Data Processing Addendum

For customer workspace content submitted to BlackReach, the customer is generally the controller and BlackReach acts as processor. For account administration, billing, security and service improvement, BlackReach may act as controller.

BlackReach processes customer workspace data to provide the service: user management, company profile, qualification preferences, watchlists, notes, reports, procurement intelligence and related support. We will not process customer workspace data for unrelated purposes unless required by law or authorised by the customer.

Workspace data may include user names, email addresses, roles, company descriptions, target markets, commercial preferences, notes, saved searches, watchlists, generated reports and procurement-related metadata. It should not be used to store special category data unless expressly agreed.

BlackReach currently expects to use Clerk for authentication, Stripe for billing and payment processing, and Resend for transactional product email. Hosting, database and monitoring providers should be listed before production deployment.

A live subprocessors list should identify each provider, processing purpose, location and relevant safeguard before production use.

BlackReach should apply appropriate technical and organisational measures, including access controls, authentication, workspace separation, secure secret handling, backups and monitoring. Personnel or contractors with access to customer data should be bound by confidentiality obligations.

BlackReach should assist customers with reasonable data subject requests, security incidents and deletion/export requests where technically possible and legally required. At termination, customer workspace data should be deleted or returned according to the final retention policy and contract.