, the United Kingdom or Switzerland, the disclosure of Customer Data to Preb is not a transfer to a third country. For a Customer established elsewhere, for example in the United States, the GDPR applies to Preb's processing because Preb is established in the European Union, and no transfer safeguards are required for the Customer's disclosure to Preb.
7.2 Onward transfers by Preb. Preb stores and processes Customer Data with Sub-processors in the United States and the European Union as set out in the Sub-processor List. Preb transfers Customer Data to a third country only in accordance with Chapter V GDPR: on the basis of an adequacy decision, including the EU-US Data Privacy Framework for Sub-processors certified under it, and otherwise on the basis of the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module 3 (processor to processor), with Preb as data exporter and the Sub-processor as data importer, supplemented by a transfer impact assessment and additional measures where needed. For UK Customer Data Preb uses the UK International Data Transfer Addendum, and for Swiss Customer Data the adjustments required by the Swiss Federal Act on Data Protection.
7.3 Copies. Preb provides the Customer on request with information on the transfer mechanisms in place with each Sub-processor and, where available, copies of the relevant clauses, with commercial information redacted.
7.4 Customer as exporter. If the Customer is itself a processor for a client in the EEA, the United Kingdom or Switzerland, the Customer may require Preb to enter into the Standard Contractual Clauses (Module 3) with the Customer for the benefit of that client. Preb will do so on request.
8. Personal data breaches
8.1 Preb notifies the Customer without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting Customer Data. Notice goes by email to the Owner and Admins of the affected Workspace.
8.2 The notice describes, as far as known at the time, the nature of the breach including the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed to address the breach and mitigate its effects, and a contact point for more information. Information not available at first is provided in phases without undue delay.
8.3 Preb cooperates with the Customer and takes reasonable steps to contain and remedy the breach. Preb does not inform data subjects or authorities about a breach of Customer Data without the Customer's instruction, unless required by law.
9. Data subject requests and complaints
9.1 If a data subject, a supervisory authority or another third party contacts Preb about Customer Data, Preb forwards the request to the Customer within 5 business days and does not respond on the merits, except to refer the person to the Customer or where the law requires Preb to respond.
9.2 Preb assists the Customer in responding, in particular by providing the Customer Data held about the data subject, by correcting or deleting it on instruction, and by restricting processing. The Service lets the Customer search, edit, export and delete Contacts and Lists itself at any time.
9.3 Where a data subject objects to the processing of their data or requests erasure directly from Preb or from Preb's enrichment Sub-processor, Preb may, in addition to forwarding the request, suppress that data subject's Results in the Service and block future enrichment of that data subject, as described in the Privacy Policy. Preb informs the Customer of such suppression. Credits consumed for suppressed Results are not refunded.
10. Deletion and return of Customer Data
10.1 The Customer can export Lists at any time and can delete Lists, Contacts, its Workspace and its accounts itself in the Service. Deletion in the Service is immediate for live data.
10.2 Lists, Results and uploaded files are kept until the Customer deletes them or the Workspace. Cached Results are kept per Workspace for 90 days after the enrichment. Raw notifications from Sub-processors are kept for 30 days. Copies in backups are overwritten within 30 days after deletion of the live data.
10.3 At the end of the Terms, Preb deletes all remaining Customer Data within 30 days, unless Union or Member State law requires longer storage, in which case Preb restricts the data to that purpose. On request made before the end of the Terms, Preb provides an export of the Customer's Lists first.
10.4 Preb's enrichment Sub-processor deletes the Customer Data it received for enrichment 3 months after the enrichment.
11. Information and audit
11.1 Preb provides the Customer on request with the information necessary to demonstrate compliance with this DPA and Art. 28 GDPR, including the current version of Annex 2, the Sub-processor List, and summaries of security reports of its Sub-processors (such as SOC 2 reports) to the extent Preb may share them.
11.2 The Customer may audit Preb's compliance once per year, and additionally after a personal data breach or at the request of a supervisory authority. The Customer gives at least 30 days notice and describes the scope. The audit is first conducted on the basis of documentation and written answers. An inspection on site is possible only if the documentation leaves reasonable doubts, is limited to the systems used for the Customer Data, takes place during business hours without disrupting operations, and may be conducted by an independent auditor bound by confidentiality who is not a competitor of Preb. Each party bears its own costs, unless the audit reveals a material breach by Preb.
11.3 Preb may demonstrate compliance with obligations relating to Sub-processors by providing the Sub-processors' own certifications and audit reports.
12. Liability
Liability under this DPA follows Section 16 of the Terms. The allocation of liability between controller and processor under Art. 82 GDPR towards data subjects remains unaffected. The Customer indemnifies Preb against claims arising from instructions that infringe Data Protection Law or from a breach of Section 5.
13. US state privacy laws
This Section applies to the extent the California Consumer Privacy Act as amended by the California Privacy Rights Act (together "CCPA"), the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Utah Consumer Privacy Act, the Texas Data Privacy and Security Act, the Oregon Consumer Privacy Act or another comparable US state law ("US State Laws") applies to Customer Data.
13.1 Preb acts as a "service provider", "processor" or "contractor" under the US State Laws. The Customer discloses Customer Data to Preb only for the limited and specified business purpose of providing the Service as described in Annex 1.
13.2 Preb shall not: (a) sell or share Customer Data; (b) retain, use or disclose Customer Data for any purpose other than the business purpose specified in this DPA, including for any commercial purpose other than providing the Service; (c) retain, use or disclose Customer Data outside the direct business relationship between Preb and the Customer; or (d) combine Customer Data with personal information it receives from another source or collects itself, except as permitted by the US State Laws for service providers.
13.3 Preb complies with the US State Laws applicable to it as a service provider and provides the same level of privacy protection as those laws require of the Customer. Preb notifies the Customer if it determines that it can no longer meet its obligations under the US State Laws. The Customer may take reasonable and appropriate steps to ensure that Preb uses Customer Data in a manner consistent with the Customer's obligations, and to stop and remediate unauthorised use, including by requesting the information described in Section 11.
13.4 Preb passes the restrictions of this Section on to its Sub-processors by written contract and notifies the Customer of such engagements through the Sub-processor List.
13.5 Preb assists the Customer in responding to verifiable consumer requests as described in Section 9, and certifies that it understands the restrictions in this Section and will comply with them.
14. Final provisions
14.1 Changes. Preb may update this DPA where a change in Data Protection Law, in the Service or in the Sub-processors requires it. Preb informs the Customer as described in the Terms. Changes that reduce the level of protection require the Customer's consent.
