3693 CardsBack to home

Customer Data Processing Agreement

Version customer-dpa-2026-10-29 · Published 29 October 2026

When accepted in the applicable capacity, this agreement binds SINCE3693 Limited, 2 Frederick Street, Kings Cross, London, WC1X 0ND, United Kingdom (“3693 Cards”), and the Individual customer or Team organisation identified in its acceptance record (“Customer”). It applies only when 3693 Cards processes personal data on Customer's documented instructions for the services in Schedule 1. It forms part of the Customer Terms. It does not assign 3693 Cards' independent account, billing, security, support, legal or independently determined analytics purposes to Customer. The parties' actual roles under data-protection law govern if a label in this agreement is inconsistent with a particular processing activity.

Only the Team owner may accept for an organisation. An Individual accepts for their own customer-directed processing. A guest publisher accepts only for the temporary profile they publish; that acceptance does not bind a later account or Team. The accepted text, schedules, actor and capacity must be identifiable for any version. This agreement takes precedence over the Customer Terms for a conflict about the processing it covers; mandatory law prevails over both.

Customer controls the lawful purpose, basis, notices, access and retention instructions for its published profiles, visitor enquiries, network contacts, AI conversations, leads and bookings. Using the configured features, assigning Team access, requesting an export or deletion, and sending a written instruction to [email protected] are documented instructions to process the Schedule 1 data for the service. We will process it only on such instructions, including international-transfer instructions, unless applicable law requires otherwise. Where law permits, we will tell Customer before legally required processing. We will inform Customer if an instruction appears to infringe data-protection law and may pause that instruction while it is assessed.

Customer must have authority to supply data about others, provide required information and respond to their rights requests, use collection and marketing features lawfully, and keep access limited. Customer reviews at least yearly whether each lead, booking, network contact and linked conversation remains necessary for its legitimate business purpose, and instructs earlier deletion when appropriate. This is Customer's review duty, not a claim that the service performs an automatic yearly review. Customer will not treat contact submission as consent to unrelated analytics or marketing. These duties do not remove our own legal obligations.

We will allow access to Schedule 1 data only by personnel or contractors who need it for an authorised service, support, security or legal purpose and are bound to confidentiality unless law already imposes that duty. We will use measures appropriate to the risk, including authenticated account and Team permissions; restricted staff and privileged access; transport protection; controlled storage of Calendar credentials; private media access controls; logging, backup and incident procedures; and access review. We will assess and update those measures as the service and risks change without materially reducing overall protection. Customer must secure its accounts, manage Team permissions and tell us promptly about a suspected compromise affecting its data.

Customer gives general written authorisation for the initial subprocessors identified in Schedule 2, subject to the conditions below. We will use a written arrangement imposing data-protection duties equivalent to those in this agreement on a subprocessor and remain responsible to Customer for its performance of those duties. We will give advance written notice of an intended addition or replacement, identifying its service and relevant location or transfer change, and a meaningful opportunity to object on data-protection grounds before use. Customer may object by contacting [email protected]; we will discuss an alternative or permit termination of the affected future service if no workable alternative exists, without removing mandatory rights or amounts already due for delivered service.

A provider that independently controls a payment account, Google account, Calendar or Wallet function is not made our subprocessor for every activity merely because its API is used. Schedule 2 identifies the initial subprocessors for the customer-directed activities in Schedule 1. Other recipients and our own controller processing are described in the Privacy Policy.

Taking account of the processing and information available to us, we will assist Customer with access, correction, portability, objection, restriction and deletion requests. Customer may use available exports and settings and send a documented request to [email protected] for records or actions not covered by those tools. We will verify the requester's authority, coordinate where another controller is responsible, and explain a lawful exception or practical limitation. We will not disclose another customer's records. We will also provide reasonable information and assistance for Customer's security assessment, breach notices, data-protection impact assessment or prior consultation where required by law.

We will notify Customer without undue delay after becoming aware of a personal-data breach affecting Schedule 1 data and provide information reasonably available to support its assessment and response. We may update that information as an investigation develops. Each party remains responsible for its own statutory decisions and notices. Customer should report suspected incidents to [email protected]; we will identify an operational owner and use a restricted case record for follow-up.

We will not make a restricted transfer of Schedule 1 data without an applicable lawful transfer route and any required supplementary assessment or measure. This may be an adequacy decision covering the receiving organisation and data, or the appropriate EU standard contractual clauses and UK addendum or international data transfer agreement, as applicable. We will make information about the route and relevant safeguards available to Customer on request. A storage-region choice does not mean that every support, network or subprocessor operation occurs in that region. Customer's own onward export or sharing instructions remain its responsibility, while we remain responsible for transfers we make as processor.

At the end of the covered service, Customer may request return of Schedule 1 data through available exports or a documented support request, or instruct deletion. We will delete or return the data and delete existing copies unless applicable law requires storage, subject to the operational handling of backups and provider copies. We will not use a retained copy for a new purpose. We will explain the records and reasons for a justified exception, including invoices or audit records we hold for a separate lawful purpose. If a backup is restored, we will keep the restored environment restricted while checking recorded erasure requests before making it available for ordinary use. This requires a controlled manual review and may delay recovery. Immediate deletion from every backup or provider is not promised.

