Contact+ List of Processors

This English version is a translation; the Slovak version is binding.

Introduction

The Contact+ service (https://app.plus.contact) is provided by RESINOS & GO UP SYSTEMS INC., 228 Park Ave S #86399, New York, NY 10003, USA, EIN 981914999, NYBE ID 265604920 (hereinafter "we"). Contact: e-⁠mail quick@plus.contact, telephone +421 910 468 787. Our representative in the Union under Article 27 of Regulation (EU) 2016/⁠679 (GDPR) (nariadenie (EÚ) 2016/⁠679) and our legal representative under Article 13 of Regulation (EU) 2022/⁠2065 (DSA) (nariadenie (EÚ) 2022/⁠2065) is ERIOS, s.r.o., IČO 29789770, Rybná 716/⁠24, Staré Město, 110 00 Praha 1, Czech Republic; documents for it may also be sent to quick@plus.contact.

This list states to whom we pass personal data when we provide the service. It has two roles. For your company's data, that is contacts, e-⁠mails, replies, videos and other data that we process in the service on your instruction, it is the list of sub-⁠processors under clause 2.15 of the Personal Data Processing Agreement (Zmluva o spracúvaní osobných údajov), which is Annex 2 to the Terms and Conditions (https://plus.contact/en/podmienky). For data about which we decide ourselves, for example user accounts, registration and payments, it is the list of recipients under the Privacy Policy (Zásady ochrany osobných údajov) (https://plus.contact/en/ochrana-udajov).

The service database with its backups and the companies' files are on our server in a data centre in the Netherlands. For each processor we state what it does, what data it receives, where it processes the data and what the transfer outside the European Economic Area (EEA) is based on.

The list has four parts:

• A — processors we always use;
• B — processors we use only when you use a feature in your company that needs them, or when the feature is switched on;
• C — providers with whom you have your own contract and to whom you give us access by connecting your account or mailbox to the service; they are not our processors;
• D — services that do not receive the data of your contacts.

We will notify company owners by e-⁠mail of the addition or replacement of a processor in parts A and B at least 30 days before we start passing data to it. You may object to the change and, if the objection is not accommodated, terminate the agreement free of charge under clause 2.16 of the Processing Agreement.

A — Processors we always use

Hostinger — the service's server

• Company: HOSTINGER INTERNATIONAL LIMITED, 61 Lordou Vironos str., 6023 Larnaca, Cyprus.
• Place of processing: data centre in the Netherlands (EU).
• What it does: operates the virtual server on which the service, its database, the companies' files and the database backups run. A backup outside this server is not yet switched on.
• What data: all data stored in the service, both the companies' data and ours.
• Transfer safeguard: the data are in the EU; no transfer outside the EEA takes place.

Google Workspace — our mail

• Company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; if our account is kept with a billing address in Europe, Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland.
• Place of processing: Google data centres in the EU and outside it, in particular in the USA.
• What it does: sends the service's system e-⁠mails from an address in the plus.contact domain: invitations, registration verification, password reset, order confirmations, notices of company deletion and of advertising, and alerts from the service. It also delivers to us enquiries from the Enterprise form on the website. It also keeps our mailbox quick@plus.contact, in which the e-⁠mails you send us and our replies are stored.
• What data: the user's name and e-⁠mail and the content of the system e-⁠mail, for example the name of the company, campaign, video or post. We do not send your company's contact data in system e-⁠mails; campaign e-⁠mails and reply alerts go out from your own mailbox (part C). The mailbox quick@plus.contact holds what you send us by e-⁠mail, for example a request to erase a person from your contacts.
• Transfer safeguard: Google LLC is certified under the EU–⁠US Data Privacy Framework (rámec EÚ – USA pre ochranu údajov) (Commission Implementing Decision (EU) 2023/⁠1795) (vykonávacie rozhodnutie Komisie (EÚ) 2023/⁠1795); Google's data processing terms also contain the standard contractual clauses (Commission Implementing Decision (EU) 2021/⁠914) (vykonávacie rozhodnutie Komisie (EÚ) 2021/⁠914).

GitHub — code management and server maintenance

• Company: GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA.
• Place of processing: USA.
• What it does: stores the service's source code and runs and records server maintenance operations, for example deployment of a new version, checking the state of the service and listing the server logs. It automatically deletes maintenance outputs after the period set in our account, at the latest after 400 days.
• What data: maintenance outputs, which may contain for example campaign names, e-⁠mail addresses of users or contacts and error reports. We do not send the service database or its backups to GitHub.
• Transfer safeguard: GitHub, Inc. is certified under the EU–⁠US Data Privacy Framework (Commission Implementing Decision (EU) 2023/⁠1795); GitHub's data processing agreement also contains the standard contractual clauses (Commission Implementing Decision (EU) 2021/⁠914).

