1. Scope and roles
This agreement forms part of the AgentsVerify Terms between you and Navor Sàrl, Switzerland. It applies when we process personal data you submit for verification on your behalf. You act as controller, or as a processor authorised by your controller; we act as processor or subprocessor accordingly. Applicable Swiss data-protection law and EU or UK data-protection law apply to the extent each governs the processing.
We determine the purposes of processing account, payment, fraud-prevention and necessary business-administration information separately, as explained in our Privacy information. This agreement does not change a provider’s independent responsibilities for its own regulated services.
2. Your instructions
Your use of the dashboard and API, these Terms and this agreement document your instructions to receive inputs, carry out verification checks, return results, maintain the history you choose to keep and perform requested cancellation or deletion.
You must have the rights, authority and lawful basis needed to submit the data and give these instructions. Submit only information needed for your verification workflow. Do not include unrelated sensitive or special-category information. You remain responsible for deciding which addresses to verify, responding to the people whose data you submit and complying with the laws applicable to your sending activity.
We process submitted personal data for these instructed purposes and to maintain the security of the service. We will inform you if an instruction appears to breach applicable data-protection law, unless the law prohibits doing so. Instructions outside the supported service require a separate agreement.
3. Confidentiality and security
Access is limited to authorised people and service providers who need it for their role and are subject to confidentiality obligations. We use measures appropriate to the processing risks, including authenticated access, workspace-level authorisation, private database networking, encrypted application connections, access-controlled object storage, controlled worker credentials and recoverable operations.
Security measures include software maintenance, operational monitoring, bounded worker storage, content cleanup and deletion safeguards during restoration. We may improve these measures while maintaining an appropriate level of protection. The service’s technical controls and your own account and API-key security work together.
4. Service providers
You give general authorisation for the service providers described in our provider and processing-location list to carry out the stated functions. We impose applicable data-protection obligations on processors we engage and remain responsible for our obligations concerning their processing.
We will give advance notice of additions or replacements affecting the processing of customer verification data, at least 14 days before the change, with an opportunity to object on substantiated data-protection grounds. We will consider a reasonable alternative. If no suitable arrangement is available, the affected processing or service may be discontinued under the Terms. Mandatory rights remain applicable.
5. International transfers
Processing locations are described in the provider list. Where a transfer needs additional safeguards, the applicable arrangements must provide a recognised transfer mechanism, such as the relevant standard contractual clauses and Swiss or UK provisions, or an applicable adequacy decision covering the recipient and processing.
Where required for a transfer between you and us, the European Commission’s standard contractual clauses, Decision (EU) 2021/914, are incorporated into this agreement. Module Two applies when you are controller; Module Three applies when you act as processor. Clause 7 applies; the optional dispute-resolution wording in Clause 11 does not. Clause 9 uses general authorisation and the 14-day notice in section 4. Under Clauses 17 and 18, Irish law and courts apply, subject to the clauses’ mandatory protections. The competent EU supervisory authority is determined under Clause 13 from your establishment, representative or affected individuals.
For transfers governed by Swiss law, references cover the Swiss Federal Act on Data Protection; the FDPIC is the competent Swiss authority, Swiss law and courts apply to Swiss-only transfers, and people in Switzerland can exercise the clauses’ protected rights. These adaptations do not reduce any protection owed under the GDPR.
For UK restricted transfers, the ICO’s approved UK Addendum, version B.1.0, is incorporated in full, with its mandatory provisions and updates under section 18. Its tables are completed as follows: Table 1 identifies you from your account as exporter and Navor Sàrl as importer, with the account and Terms contacts and the agreement’s acceptance date; Table 2 selects the clauses, modules and options above; Table 3 uses the annex information below; Table 4 selects neither party for the special right to end the Addendum following an approved revision. The Addendum’s mandatory provisions prevail.
For the clauses’ annexes, Annex I.A uses those parties, contacts, roles and acceptance date; Annex I.B uses the processing details in section 9, with ongoing transfers as you use the service and no intended special-category data; Annex I.C uses the competent authority above. Annex II comprises section 3’s security measures, workspace authorisation, encrypted transport and cloud storage, scoped service credentials, recovery controls and scheduled cleanup. Annex III uses the authorised processors in section 4 and the linked provider list for the relevant functions. Mandatory transfer terms prevail over conflicting commercial terms.
6. Rights and incidents
The dashboard and API provide routine download, cancellation and deletion controls. You are responsible for handling requests concerning the data you submit. Where those controls are insufficient, we provide the assistance required by applicable law, taking account of the nature of processing and the information available to us. We may verify the request and the requester’s authority before disclosing or changing data.
We will notify you without undue delay after becoming aware of a personal-data breach affecting data processed on your behalf, and provide information reasonably available to help you meet your obligations. You remain responsible for your notifications to affected people or authorities unless the law requires us to act directly.
We provide assistance required for applicable security, impact-assessment and supervisory-consultation obligations. Additional work beyond the standard self-service controls may be subject to reasonable agreed charges where the law permits.
7. Return and deletion
You can download results and delete finished verifications through the dashboard or API. Account deletion revokes access and starts removal of your profile and verification history, including the associated worker content. Unfinished work is cancelled and required settlement is completed before its data is purged.
Recovery copies expire under the retention schedule in our Privacy information. Deletion instructions are retained separately so they can be reapplied before restored data becomes accessible. Until recovery copies expire, they remain access-controlled and are not used for ordinary service processing.
Required billing and legal records, and necessary non-content security and recovery identifiers, are handled separately. Any legally required continued retention is limited to its required purpose and duration.
8. Compliance information
We make available information reasonably needed to demonstrate compliance with this agreement. Reviews should use relevant documentation and existing independent assurance information first. Where a further audit is required by applicable law, its scope, timing, confidentiality and safeguards must be agreed in advance, except where a competent authority requires otherwise.
A review must protect other customers’ data, credentials and the service’s security and availability. Mandatory audit rights are preserved. Contact for legally required data-protection matters: support@agentsverify.dev.
9. Processing details
Subject and purpose: email verification, delivery of results and the customer-controlled workspace history.
Operations: collection, validation, domain and recipient checks, recording, organisation, storage, retrieval, export, cancellation and deletion.
Data: submitted email addresses, customer-selected CSV columns, verification results and necessary job and operational metadata.
People: individuals whose information the customer submits, including contacts, prospects, customers or subscribers.
Duration: while providing the instructed service and maintaining the history you keep, followed by the deletion and recovery periods described above.
Instructions and contact: the supported dashboard and API controls, and the account contact details maintained by the customer. Navor Sàrl’s identity and legal contact details appear in the Terms.