14.2 Law and courts. This DPA is governed by the law of the Federal Republic of Germany. The courts of Bonn, Germany, have jurisdiction as set out in the Terms. Mandatory provisions of Data Protection Law prevail.
14.3 Severability. If a provision of this DPA is invalid, the remaining provisions remain in force and the invalid provision is replaced by one that comes closest to the requirements of Art. 28 GDPR.
14.4 Contact. Data protection matters: hello@preb.co. Kranz & Gupta, Indiepal GbR, Brunnenstr. 11, 53123 Bonn, Germany, represented by Leon Kranz and Arun Gupta.
Annex 1: Details of the processing
Subject matter. Enrichment and verification of contact data of candidates, hiring managers and other business contacts that the Customer uploads to or enters in the Preb application, and the storage, display and export of the results.
Nature and purpose. On the Customer's instruction Preb sends the inputs it has provided to its enrichment Sub-processor, which finds and verifies work email addresses, personal email addresses and phone numbers, identifies a person from an email address, and returns public professional profile data. Preb stores the results in the Customer's Workspace, shows them in the application, allows filtering and export, caches them per Workspace for reuse within 90 days, and deletes them on the Customer's instruction. The purpose is recruiting and hiring by the Customer, as permitted by the Terms.
Categories of data subjects. Candidates, hiring managers, recruiters, employees of target companies and other business contacts that the Customer wants to reach for recruiting purposes.
Categories of personal data.
- Identification data: first name, last name, full name.
- Professional data: current and past employer, company domain, job title, seniority, location, LinkedIn profile URL and identifiers, professional headline, employment history, education, skills and languages as returned by the enrichment Sub-processor.
- Contact data: work email address and its deliverability status, personal email address and its status, phone numbers with line type, region, ownership confidence and connect rate.
- Any other columns contained in the files the Customer uploads, which are stored unchanged and returned in exports.
- Technical data: row position, internal identifiers, timestamps, credits consumed per row.
Special categories of personal data. None. The Customer undertakes not to submit special categories of personal data, data relating to criminal convictions or data about children (Section 5.2).
Duration. For the term of the Terms. Retention periods are set out in Section 10 and in the Privacy Policy.
Processing operations. Collection (upload), storage, organisation, structuring, transmission to the enrichment Sub-processor, retrieval, consultation, use, alignment with cached results, restriction, erasure.
Annex 2: Technical and organisational measures
Preb implements the following measures, which it reviews at least once a year and after every significant change to the Service.
Pseudonymisation and encryption. All connections between users, the application and Sub-processors are encrypted with TLS 1.2 or higher. Data at rest in the database, in file storage and in backups is encrypted by the hosting provider with AES-256. Deleted accounts are remembered only as a one-way hash of the email address for abuse prevention. Engine logs are structured and never contain contact data.
Confidentiality. Every Workspace's data is isolated by row level security policies in the database, so that a User can only read data of Workspaces they are a member of, and only the server-side service role can read across Workspaces. Within a Workspace, access is role based (Owner, Admin, Member). Service-role keys and provider API keys exist only on the server and in the hosting provider's encrypted environment configuration, never in the browser. Uploaded files are stored in a private bucket and are reachable only through signed, time-limited links. Access to production systems is limited to the two founders, protected by two-factor authentication at every provider, and reviewed when a person's role changes.
Integrity. Users sign in without passwords through expiring magic links or Google sign-in. Incoming notifications from Sub-processors and from the payment provider are verified with cryptographic signatures before they are processed and are recorded for idempotent processing. Credits and results are reconciled against the Sub-processor's authoritative response. Database changes are made through versioned migrations.
Availability and resilience. The application runs on a global hosting platform with automatic scaling and failover. The database provider takes daily backups and keeps them for a limited rotation period. Enrichment runs are resumable: an interrupted run continues where it stopped, and provider outages pause runs and retry automatically.
Restoration. Backups can be restored by the database provider on request. The founders test the restore procedure at least once a year.
Testing and evaluation. Automated tests run on every change. Type checks and linting are enforced. Security and performance advisories of the database provider are reviewed after every schema change. Sub-processors' SOC 2 reports are reviewed once a year.
User identification and authorisation. Each User has one account tied to one email address. Sessions are bound to signed tokens with limited lifetime and refreshed server-side. Invitations are single-use tokens that expire after 7 days. Rate limits apply to sign-in emails and invitations.
Protection of data during transmission. TLS for all traffic, HTTP Strict Transport Security on the application domain, signed webhooks, no transfer of contact data by email.
Protection of data during storage. Encryption at rest, private buckets, row level security, separation of Workspaces, no cross-Workspace reuse of results.
Physical security. Data centres of the hosting providers (AWS and DigitalOcean) are certified under SOC 2 and ISO 27001 with physical access controls. Preb operates no servers of its own.
Event logging. Request logs at the hosting provider, authentication logs at the database provider and structured engine logs allow security events to be traced. Logs contain no contact data. Retention follows the Privacy Policy.
System configuration. Infrastructure is defined in code and reviewed before deployment. Default-deny access policies in the database. Dependencies are kept current.
Internal governance. The two founders are jointly responsible for data protection. Privacy and security are part of every feature review. Incidents are handled according to Section 8.
Certification and assurance. Preb relies on the certifications of its Sub-processors (SOC 2 Type II at Supabase, Vercel and FullEnrich) and makes them available as described in Section 11.
Data minimisation. Only the fields selected by the Customer are requested from the enrichment Sub-processor. Only the inputs needed for enrichment are sent (names, company, domain, LinkedIn URL or email address). Error reports and logs exclude contact data.
Data quality. Results carry their verification status so that the Customer can judge their reliability. The Customer can correct or delete any record.
Limited retention. Lists until deletion by the Customer; cache 90 days; raw notifications 30 days; backups rotated within 30 days; daily automated cleanup jobs enforce these periods.
Accountability. Records of processing, this DPA, the Sub-processor List and the Privacy Policy are kept current and published.
Portability and erasure. Export of every List in CSV format at any time; self-service deletion of Lists, Workspaces and accounts; deletion cascades through all related records and files.
Measures for Sub-processors. Written data processing agreements with Standard Contractual Clauses or Data Privacy Framework certification, review of the Sub-processors' security documentation, and the chain transparency described in Section 6.5.
Annex 3: Sub-processors
The authorised Sub-processors, including the providers engaged by them for Customer Data, are listed in the Sub-processor List published at preb.co/sub-processor and provided together with this DPA.
