Enrow is designed to comply with the GDPR and the CCPA. Its Data Processing Agreement (DPA) applies automatically when you accept Enrow's Terms, that is, when you create your account: you don't need to sign anything. You can read the DPA and download it as a PDF at enrow.io/en/legal/dpa.
This article is a summary. The official documents are the Terms, the Privacy Policy and the DPA.
Who is responsible for what
The data you send to Enrow (the names, companies and emails in your searches and files): you are the data controller, and Enrow is your data processor under Article 28 of the GDPR. The DPA sets the rules for this.
The data Enrow uses to find and verify contacts: Enrow is an independent data controller.
The results you use (the emails and phone numbers you get): you are the data controller. You decide how you use them, and you are responsible for that use.
Enrow's legal basis is legitimate interest (Article 6(1)(f) of the GDPR). Its Legitimate Interest Assessment (LIA) is available on request from Enrow's Data Protection Officer (DPO) at [email protected].
Which laws are covered
Enrow's documents cover:
the GDPR and the French Data Protection Act (European Union);
the UK GDPR and the Data Protection Act 2018 (United Kingdom);
the Swiss Federal Act on Data Protection (nFADP);
the CCPA, as amended by the CPRA (California).
In other countries, you are responsible for checking the local rules on data protection, direct marketing and telemarketing. Don't use Enrow where local law doesn't allow it.
California (CCPA): Enrow acts as a "service provider" for the data it processes on your behalf. Enrow doesn't sell or share the information you give when you sign up. California residents can ask to know, delete or correct their data, or opt out, with the Claim form or by email to [email protected].
Get the DPA
Read or download it: go to enrow.io/en/legal/dpa (the DPA link at the bottom of every page of enrow.io), then click Download PDF.
No signature needed: the DPA takes effect when you accept the Terms, and stays in force as long as you use Enrow.
Need a countersigned copy? Write to [email protected].
Want Enrow to sign your own DPA or master agreement (MSA)? This is only possible as part of a custom contract. See Custom plans for high volumes.
Where your data is stored and who processes it
Hosting: all data is hosted in the European Union, on Amazon Web Services (AWS) servers in Paris.
Sub-processors: the list is in section 6 of the Privacy Policy (hosting, payments, emails, support…). The few that are based in the United States are covered by the EU-US Data Privacy Framework and by standard contractual clauses.
Data providers: Enrow also works with specialist providers of professional data. Their names are a trade secret. Enrow gives the list on written request to [email protected], after you sign a non-disclosure agreement (NDA).
Changes: Enrow tells you about any new or replaced provider at least 15 days in advance. You can object in writing within 15 days.
Data breach: if a breach affects your data, Enrow informs you within 72 hours.
Audit: you can ask for one audit a year, with 30 days' notice, at your cost. Enrow may send you recent security documents instead. See Security and certifications: is Enrow SOC 2 certified?
How long Enrow keeps your data
Your searches, files and results are deleted 3 months after you make them, whether you used the app, the Chrome extension or the API. Lists are not deleted automatically. Download what you want to keep: see How to find, download and delete your past searches.
Your obligations when you prospect
When you contact people with data from Enrow, you must:
have a valid legal basis, such as legitimate interest, and document your assessment;
tell the people you contact where you got their data, why you contact them and how they can object (GDPR Articles 13 and 14);
use the data for B2B prospecting only: never for consumer marketing, and never to feed advertising or retargeting audiences;
check do-not-call lists (Bloctel in France, and their equivalents in other countries) before you call a mobile number;
respect opt-outs, and never send sensitive data (health, religion, political opinions…) to Enrow.
If a prospect asks how to be removed from Enrow, send them to How to request the deletion of your personal data.