Anthropic — assistant for service maintenance

• Company: Anthropic, PBC, San Francisco, California, USA.
• Place of processing: USA.
• What it does: our authorised staff use the Claude assistant when maintaining the service and resolving errors; it reads the server maintenance outputs (see GitHub) and helps evaluate them.
• What data: server maintenance outputs, which may contain for example campaign names, e-⁠mail addresses and error reports.
• Transfer safeguard: standard contractual clauses (Commission Implementing Decision (EU) 2021/⁠914), which form part of Anthropic's data processing agreement.

B — Processors we use only when you use the feature

Anthropic — artificial intelligence

• Company: Anthropic, PBC, San Francisco, California, USA.
• Place of processing: USA.
• When: when you use AI text suggestions, a suggested reply to a received message or voice control in your company.
• What it does: writes drafts of e-⁠mails, posts, advertisements and video scripts, suggests a reply to a received message and understands voice commands. When drafting posts it searches the web.
• What data: the prompt and texts, the company description and brand profile; for a suggested reply, the text of the received message, its subject and the name of the sender's company; for voice control, the transcript of the command and lists from your company, including the names and companies of the senders of the last 20 replies and their subjects.
• Transfer safeguard: standard contractual clauses (Commission Implementing Decision (EU) 2021/⁠914), which form part of Anthropic's data processing agreement.

Argil — videos with an avatar

• Company: Argil, Inc., a company incorporated in the State of Delaware, USA.
• Place of processing: Amazon Web Services and Google Cloud infrastructure. Argil does not state the country of processing, so we assume a transfer to the USA.
• When: when you create a character, a voice or a video with an avatar.
• What it does: creates a character (avatar) from a photo and a voice clone from a recording, and makes a video with them according to a script. For the voice it uses a model by ElevenLabs.
• What data: a photo of the face, the voice recording, which Argil downloads from a temporary address with a random name, and video scripts; we receive the finished videos back. All companies use our single account at Argil; only our database knows which company a character or voice belongs to. Your browser loads character previews and voice samples directly from Argil's addresses, so Argil sees the IP address of your connection.
• Retention: the service does not itself delete characters and voices created in the service and the videos made with them, including scripts, at Argil, even when you remove them in the service. We will delete them there at your request sent to quick@plus.contact within 30 days, and within 30 days after the deletion of the company even without a request. Characters and voices that the company did not create in the service but received from our account at Argil are not deleted there after the deletion of the company. Nor do we delete there, after the deletion of the company, characters and voices created by the company that at the time of its deletion are still used in the service by another company or by us (for example as the default character or voice in the service settings).
• Transfer safeguard: standard contractual clauses (Commission Implementing Decision (EU) 2021/⁠914) in our data processing agreement with Argil.

ElevenLabs — narration voice

• Company: Eleven Labs Inc., 169 Madison Ave #2484, New York, NY 10016, USA.
• Place of processing: USA.
• When: when you have a narration read for a video by one of the preset voices.
• What it does: reads the narration text in a preset voice. We do not create the voices of your people directly in ElevenLabs; the voice clone is created at Argil.
• What data: the narration text, at most 2,500 characters.
• Transfer safeguard: standard contractual clauses (Commission Implementing Decision (EU) 2021/⁠914), which form part of ElevenLabs' data processing agreement.

Groq — speech transcription and video texts

• Company: Groq, Inc., Mountain View, California, USA.
• Place of processing: USA.
• When: when you transcribe speech in a video or have texts for a video written; for voice control, when transcription in the browser is not available.
• What it does: transcribes speech in videos and voice commands and writes texts for videos.
• What data: the audio of the video or voice command and the video texts. We do not store the audio of voice commands.
• Transfer safeguard: standard contractual clauses (Commission Implementing Decision (EU) 2021/⁠914), which form part of Groq's data processing agreement.

Google Gemini — editing the character photo

• Company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
• Place of processing: Google data centres in the EU and outside it, in particular in the USA.
• When: when you choose a new style for a character.
• What it does: edits the photo of the face into the chosen style.
• What data: the photo of the face. We send it with a setting by which we ask Google not to store it.
• Transfer safeguard: Google LLC is certified under the EU–⁠US Data Privacy Framework (Commission Implementing Decision (EU) 2023/⁠1795); Google's data processing terms also contain the standard contractual clauses.