Data Processing Agreement
Last updated: October 13, 2026
Version: 1.0
This Data Processing Agreement (the "DPA") is part of the Terms of Service (the "Terms") between Kranz & Gupta, Indiepal GbR, Brunnenstr. 11, 53123 Bonn, Germany ("Preb") and the Customer. It applies whenever Preb processes personal data on behalf of the Customer in the course of providing the Service. The Customer accepts this DPA by accepting the Terms. A countersigned copy is available on request at hello@preb.co.
Capitalised terms have the meaning given in the Terms. "GDPR" means Regulation (EU) 2016/679. "Data Protection Law" means the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, the national laws implementing them, and the US state privacy laws listed in Section 13, in each case as applicable to the Customer Data. "Customer Data" in this DPA means the personal data in Customer Data and Results as defined in the Terms. "Sub-processor" means a third party engaged by Preb to process Customer Data.
1. Scope, precedence and term
1.1 This DPA governs the processing of Customer Data by Preb. It does not govern Preb's processing of account, billing, support, website or usage data of the Customer and its Users, for which Preb is the controller and which is described in the Privacy Policy.
1.2 In case of conflict concerning the protection of personal data, this DPA prevails over the Terms. Where Standard Contractual Clauses apply under Section 7, they prevail over this DPA.
1.3 This DPA starts with the Terms and remains in force until Preb has deleted all Customer Data in accordance with Section 10.
2. Roles
2.1 The Customer is the controller of Customer Data and determines the purposes and means of the processing. Where the Customer uses the Service on behalf of its own clients (for example as a recruiting agency), the Customer acts as processor for those clients and warrants that it has the authority to instruct Preb as a further processor and that its own agreements allow this.
2.2 Preb is the processor of Customer Data and processes it only on the Customer's documented instructions.
3. Details of the processing
The subject matter, nature and purpose of the processing, the types of personal data, the categories of data subjects and the duration are set out in Annex 1.
4. Preb's obligations as processor
4.1 Instructions. Preb processes Customer Data only on documented instructions from the Customer, including with regard to transfers to a third country, unless Union or Member State law requires otherwise. In that case Preb informs the Customer of the legal requirement before processing, unless the law prohibits this on important grounds of public interest. The Customer's instructions are given through the functions of the Service (uploading or entering contacts, choosing the fields to find, starting, stopping, exporting and deleting Lists and Workspaces, and the settings of the Workspace), through the Terms and this DPA, and, where needed, by email to hello@preb.co. Preb informs the Customer without delay if, in its opinion, an instruction infringes Data Protection Law, and may suspend the instruction until it is confirmed or changed.
4.2 Confidentiality. Preb ensures that every person authorised to process Customer Data has committed to confidentiality or is under an appropriate statutory obligation of confidentiality, and processes Customer Data only on instruction. Access is limited to the persons who need it for the Service.
4.3 Security. Preb implements the technical and organisational measures in Annex 2 and keeps them up to date with the state of the art, so that the processing meets the requirements of Art. 32 GDPR. Preb may change individual measures provided the overall level of security is not reduced.
4.4 Sub-processors. Preb engages Sub-processors only under the conditions of Section 6.
4.5 Data subject rights. Taking into account the nature of the processing, Preb assists the Customer with appropriate technical and organisational measures, as far as possible, in responding to requests from data subjects to exercise their rights, as set out in Section 9.
4.6 Further assistance. Taking into account the nature of the processing and the information available to Preb, Preb assists the Customer in meeting its obligations regarding security of processing, notification of personal data breaches, data protection impact assessments and prior consultation of supervisory authorities (Art. 32 to 36 GDPR).
4.7 Deletion and return. At the end of the provision of the Service, Preb deletes or returns Customer Data as set out in Section 10.
4.8 Information and audits. Preb makes available all information necessary to demonstrate compliance with Art. 28 GDPR and allows for and contributes to audits as set out in Section 11.
4.9 Records. Preb keeps a record of the processing activities carried out on behalf of the Customer as required by Art. 30 (2) GDPR.
5. Customer's obligations
5.1 The Customer is responsible for the lawfulness of the processing of Customer Data, in particular for having a lawful basis to enrich and contact each data subject, for providing the information required by Art. 13 and 14 GDPR and comparable laws, for the accuracy of Customer Data, and for its instructions complying with Data Protection Law.
5.2 The Customer will not upload or request processing of special categories of personal data (Art. 9 GDPR), data relating to criminal convictions, data about children, or data it has no right to use.
5.3 The Customer responds to data subjects, supervisory authorities and third parties concerning Customer Data. Preb supports it as described in this DPA.
5.4 The Customer informs Preb without delay if it becomes aware of errors or irregularities in the processing of Customer Data by Preb.
6. Sub-processors
6.1 General authorisation. The Customer gives Preb a general authorisation to engage the Sub-processors listed in the Sub-processor List (Annex 3), including the providers those Sub-processors use for the processing of Customer Data, as named in that list. The current list is published at preb.co/sub-processor and provided with this DPA.
6.2 Changes. Preb informs Owners and Admins of the Customer's Workspace by email at least 30 days before adding or replacing a Sub-processor. If a Sub-processor gives Preb less notice of a change in its own sub-processors, Preb passes on that notice without delay. The notice names the new Sub-processor, its location and its activity.
6.3 Objection. The Customer may object to a change on reasonable data protection grounds within 14 days of the notice by email to hello@preb.co. Preb will then try to find a solution, for example by not using the new Sub-processor for the Customer's data where that is technically possible. If no solution is found within 30 days, the Customer may terminate the affected Subscription with immediate effect and Preb refunds the pro-rated fees for the unused part of a prepaid period. If the Customer does not object within 14 days, the change is deemed accepted.
6.4 Flow-down and liability. Preb imposes on each Sub-processor by written contract data protection obligations that are at least as protective as those in this DPA, in particular regarding security, confidentiality, instructions and sub-processing. Where a Sub-processor fails to fulfil its obligations, Preb remains fully liable to the Customer for the performance of that Sub-processor's obligations.
6.5 Chain transparency. Because Preb's enrichment Sub-processor relies on further providers to find and verify contact data, the Sub-processor List also names those providers as published by the Sub-processor. Preb updates the list when it learns of a change and does not use providers that the Sub-processor has not disclosed.
