Last updated: October 18, 2026
This Agreement is entered into between the Clonio user who turns on the SDR Agent (the "Controller") and ZIPGENIAL LLC, a Florida (United States) company with address at 655 S Le Jeune Rd, Ste 905, Coral Gables, FL 33134 and email contact@clonio.es, owner of Clonio (the "Processor"). It governs the processing of third parties' personal data that the Processor carries out on the Controller's behalf when providing it with the SDR Agent, under Article 28 of Regulation (EU) 2016/679 ("GDPR"). It forms part of Clonio's Legal Notice, and the Controller expressly accepts it when turning on the SDR Agent. If the Controller turns it on acting for a company, it declares that it is authorised to accept this Agreement on that company's behalf, and that company is the Controller. The Processor's representative in the Union (Article 27 GDPR) is GRUPO TINFORCE S.L.U., Spanish tax ID (NIF) B22930978, Rúa Dinán, 21, entreplanta, puerta B, 27002 Lugo (Spain), info@zipgenial.com.
The subject matter, nature and purpose of the processing, the types of data, the categories of data subjects and the retention periods are described in Annex I. This Agreement lasts while the SDR Agent is turned on and until the deletion provided for in clause 11.
The Processor processes the data only on the Controller's documented instructions, including with regard to international transfers. Documented instructions are this Agreement and its Annexes, the settings the Controller chooses in the app (activation, ideal customers, stages, notes, discards, deletions, exclusions and deactivation) and any additional written instructions it sends to contact@clonio.es and the Processor accepts. By accepting this Agreement, the Controller approves as its own instruction the operation of the service described in Annex I. The Processor will notify the Controller at least thirty (30) days in advance, by email or in the app, of any change to the data captured, the purpose, the retention periods or the sub-processors; will inform it immediately if it considers that an instruction infringes data protection law; and, if Union or Member State law requires it to process the data otherwise, will inform it beforehand, unless that law prohibits it.
The Processor does not process the data for its own purposes or those of third parties: it does not sell or disclose it, combine it across Controllers, or use it for advertising or to train or fine-tune artificial intelligence models, and it does not allow its sub-processors to do so. As the sole exception, it may derive from the data aggregated, anonymous statistics on how the service works (for example, counts by interaction type or the accuracy rate of the assessment), from which no one can be identified, in order to maintain and improve the SDR Agent; for that operation it acts as controller, on the basis of its legitimate interest.
The Processor ensures that persons authorised to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that they only access it when the Controller asks for help with an issue, to investigate a security problem or to comply with the law.
The Processor implements the technical and organisational measures in Annex II, which ensure a level of security appropriate to the risk under Article 32 GDPR, and may replace them with others offering an equal or higher level of protection.
The Controller gives the Processor a general authorisation to engage the sub-processors listed in Annex III. The Processor will inform the Controller at least thirty (30) days in advance, by email and by updating Annex III, of any addition or replacement of sub-processors; the Controller may object on reasonable data protection grounds and, if no solution is found, turn off the SDR Agent. The Processor imposes on each sub-processor, by contract, data protection obligations equivalent to those in this Agreement and remains fully liable to the Controller for their performance.
The Processor is established in the United States. The disclosure of the Controller's data to the Processor is governed by the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), which the parties incorporate by reference into this Agreement, with the Controller as data exporter and the Processor as data importer, and with these options: clause 7 (docking clause) is included; in clause 9(a), option 2 (general prior authorisation) applies, with the notice period in clause 7 of this Agreement; the option in clause 11(a) is not included; under clause 13, the competent supervisory authority is the one determined by its paragraph (a) and, for Controllers established in Spain, the Spanish Data Protection Agency; the clauses are governed by Spanish law (clause 17) and disputes are submitted to the courts of Madrid (clause 18). Their Annexes I, II and III are those of this Agreement. In case of conflict, the standard contractual clauses prevail.
Some sub-processors in Annex III process the data in the United States or may access it from there. The Processor only transfers data to sub-processors established outside the Union with a safeguard under Chapter V GDPR (their certification under the EU-U.S. Data Privacy Framework or the standard contractual clauses, Module Three), shown in Annex III.
Taking into account the nature of the processing, the Processor assists the Controller in responding to requests to exercise the rights under Articles 15 to 22 GDPR: in the app, the Controller can view all data about each person, delete them and tick "Don't track this person again". If a data subject contacts the Processor directly, the Processor will forward the request to the Controller without undue delay and will not answer it on the merits unless instructed by the Controller.
Standing instruction: when the Controller deletes a person ticking "Don't track this person again", the Processor will delete their data and keep only a pseudonymised code, computed with a secret key from their LinkedIn identifiers and different for each Controller, solely so as not to record them again while the Controller's account exists. If the person objects or requests erasure directly to the Processor, the Processor will forward the request to the Controller without undue delay, as set out in the previous paragraph, and will only delete them or stop recording them on the Controller's instructions.
The Processor assists the Controller in complying with Articles 32 to 36 GDPR with the information available to it about the processing. It will notify the Controller without undue delay, and in any event within forty-eight (48) hours of becoming aware of it, of any personal data breach affecting its data, with the information under Article 33(3) GDPR available to it, supplemented in phases. It will not notify the breach to the supervisory authority or to data subjects on the Controller's behalf unless instructed by the Controller.
If the Controller turns off the SDR Agent or no longer has a plan that includes it, the Processor deletes all of its data after thirty (30) days, or immediately if the Controller asks when turning it off, unless the Controller turns it back on or gets that plan back before then. Until deletion, the Controller may ask contact@clonio.es for a copy of its data in a structured format. The database provider's backups are overwritten in their ordinary cycle. The exclusion codes in clause 9 are deleted together with the Controller's account.
The Processor makes available to the Controller the information necessary to demonstrate compliance with this Agreement and Article 28 GDPR, and allows for and contributes to audits, including inspections, conducted by the Controller or an independent auditor bound by confidentiality appointed by it, with thirty (30) days' prior notice, at most once a year unless there is a personal data breach or a supervisory authority requires it, first in documentary form and at the Controller's expense.
The Controller warrants that the processing it entrusts is lawful and, in particular, undertakes to: (a) have a valid legal basis; (b) inform the people it contacts under Article 14 GDPR; (c) respect their right to object, using "Don't track this person again" where appropriate; (d) comply with the rules on commercial communications by electronic means, in particular Article 21 of Spanish Law 34/2002 (LSSI) or the equivalent applicable rule; and (e) give only instructions that comply with data protection law.
Each party's liability towards data subjects is governed by Article 82 GDPR; between the parties, the limitation of liability clause of the Legal Notice applies, except in cases of wilful misconduct or gross negligence and except as mandatorily provided by the standard contractual clauses. On data protection matters, this Agreement prevails over the Legal Notice. It is governed by the GDPR and Spanish law, and disputes concerning it are submitted to the courts of Madrid (Spain), without prejudice to data subjects' right to bring proceedings in the courts of their habitual residence.
Upstash (request limits and task coordination) and PostHog (product analytics) receive no data subjects' data and are therefore not listed in this Annex.