Stripe — payments

• Company: Stripe, Inc., 354 Oyster Point Boulevard, South San Francisco, CA 94080, USA; for accounts kept in the EEA, Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Dublin 2, Ireland.
• Place of processing: USA, EU and other countries in which Stripe operates.
• When: only when paying for a paid plan or an add-⁠on purchase. As long as we do not sell paid plans and add-⁠on purchases online, Stripe does not receive data from us.
• What it does: payment gateway, subscriptions and invoices. For payments it is at the same time an independent controller under its own policies.
• What data: the company name and the e-⁠mail of the person ordering. You enter the billing address, VAT ID and payment card details directly on Stripe's payment page; the card details do not reach us. Stripe does not receive your company's contact data.
• Transfer safeguard: Stripe, Inc. is certified under the EU–⁠US Data Privacy Framework (Commission Implementing Decision (EU) 2023/⁠1795); Stripe's data processing agreement also contains the standard contractual clauses.

C — Providers to whom you pass the data yourself

These providers are not our processors. You have your own contract with them and you give us access to them by connecting your account or mailbox to the service. Their position towards you is determined by your contract with them and their terms: the provider of your e-⁠mail mailbox is as a rule your processor, while Google, Meta and LinkedIn are, under their own terms, independent controllers for most of the processing. In their services we act only on your instruction and only with what you have confirmed in the service. You can cancel the connection in the service or directly with the provider. Each of them ensures transfers of data outside the EEA within its own group under its own terms.

Google — Google Ads, YouTube and sign-⁠in with Google

• Company: for advertisers and users in the EEA, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; otherwise Google LLC, USA.
• What happens: when we make advertising available in the service, you connect your Google Ads advertising account to our manager account. The service builds the campaign in it and launches it only after confirmation by a person from your company, and then reads its results. It uploads videos for advertisements via Google Ads to YouTube as unlisted, available only via a link, to a channel managed by Google. You pay for advertising directly to Google. If sign-⁠in with Google is switched on and you use it, Google confirms your e-⁠mail address to us.
• What data: the texts, images and videos of the advertisement, including the people who appear in the videos, the budget and the campaign settings. We do not send contact lists to Google Ads.

Meta — Facebook and Instagram

• Company: for users in the EU, Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland.
• What happens: you connect your Facebook page and Instagram account and the service publishes posts on your instruction. When we make advertising available in the service, you also connect an advertising account; the service then builds the advertisement and launches it only after confirmation by a person from your company, reads its results and takes over leads from the forms of your advertisements. You pay for advertising directly to Meta.
• What data: the texts, images and videos of posts and advertisements. When we make advertising available in the service, data from the forms of your advertisements (name, e-⁠mail, telephone and other answers) also come to us from Meta. We store access tokens encrypted.

LinkedIn

• Company: for users in the EU, LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.
• What happens: you connect your LinkedIn account and the service publishes posts on your instruction.
• What data: the texts, images and videos of posts. We store the access token encrypted.

Your e-⁠mail provider

• Company: the provider of the mailbox you choose, for example your company's Google Workspace or Microsoft 365.
• What happens: campaign e-⁠mails and individual e-⁠mails go out from your mailbox (SMTP). The service reads replies from it (IMAP); it neither deletes nor moves messages in it, and marks as read only the non-⁠delivery notices for its own e-⁠mails that it has itself processed. It sends reply alerts from your mailbox to your company's administrator.
• What data: the e-⁠mails to your recipients and their replies. We store mailbox passwords encrypted.

D — Services that do not receive the data of your contacts

• Pexels, Pixabay, Freesound and Jamendo — stock photo libraries and libraries of sounds and music. When searching, they receive only the search terms, and the files you use are downloaded from them by our server. If you use the Video Editor, your browser loads the previews of footage search results directly from the servers of Pexels, Pixabay and Vimeo and plays music and sound samples directly from the servers of Jamendo and Freesound, so these services see the IP address of your connection. The image servers of Pexels and Pixabay may in doing so store technical cookies of the Cloudflare service (for example __cf_bm and _cfuvid) in your browser, unless you block third-party cookies; details are at https://plus.contact/en/cookies.
• Fonts and face detection in the Video Editor — the fonts you use in the Video Editor are loaded from our server. Face detection for automatic framing and background removal (MediaPipe) runs directly in your browser; its usage reporting to Google is blocked and nothing is sent to Google.
• Speech recognition in the browser — dictation and voice control first use your browser's speech recognition. The browser may send the audio to its manufacturer (for example Chrome to Google) under its terms; it is not our processor.
• Cloudflare (Cloudflare, Inc., USA) — translates the names of our domains to the server address (DNS). The service's traffic does not go through Cloudflare and it does not receive data from the service.
• Let's Encrypt (Internet Security Research Group, USA) — issues certificates for the encrypted connection (HTTPS) and receives only the names of our domains.