7. International transfers
7.1 Preb's location. Preb is established in Germany. For a Customer established in the EEA, the United Kingdom or Switzerland, the disclosure of Customer Data to Preb is not a transfer to a third country. For a Customer established elsewhere, for example in the United States, the GDPR applies to Preb's processing because Preb is established in the European Union, and no transfer safeguards are required for the Customer's disclosure to Preb.
7.2 Onward transfers by Preb. Preb stores and processes Customer Data with Sub-processors in the United States and the European Union as set out in the Sub-processor List. Preb transfers Customer Data to a third country only in accordance with Chapter V GDPR: on the basis of an adequacy decision, including the EU-US Data Privacy Framework for Sub-processors certified under it, and otherwise on the basis of the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module 3 (processor to processor), with Preb as data exporter and the Sub-processor as data importer, supplemented by a transfer impact assessment and additional measures where needed. For UK Customer Data Preb uses the UK International Data Transfer Addendum, and for Swiss Customer Data the adjustments required by the Swiss Federal Act on Data Protection.
7.3 Copies. Preb provides the Customer on request with information on the transfer mechanisms in place with each Sub-processor and, where available, copies of the relevant clauses, with commercial information redacted.
7.4 Customer as exporter. If the Customer is itself a processor for a client in the EEA, the United Kingdom or Switzerland, the Customer may require Preb to enter into the Standard Contractual Clauses (Module 3) with the Customer for the benefit of that client. Preb will do so on request.
8. Personal data breaches
8.1 Preb notifies the Customer without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting Customer Data. Notice goes by email to the Owner and Admins of the affected Workspace.
8.2 The notice describes, as far as known at the time, the nature of the breach including the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed to address the breach and mitigate its effects, and a contact point for more information. Information not available at first is provided in phases without undue delay.
8.3 Preb cooperates with the Customer and takes reasonable steps to contain and remedy the breach. Preb does not inform data subjects or authorities about a breach of Customer Data without the Customer's instruction, unless required by law.
9. Data subject requests and complaints
9.1 If a data subject, a supervisory authority or another third party contacts Preb about Customer Data, Preb forwards the request to the Customer within 5 business days and does not respond on the merits, except to refer the person to the Customer or where the law requires Preb to respond.
9.2 Preb assists the Customer in responding, in particular by providing the Customer Data held about the data subject, by correcting or deleting it on instruction, and by restricting processing. The Service lets the Customer search, edit, export and delete Contacts and Lists itself at any time.
9.3 Where a data subject objects to the processing of their data or requests erasure directly from Preb or from Preb's enrichment Sub-processor, Preb may, in addition to forwarding the request, suppress that data subject's Results in the Service and block future enrichment of that data subject, as described in the Privacy Policy. Preb informs the Customer of such suppression. Credits consumed for suppressed Results are not refunded.
10. Deletion and return of Customer Data
10.1 The Customer can export Lists at any time and can delete Lists, Contacts, its Workspace and its accounts itself in the Service. Deletion in the Service is immediate for live data.
10.2 Lists, Results and uploaded files are kept until the Customer deletes them or the Workspace. Cached Results are kept per Workspace for 90 days after the enrichment. Raw notifications from Sub-processors are kept for 30 days. Copies in backups are overwritten within 30 days after deletion of the live data.
10.3 At the end of the Terms, Preb deletes all remaining Customer Data within 30 days, unless Union or Member State law requires longer storage, in which case Preb restricts the data to that purpose. On request made before the end of the Terms, Preb provides an export of the Customer's Lists first.
10.4 Preb's enrichment Sub-processor deletes the Customer Data it received for enrichment 3 months after the enrichment.
11. Information and audit
11.1 Preb provides the Customer on request with the information necessary to demonstrate compliance with this DPA and Art. 28 GDPR, including the current version of Annex 2, the Sub-processor List, and summaries of security reports of its Sub-processors (such as SOC 2 reports) to the extent Preb may share them.
11.2 The Customer may audit Preb's compliance once per year, and additionally after a personal data breach or at the request of a supervisory authority. The Customer gives at least 30 days notice and describes the scope. The audit is first conducted on the basis of documentation and written answers. An inspection on site is possible only if the documentation leaves reasonable doubts, is limited to the systems used for the Customer Data, takes place during business hours without disrupting operations, and may be conducted by an independent auditor bound by confidentiality who is not a competitor of Preb. Each party bears its own costs, unless the audit reveals a material breach by Preb.
11.3 Preb may demonstrate compliance with obligations relating to Sub-processors by providing the Sub-processors' own certifications and audit reports.
12. Liability
Liability under this DPA follows Section 16 of the Terms. The allocation of liability between controller and processor under Art. 82 GDPR towards data subjects remains unaffected. The Customer indemnifies Preb against claims arising from instructions that infringe Data Protection Law or from a breach of Section 5.
13. US state privacy laws
This Section applies to the extent the California Consumer Privacy Act as amended by the California Privacy Rights Act (together "CCPA"), the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Utah Consumer Privacy Act, the Texas Data Privacy and Security Act, the Oregon Consumer Privacy Act or another comparable US state law ("US State Laws") applies to Customer Data.
13.1 Preb acts as a "service provider", "processor" or "contractor" under the US State Laws. The Customer discloses Customer Data to Preb only for the limited and specified business purpose of providing the Service as described in Annex 1.
13.2 Preb shall not: (a) sell or share Customer Data; (b) retain, use or disclose Customer Data for any purpose other than the business purpose specified in this DPA, including for any commercial purpose other than providing the Service; (c) retain, use or disclose Customer Data outside the direct business relationship between Preb and the Customer; or (d) combine Customer Data with personal information it receives from another source or collects itself, except as permitted by the US State Laws for service providers.
13.3 Preb complies with the US State Laws applicable to it as a service provider and provides the same level of privacy protection as those laws require of the Customer. Preb notifies the Customer if it determines that it can no longer meet its obligations under the US State Laws. The Customer may take reasonable and appropriate steps to ensure that Preb uses Customer Data in a manner consistent with the Customer's obligations, and to stop and remediate unauthorised use, including by requesting the information described in Section 11.
13.4 Preb passes the restrictions of this Section on to its Sub-processors by written contract and notifies the Customer of such engagements through the Sub-processor List.
13.5 Preb assists the Customer in responding to verifiable consumer requests as described in Section 9, and certifies that it understands the restrictions in this Section and will comply with them.
14. Final provisions
14.1 Changes. Preb may update this DPA where a change in Data Protection Law, in the Service or in the Sub-processors requires it. Preb informs the Customer as described in the Terms. Changes that reduce the level of protection require the Customer's consent.