A customer's lead, booking, network contact or linked conversation is retained only while necessary for its purpose, subject to earlier authorised deletion and lawful exceptions. If a conversation's final lead or booking link is removed, the linked conversation is included in the deletion instruction unless another link or justified exception applies. Customer can request coordinated handling through support. We do not promise automatic deletion of these records on a fixed schedule.

We will make information reasonably necessary to demonstrate our Article 28 duties available to Customer and allow and contribute to audits by Customer or its independent auditor. We may first provide relevant records or independent reports where sufficient. The parties will coordinate reasonable timing, confidentiality, scope and security so an audit does not expose other customers' data or disrupt the service unnecessarily. This does not restrict a regulator's lawful powers or Customer's statutory rights. We will address substantiated deficiencies. The parties may agree reasonable assistance costs for work beyond ordinary evidence provision, without charging for a statutory right merely because it is exercised.

Subject matter and duration: hosting, publishing and managing Customer-selected profiles, media, visitor interactions, contacts, leads, AI conversations and bookings while the relevant service is used, followed by return, deletion or justified retention under section 7. No unspecified permanent retention is authorised.

Nature and purpose: collect, store, organise, display to authorised Customer users or public profile viewers as configured, transmit to authorised providers, generate requested AI replies or assessments, scan business cards, check selected Calendar availability, create requested bookings, export and delete on authorised instruction. Customer determines the purposes of its publication, visitor follow-up, Team operation and retention. We determine our own account, billing, security, support and independently controlled analytics purposes separately.

People and data: Customer representatives and Team members; public-profile visitors; people represented on profiles or in uploads; contacts, leads and booking attendees. Data can include names, roles, business and contact details, portraits, profile and portfolio content, uploaded media and business cards, messages and AI outputs, booking time/timezone/attendees and Calendar event references. Free text may contain sensitive information even though the service is not designed to request special-category data. Customer should not deliberately submit such data without a lawful need and appropriate measures.

Customer rights and duties: instruct and monitor processing, choose authorised users, provide lawful notices and bases, review retention and respond to individuals. Our duties: sections 2–8 of this agreement and applicable law. This schedule does not make all visitor analytics Customer-directed processing.

The following providers support the customer-directed functions in Schedule 1.

Render Services, Inc. — application and PostgreSQL hosting, service logs and recovery copies. The hosted service handles profile, media-reference, contact, lead, conversation, booking and Team records. Production database and services are configured in Frankfurt; support and subprocessors may access data elsewhere. Render's online Terms incorporate its DPA for personal data. That DPA provides EU standard contractual clauses and a UK addendum or applicable adequacy route for restricted transfers. Render lists subprocessor changes through its trust-page notice subscription. Frankfurt hosting does not restrict all access to the EU.

Cloudflare, Inc. — edge routing and R2 object storage. Edge routing handles request and traffic metadata, and R2 stores selected uploaded media. The relevant R2 bucket uses EU jurisdiction; global edge and support processing may take place elsewhere. Cloudflare's Customer DPA is incorporated into its self-serve service agreement and provides EU standard contractual clauses and the UK addendum for restricted transfers. It publishes intended subprocessor changes at least 30 days in advance through its subprocessor list; customers may object under the DPA process.

Plus Five Five, Inc. (Resend) — transactional email. When an email is sent, Resend receives the recipient address, message subject and content, delivery metadata and links. Resend stores customer email and log data in the United States; our Tokyo sending region does not change that storage location. Its standard online DPA provides EU standard contractual clauses and a UK addendum for restricted transfers and at least 14 days' written notice of subprocessor additions or replacements. Under our current plan, email and log data are retained for 30 days while the account is active, with seven-day backups.

OpenAI OpCo, LLC and OpenAI Ireland Ltd., as applicable under the OpenAI Services Agreement — requested AI responses, assessments and business-card extraction. The API receives limited profile context, submitted conversation and lead details, or a card image needed for the selected function. Our API project has no regional-residency restriction and uses standard retention. The application requests that Responses not be stored as application state, but standard abuse-monitoring logs may still be retained for up to 30 days, subject to the provider's stated exceptions. OpenAI's Services Agreement incorporates its DPA for personal data; the DPA describes EEA/Swiss processing through OpenAI Ireland Ltd., EU standard contractual clauses or adequacy for relevant onward transfers, and EU clauses with a UK addendum for UK data. This schedule makes no EU-only or zero-retention commitment. OpenAI publishes subprocessor-change notices under its DPA.

Google and Apple user-authorised account, Calendar and Wallet services are described in the Privacy Policy. Their role depends on the function and is not classified wholesale as a subprocessor here. The measures for Schedule 1 processing include authenticated owner and Team permissions, restricted staff access, transport protection, private-media access controls, Calendar-token protection, controlled provider credentials, service logging, recovery copies and incident handling. Customer may request current subprocessor and transfer information at [email protected].