Data Processing Agreement

Last updated: October 14, 2026

This Data Processing Agreement ("DPA") forms part of the Terms & Conditions between the Customer ("Controller") and Derrick App, a French SAS (Société par Actions Simplifiée) ("Derrick" or "Processor").

Derrick is a B2B data enrichment service available through a web application, a Google Sheets add-on, a Chrome extension, a REST API and an MCP server (together, the "Services").

1. Subject matter

This DPA governs the processing of personal data by Derrick on behalf of the Customer, in compliance with Regulation (EU) 2016/679 (the "GDPR") and applicable data protection laws.

2. Roles

  • The Customer is the sole data controller for all personal data it imports, searches, enriches, generates or exports through the Services, including data processed with AI features.
  • Derrick acts solely as data processor. It processes personal data only on the documented instructions of the Customer, which consist of the actions the Customer triggers in the Services.
  • Derrick does not decide which data is collected, about whom, for what purpose or for how long. These decisions belong to the Customer.

3. Nature and purpose of processing

  • Importing lists of people or companies from sources the Customer selects (for example a LinkedIn or Sales Navigator search run with the Customer's own account).
  • Enriching and cleaning data through Derrick's data sources and third-party providers.
  • Transforming data with language models when the Customer uses an AI feature.
  • Storing results so the Customer can view, export or push them to the tools it connects.

4. Types of personal data and data subjects

Types of personal data: names, job titles, companies, locations, professional profile URLs, email addresses, phone numbers, free-text inputs and any other data the Customer submits or requests.

Categories of data subjects: prospects, customers, contacts, candidates and other professionals whose data the Customer chooses to process.

5. Customer obligations

The Customer is responsible for:

  • having a valid legal basis for each processing it triggers, and informing data subjects where required;
  • the volume, purpose and retention of the data it collects, and its use after export;
  • handling data subject requests, with Derrick's assistance as described in section 9;
  • its use of third-party accounts connected to the Services (including LinkedIn and Sales Navigator) and its compliance with the terms of those platforms.

6. Processor obligations

  • Derrick processes personal data only to provide the Services, and never sells it.
  • Personnel with access to Customer data are bound by confidentiality.
  • Derrick informs the Customer without undue delay after becoming aware of a personal data breach affecting Customer data.
  • Derrick makes available the information reasonably necessary to demonstrate compliance with this DPA.

7. Subprocessors

The Customer authorises Derrick to use subprocessors for hosting, payment, authentication, AI and data enrichment. The main categories are: cloud hosting (Heroku, on AWS servers in Europe), payment (Stripe), authentication (Google), AI models (Anthropic, OpenAI) used only when the Customer runs an AI feature, and data enrichment providers. The current list of subprocessors is available on request at contact@derrick-app.com.

8. Security measures

  • Data in transit is encrypted with HTTPS/TLS.
  • Access to the Services requires authentication; API access requires a personal API key.
  • Access to production systems and logs is limited to authorised personnel.
  • Derrick does not manually review Customer data, except when the Customer asks for support on a specific case.

9. Data subject rights

Derrick assists the Customer, as far as reasonably possible, in answering requests for access, rectification, erasure, restriction, portability and objection. Requests can be sent to contact@derrick-app.com.

10. Retention and deletion

Customer data is kept while the Customer's account is active, so the Customer can retrieve its results. The Customer can delete its lists from the Services, or ask contact@derrick-app.com for the deletion of its data. Technical logs are kept for a limited period for debugging and security.

11. Data from third parties

Data returned by data sources and third-party providers is supplied as is. Derrick does not guarantee its accuracy or completeness, and the Customer decides whether and how to use it.

12. Liability

Each party's liability under this DPA is subject to the limitations set out in the Terms & Conditions, to the extent permitted by the GDPR.

13. Term and termination

This DPA remains in effect for as long as Derrick processes personal data on behalf of the Customer. Upon termination, Derrick deletes Customer data, or returns it on request, unless the law requires it to be kept.

14. Miscellaneous

  • This DPA is governed by French law and the GDPR.
  • Updates to this DPA are published on this page with a new "Last updated" date.