14.2 Law and courts. This DPA is governed by the law of the Federal Republic of Germany. The courts of Bonn, Germany, have jurisdiction as set out in the Terms. Mandatory provisions of Data Protection Law prevail.
14.3 Severability. If a provision of this DPA is invalid, the remaining provisions remain in force and the invalid provision is replaced by one that comes closest to the requirements of Art. 28 GDPR.
14.4 Contact. Data protection matters: hello@preb.co. Kranz & Gupta, Indiepal GbR, Brunnenstr. 11, 53123 Bonn, Germany, represented by Leon Kranz and Arun Gupta.
Annex 1: Details of the processing
Subject matter. Enrichment and verification of contact data of candidates, hiring managers and other business contacts that the Customer uploads to or enters in the Preb application, and the storage, display and export of the results.
Nature and purpose. On the Customer's instruction Preb sends the inputs it has provided to its enrichment Sub-processor, which finds and verifies work email addresses, personal email addresses and phone numbers, identifies a person from an email address, and returns public professional profile data. Preb stores the results in the Customer's Workspace, shows them in the application, allows filtering and export, caches them per Workspace for reuse within 90 days, and deletes them on the Customer's instruction. The purpose is recruiting and hiring by the Customer, as permitted by the Terms.
Categories of data subjects. Candidates, hiring managers, recruiters, employees of target companies and other business contacts that the Customer wants to reach for recruiting purposes.
Categories of personal data.
- Identification data: first name, last name, full name.
- Professional data: current and past employer, company domain, job title, seniority, location, LinkedIn profile URL and identifiers, professional headline, employment history, education, skills and languages as returned by the enrichment Sub-processor.
- Contact data: work email address and its deliverability status, personal email address and its status, phone numbers with line type, region, ownership confidence and connect rate.
- Any other columns contained in the files the Customer uploads, which are stored unchanged and returned in exports.
- Technical data: row position, internal identifiers, timestamps, credits consumed per row.
Special categories of personal data. None. The Customer undertakes not to submit special categories of personal data, data relating to criminal convictions or data about children (Section 5.2).
Duration. For the term of the Terms. Retention periods are set out in Section 10 and in the Privacy Policy.
Processing operations. Collection (upload), storage, organisation, structuring, transmission to the enrichment Sub-processor, retrieval, consultation, use, alignment with cached results, restriction, erasure.
Annex 2: Technical and organisational measures
Preb implements the following measures, which it reviews at least once a year and after every significant change to the Service.
Pseudonymisation and encryption. All connections between users, the application and Sub-processors are encrypted with TLS 1.2 or higher. Data at rest in the database, in file storage and in backups is encrypted by the hosting provider with AES-256. Deleted accounts are remembered only as a one-way hash of the email address for abuse prevention. Engine logs are structured and never contain contact data.
Confidentiality. Every Workspace's data is isolated by row level security policies in the database, so that a User can only read data of Workspaces they are a member of, and only the server-side service role can read across Workspaces. Within a Workspace, access is role based (Owner, Admin, Member). Service-role keys and provider API keys exist only on the server and in the hosting provider's encrypted environment configuration, never in the browser. Uploaded files are stored in a private bucket and are reachable only through signed, time-limited links. Access to production systems is limited to the two founders, protected by two-factor authentication at every provider, and reviewed when a person's role changes.
Integrity. Users sign in without passwords through expiring magic links or Google sign-in. Incoming notifications from Sub-processors and from the payment provider are verified with cryptographic signatures before they are processed and are recorded for idempotent processing. Credits and results are reconciled against the Sub-processor's authoritative response. Database changes are made through versioned migrations.
Availability and resilience. The application runs on a global hosting platform with automatic scaling and failover. The database provider takes daily backups and keeps them for a limited rotation period. Enrichment runs are resumable: an interrupted run continues where it stopped, and provider outages pause runs and retry automatically.
Restoration. Backups can be restored by the database provider on request. The founders test the restore procedure at least once a year.
Testing and evaluation. Automated tests run on every change. Type checks and linting are enforced. Security and performance advisories of the database provider are reviewed after every schema change. Sub-processors' SOC 2 reports are reviewed once a year.
User identification and authorisation. Each User has one account tied to one email address. Sessions are bound to signed tokens with limited lifetime and refreshed server-side. Invitations are single-use tokens that expire after 7 days. Rate limits apply to sign-in emails and invitations.
Protection of data during transmission. TLS for all traffic, HTTP Strict Transport Security on the application domain, signed webhooks, no transfer of contact data by email.
Protection of data during storage. Encryption at rest, private buckets, row level security, separation of Workspaces, no cross-Workspace reuse of results.
Physical security. Data centres of the hosting providers (AWS and DigitalOcean) are certified under SOC 2 and ISO 27001 with physical access controls. Preb operates no servers of its own.
Event logging. Request logs at the hosting provider, authentication logs at the database provider and structured engine logs allow security events to be traced. Logs contain no contact data. Retention follows the Privacy Policy.
System configuration. Infrastructure is defined in code and reviewed before deployment. Default-deny access policies in the database. Dependencies are kept current.
Internal governance. The two founders are jointly responsible for data protection. Privacy and security are part of every feature review. Incidents are handled according to Section 8.
Certification and assurance. Preb relies on the certifications of its Sub-processors (SOC 2 Type II at Supabase, Vercel and FullEnrich) and makes them available as described in Section 11.
Data minimisation. Only the fields selected by the Customer are requested from the enrichment Sub-processor. Only the inputs needed for enrichment are sent (names, company, domain, LinkedIn URL or email address). Error reports and logs exclude contact data.
Data quality. Results carry their verification status so that the Customer can judge their reliability. The Customer can correct or delete any record.
Limited retention. Lists until deletion by the Customer; cache 90 days; raw notifications 30 days; backups rotated within 30 days; daily automated cleanup jobs enforce these periods.
Accountability. Records of processing, this DPA, the Sub-processor List and the Privacy Policy are kept current and published.
Portability and erasure. Export of every List in CSV format at any time; self-service deletion of Lists, Workspaces and accounts; deletion cascades through all related records and files.
Measures for Sub-processors. Written data processing agreements with Standard Contractual Clauses or Data Privacy Framework certification, review of the Sub-processors' security documentation, and the chain transparency described in Section 6.5.
Annex 3: Sub-processors
The authorised Sub-processors, including the providers engaged by them for Customer Data, are listed in the Sub-processor List published at preb.co/sub-processor and provided together with this DPA.
Data Processing Agreement
Last updated: October 13, 2026
Version: 1.0
This Data Processing Agreement (the "DPA") is part of the Terms of Service (the "Terms") between Kranz & Gupta, Indiepal GbR, Brunnenstr. 11, 53123 Bonn, Germany ("Preb") and the Customer. It applies whenever Preb processes personal data on behalf of the Customer in the course of providing the Service. The Customer accepts this DPA by accepting the Terms. A countersigned copy is available on request at hello@preb.co.
Capitalised terms have the meaning given in the Terms. "GDPR" means Regulation (EU) 2016/679. "Data Protection Law" means the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, the national laws implementing them, and the US state privacy laws listed in Section 13, in each case as applicable to the Customer Data. "Customer Data" in this DPA means the personal data in Customer Data and Results as defined in the Terms. "Sub-processor" means a third party engaged by Preb to process Customer Data.
1. Scope, precedence and term
1.1 This DPA governs the processing of Customer Data by Preb. It does not govern Preb's processing of account, billing, support, website or usage data of the Customer and its Users, for which Preb is the controller and which is described in the Privacy Policy.
1.2 In case of conflict concerning the protection of personal data, this DPA prevails over the Terms. Where Standard Contractual Clauses apply under Section 7, they prevail over this DPA.
1.3 This DPA starts with the Terms and remains in force until Preb has deleted all Customer Data in accordance with Section 10.
2. Roles
2.1 The Customer is the controller of Customer Data and determines the purposes and means of the processing. Where the Customer uses the Service on behalf of its own clients (for example as a recruiting agency), the Customer acts as processor for those clients and warrants that it has the authority to instruct Preb as a further processor and that its own agreements allow this.
2.2 Preb is the processor of Customer Data and processes it only on the Customer's documented instructions.
3. Details of the processing
The subject matter, nature and purpose of the processing, the types of personal data, the categories of data subjects and the duration are set out in Annex 1.
4. Preb's obligations as processor
4.1 Instructions. Preb processes Customer Data only on documented instructions from the Customer, including with regard to transfers to a third country, unless Union or Member State law requires otherwise. In that case Preb informs the Customer of the legal requirement before processing, unless the law prohibits this on important grounds of public interest. The Customer's instructions are given through the functions of the Service (uploading or entering contacts, choosing the fields to find, starting, stopping, exporting and deleting Lists and Workspaces, and the settings of the Workspace), through the Terms and this DPA, and, where needed, by email to hello@preb.co. Preb informs the Customer without delay if, in its opinion, an instruction infringes Data Protection Law, and may suspend the instruction until it is confirmed or changed.
4.2 Confidentiality. Preb ensures that every person authorised to process Customer Data has committed to confidentiality or is under an appropriate statutory obligation of confidentiality, and processes Customer Data only on instruction. Access is limited to the persons who need it for the Service.
4.3 Security. Preb implements the technical and organisational measures in Annex 2 and keeps them up to date with the state of the art, so that the processing meets the requirements of Art. 32 GDPR. Preb may change individual measures provided the overall level of security is not reduced.
4.4 Sub-processors. Preb engages Sub-processors only under the conditions of Section 6.
4.5 Data subject rights. Taking into account the nature of the processing, Preb assists the Customer with appropriate technical and organisational measures, as far as possible, in responding to requests from data subjects to exercise their rights, as set out in Section 9.
4.6 Further assistance. Taking into account the nature of the processing and the information available to Preb, Preb assists the Customer in meeting its obligations regarding security of processing, notification of personal data breaches, data protection impact assessments and prior consultation of supervisory authorities (Art. 32 to 36 GDPR).
4.7 Deletion and return. At the end of the provision of the Service, Preb deletes or returns Customer Data as set out in Section 10.
4.8 Information and audits. Preb makes available all information necessary to demonstrate compliance with Art. 28 GDPR and allows for and contributes to audits as set out in Section 11.
4.9 Records. Preb keeps a record of the processing activities carried out on behalf of the Customer as required by Art. 30 (2) GDPR.
5. Customer's obligations
5.1 The Customer is responsible for the lawfulness of the processing of Customer Data, in particular for having a lawful basis to enrich and contact each data subject, for providing the information required by Art. 13 and 14 GDPR and comparable laws, for the accuracy of Customer Data, and for its instructions complying with Data Protection Law.
5.2 The Customer will not upload or request processing of special categories of personal data (Art. 9 GDPR), data relating to criminal convictions, data about children, or data it has no right to use.
5.3 The Customer responds to data subjects, supervisory authorities and third parties concerning Customer Data. Preb supports it as described in this DPA.
5.4 The Customer informs Preb without delay if it becomes aware of errors or irregularities in the processing of Customer Data by Preb.
6. Sub-processors
6.1 General authorisation. The Customer gives Preb a general authorisation to engage the Sub-processors listed in the Sub-processor List (Annex 3), including the providers those Sub-processors use for the processing of Customer Data, as named in that list. The current list is published at preb.co/sub-processor and provided with this DPA.
6.2 Changes. Preb informs Owners and Admins of the Customer's Workspace by email at least 30 days before adding or replacing a Sub-processor. If a Sub-processor gives Preb less notice of a change in its own sub-processors, Preb passes on that notice without delay. The notice names the new Sub-processor, its location and its activity.
6.3 Objection. The Customer may object to a change on reasonable data protection grounds within 14 days of the notice by email to hello@preb.co. Preb will then try to find a solution, for example by not using the new Sub-processor for the Customer's data where that is technically possible. If no solution is found within 30 days, the Customer may terminate the affected Subscription with immediate effect and Preb refunds the pro-rated fees for the unused part of a prepaid period. If the Customer does not object within 14 days, the change is deemed accepted.
6.4 Flow-down and liability. Preb imposes on each Sub-processor by written contract data protection obligations that are at least as protective as those in this DPA, in particular regarding security, confidentiality, instructions and sub-processing. Where a Sub-processor fails to fulfil its obligations, Preb remains fully liable to the Customer for the performance of that Sub-processor's obligations.
6.5 Chain transparency. Because Preb's enrichment Sub-processor relies on further providers to find and verify contact data, the Sub-processor List also names those providers as published by the Sub-processor. Preb updates the list when it learns of a change and does not use providers that the Sub-processor has not disclosed.
7. International transfers
7.1 Preb's location. Preb is established in Germany. For a Customer established in the EEA, the United Kingdom or Switzerland, the disclosure of Customer Data to Preb is not a transfer to a third country. For a Customer established elsewhere, for example in the United States, the GDPR applies to Preb's processing because Preb is established in the European Union, and no transfer safeguards are required for the Customer's disclosure to Preb.
7.2 Onward transfers by Preb. Preb stores and processes Customer Data with Sub-processors in the United States and the European Union as set out in the Sub-processor List. Preb transfers Customer Data to a third country only in accordance with Chapter V GDPR: on the basis of an adequacy decision, including the EU-US Data Privacy Framework for Sub-processors certified under it, and otherwise on the basis of the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module 3 (processor to processor), with Preb as data exporter and the Sub-processor as data importer, supplemented by a transfer impact assessment and additional measures where needed. For UK Customer Data Preb uses the UK International Data Transfer Addendum, and for Swiss Customer Data the adjustments required by the Swiss Federal Act on Data Protection.
7.3 Copies. Preb provides the Customer on request with information on the transfer mechanisms in place with each Sub-processor and, where available, copies of the relevant clauses, with commercial information redacted.
7.4 Customer as exporter. If the Customer is itself a processor for a client in the EEA, the United Kingdom or Switzerland, the Customer may require Preb to enter into the Standard Contractual Clauses (Module 3) with the Customer for the benefit of that client. Preb will do so on request.
8. Personal data breaches
8.1 Preb notifies the Customer without undue delay, and where feasible within 48 hours, after becoming aware of a personal data breach affecting Customer Data. Notice goes by email to the Owner and Admins of the affected Workspace.
8.2 The notice describes, as far as known at the time, the nature of the breach including the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed to address the breach and mitigate its effects, and a contact point for more information. Information not available at first is provided in phases without undue delay.
8.3 Preb cooperates with the Customer and takes reasonable steps to contain and remedy the breach. Preb does not inform data subjects or authorities about a breach of Customer Data without the Customer's instruction, unless required by law.
9. Data subject requests and complaints
9.1 If a data subject, a supervisory authority or another third party contacts Preb about Customer Data, Preb forwards the request to the Customer within 5 business days and does not respond on the merits, except to refer the person to the Customer or where the law requires Preb to respond.
9.2 Preb assists the Customer in responding, in particular by providing the Customer Data held about the data subject, by correcting or deleting it on instruction, and by restricting processing. The Service lets the Customer search, edit, export and delete Contacts and Lists itself at any time.
9.3 Where a data subject objects to the processing of their data or requests erasure directly from Preb or from Preb's enrichment Sub-processor, Preb may, in addition to forwarding the request, suppress that data subject's Results in the Service and block future enrichment of that data subject, as described in the Privacy Policy. Preb informs the Customer of such suppression. Credits consumed for suppressed Results are not refunded.
10. Deletion and return of Customer Data
10.1 The Customer can export Lists at any time and can delete Lists, Contacts, its Workspace and its accounts itself in the Service. Deletion in the Service is immediate for live data.
10.2 Lists, Results and uploaded files are kept until the Customer deletes them or the Workspace. Cached Results are kept per Workspace for 90 days after the enrichment. Raw notifications from Sub-processors are kept for 30 days. Copies in backups are overwritten within 30 days after deletion of the live data.
10.3 At the end of the Terms, Preb deletes all remaining Customer Data within 30 days, unless Union or Member State law requires longer storage, in which case Preb restricts the data to that purpose. On request made before the end of the Terms, Preb provides an export of the Customer's Lists first.
10.4 Preb's enrichment Sub-processor deletes the Customer Data it received for enrichment 3 months after the enrichment.
11. Information and audit
11.1 Preb provides the Customer on request with the information necessary to demonstrate compliance with this DPA and Art. 28 GDPR, including the current version of Annex 2, the Sub-processor List, and summaries of security reports of its Sub-processors (such as SOC 2 reports) to the extent Preb may share them.
11.2 The Customer may audit Preb's compliance once per year, and additionally after a personal data breach or at the request of a supervisory authority. The Customer gives at least 30 days notice and describes the scope. The audit is first conducted on the basis of documentation and written answers. An inspection on site is possible only if the documentation leaves reasonable doubts, is limited to the systems used for the Customer Data, takes place during business hours without disrupting operations, and may be conducted by an independent auditor bound by confidentiality who is not a competitor of Preb. Each party bears its own costs, unless the audit reveals a material breach by Preb.
11.3 Preb may demonstrate compliance with obligations relating to Sub-processors by providing the Sub-processors' own certifications and audit reports.
12. Liability
Liability under this DPA follows Section 16 of the Terms. The allocation of liability between controller and processor under Art. 82 GDPR towards data subjects remains unaffected. The Customer indemnifies Preb against claims arising from instructions that infringe Data Protection Law or from a breach of Section 5.
13. US state privacy laws
This Section applies to the extent the California Consumer Privacy Act as amended by the California Privacy Rights Act (together "CCPA"), the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Utah Consumer Privacy Act, the Texas Data Privacy and Security Act, the Oregon Consumer Privacy Act or another comparable US state law ("US State Laws") applies to Customer Data.
13.1 Preb acts as a "service provider", "processor" or "contractor" under the US State Laws. The Customer discloses Customer Data to Preb only for the limited and specified business purpose of providing the Service as described in Annex 1.
13.2 Preb shall not: (a) sell or share Customer Data; (b) retain, use or disclose Customer Data for any purpose other than the business purpose specified in this DPA, including for any commercial purpose other than providing the Service; (c) retain, use or disclose Customer Data outside the direct business relationship between Preb and the Customer; or (d) combine Customer Data with personal information it receives from another source or collects itself, except as permitted by the US State Laws for service providers.
13.3 Preb complies with the US State Laws applicable to it as a service provider and provides the same level of privacy protection as those laws require of the Customer. Preb notifies the Customer if it determines that it can no longer meet its obligations under the US State Laws. The Customer may take reasonable and appropriate steps to ensure that Preb uses Customer Data in a manner consistent with the Customer's obligations, and to stop and remediate unauthorised use, including by requesting the information described in Section 11.
13.4 Preb passes the restrictions of this Section on to its Sub-processors by written contract and notifies the Customer of such engagements through the Sub-processor List.
13.5 Preb assists the Customer in responding to verifiable consumer requests as described in Section 9, and certifies that it understands the restrictions in this Section and will comply with them.
14. Final provisions
14.1 Changes. Preb may update this DPA where a change in Data Protection Law, in the Service or in the Sub-processors requires it. Preb informs the Customer as described in the Terms. Changes that reduce the level of protection require the Customer's consent.
14.2 Law and courts. This DPA is governed by the law of the Federal Republic of Germany. The courts of Bonn, Germany, have jurisdiction as set out in the Terms. Mandatory provisions of Data Protection Law prevail.
14.3 Severability. If a provision of this DPA is invalid, the remaining provisions remain in force and the invalid provision is replaced by one that comes closest to the requirements of Art. 28 GDPR.
14.4 Contact. Data protection matters: hello@preb.co. Kranz & Gupta, Indiepal GbR, Brunnenstr. 11, 53123 Bonn, Germany, represented by Leon Kranz and Arun Gupta.
Annex 1: Details of the processing
Subject matter. Enrichment and verification of contact data of candidates, hiring managers and other business contacts that the Customer uploads to or enters in the Preb application, and the storage, display and export of the results.
Nature and purpose. On the Customer's instruction Preb sends the inputs it has provided to its enrichment Sub-processor, which finds and verifies work email addresses, personal email addresses and phone numbers, identifies a person from an email address, and returns public professional profile data. Preb stores the results in the Customer's Workspace, shows them in the application, allows filtering and export, caches them per Workspace for reuse within 90 days, and deletes them on the Customer's instruction. The purpose is recruiting and hiring by the Customer, as permitted by the Terms.
Categories of data subjects. Candidates, hiring managers, recruiters, employees of target companies and other business contacts that the Customer wants to reach for recruiting purposes.
Categories of personal data.
- Identification data: first name, last name, full name.
- Professional data: current and past employer, company domain, job title, seniority, location, LinkedIn profile URL and identifiers, professional headline, employment history, education, skills and languages as returned by the enrichment Sub-processor.
- Contact data: work email address and its deliverability status, personal email address and its status, phone numbers with line type, region, ownership confidence and connect rate.
- Any other columns contained in the files the Customer uploads, which are stored unchanged and returned in exports.
- Technical data: row position, internal identifiers, timestamps, credits consumed per row.
Special categories of personal data. None. The Customer undertakes not to submit special categories of personal data, data relating to criminal convictions or data about children (Section 5.2).
Duration. For the term of the Terms. Retention periods are set out in Section 10 and in the Privacy Policy.
Processing operations. Collection (upload), storage, organisation, structuring, transmission to the enrichment Sub-processor, retrieval, consultation, use, alignment with cached results, restriction, erasure.
Annex 2: Technical and organisational measures
Preb implements the following measures, which it reviews at least once a year and after every significant change to the Service.
Pseudonymisation and encryption. All connections between users, the application and Sub-processors are encrypted with TLS 1.2 or higher. Data at rest in the database, in file storage and in backups is encrypted by the hosting provider with AES-256. Deleted accounts are remembered only as a one-way hash of the email address for abuse prevention. Engine logs are structured and never contain contact data.
Confidentiality. Every Workspace's data is isolated by row level security policies in the database, so that a User can only read data of Workspaces they are a member of, and only the server-side service role can read across Workspaces. Within a Workspace, access is role based (Owner, Admin, Member). Service-role keys and provider API keys exist only on the server and in the hosting provider's encrypted environment configuration, never in the browser. Uploaded files are stored in a private bucket and are reachable only through signed, time-limited links. Access to production systems is limited to the two founders, protected by two-factor authentication at every provider, and reviewed when a person's role changes.
Integrity. Users sign in without passwords through expiring magic links or Google sign-in. Incoming notifications from Sub-processors and from the payment provider are verified with cryptographic signatures before they are processed and are recorded for idempotent processing. Credits and results are reconciled against the Sub-processor's authoritative response. Database changes are made through versioned migrations.
Availability and resilience. The application runs on a global hosting platform with automatic scaling and failover. The database provider takes daily backups and keeps them for a limited rotation period. Enrichment runs are resumable: an interrupted run continues where it stopped, and provider outages pause runs and retry automatically.
Restoration. Backups can be restored by the database provider on request. The founders test the restore procedure at least once a year.
Testing and evaluation. Automated tests run on every change. Type checks and linting are enforced. Security and performance advisories of the database provider are reviewed after every schema change. Sub-processors' SOC 2 reports are reviewed once a year.
User identification and authorisation. Each User has one account tied to one email address. Sessions are bound to signed tokens with limited lifetime and refreshed server-side. Invitations are single-use tokens that expire after 7 days. Rate limits apply to sign-in emails and invitations.
Protection of data during transmission. TLS for all traffic, HTTP Strict Transport Security on the application domain, signed webhooks, no transfer of contact data by email.
Protection of data during storage. Encryption at rest, private buckets, row level security, separation of Workspaces, no cross-Workspace reuse of results.
Physical security. Data centres of the hosting providers (AWS and DigitalOcean) are certified under SOC 2 and ISO 27001 with physical access controls. Preb operates no servers of its own.
Event logging. Request logs at the hosting provider, authentication logs at the database provider and structured engine logs allow security events to be traced. Logs contain no contact data. Retention follows the Privacy Policy.
System configuration. Infrastructure is defined in code and reviewed before deployment. Default-deny access policies in the database. Dependencies are kept current.
Internal governance. The two founders are jointly responsible for data protection. Privacy and security are part of every feature review. Incidents are handled according to Section 8.
Certification and assurance. Preb relies on the certifications of its Sub-processors (SOC 2 Type II at Supabase, Vercel and FullEnrich) and makes them available as described in Section 11.
Data minimisation. Only the fields selected by the Customer are requested from the enrichment Sub-processor. Only the inputs needed for enrichment are sent (names, company, domain, LinkedIn URL or email address). Error reports and logs exclude contact data.
Data quality. Results carry their verification status so that the Customer can judge their reliability. The Customer can correct or delete any record.
Limited retention. Lists until deletion by the Customer; cache 90 days; raw notifications 30 days; backups rotated within 30 days; daily automated cleanup jobs enforce these periods.
Accountability. Records of processing, this DPA, the Sub-processor List and the Privacy Policy are kept current and published.
Portability and erasure. Export of every List in CSV format at any time; self-service deletion of Lists, Workspaces and accounts; deletion cascades through all related records and files.
Measures for Sub-processors. Written data processing agreements with Standard Contractual Clauses or Data Privacy Framework certification, review of the Sub-processors' security documentation, and the chain transparency described in Section 6.5.
Annex 3: Sub-processors
The authorised Sub-processors, including the providers engaged by them for Customer Data, are listed in the Sub-processor List published at preb.co/sub-processor and provided together with this DPA.