Data Rights Notice

Purpose of this notice. This notice explains the rights you have under the GDPR in relation to personal data processed in connection with ManyPI, who must answer a request to exercise them, and how to make one. It supplements the Privacy Policy, which contains the information required by Articles 13 and 14 GDPR for the processing for which we are the controller.

Terms used. "ManyPI", "we", "us" and "our" mean ManyPI, Ole Nepomuk Mai, whose details are set out in clause 8.1. "Customer" means a business that uses the Service under the Terms of Service. "Service", "Workspace" and "User" have the meanings given in §2 of the Terms of Service.

Where we are the controller. We are the controller of:

1. (a)
   the account, billing and usage data of Customers and of their Users;
2. (b)
   data about visitors to our website and about people who contact us, including prospective customers;
3. (c)
   data we process for our own marketing; and
4. (d)
   the two shared operational caches described in §4.

Payment providers. For new purchases, Stripe and its affiliate Sold through Link, LLC process data relating to checkout, payment, fraud prevention and tax as independent controllers, as described in §10 of the Privacy Policy. You may exercise your rights in respect of the data they hold directly against them.

Where we are a processor. Where a Customer uses the Service to research, store or contact you, or otherwise to process your personal data, the Customer is the controller and we process the data on its behalf under the Data Processing Agreement (Article 28 GDPR). We may process that data only on the Customer's documented instructions. Your rights in respect of it are directed against the Customer. §3 explains how we assist you and what we do directly.

Both roles. If clauses 1.3 and 1.5 both apply to you, for example because you use ManyPI and have also been contacted by a Customer, each applies to the data it concerns.

Application. This section applies to personal data for which we are the controller under clause 1.3. Each right applies subject to the conditions and exceptions set out in the GDPR and, where applicable, in §§ 34 and 35 BDSG.

Access (Article 15 GDPR). You may obtain confirmation as to whether we process personal data concerning you and, where we do, a copy of that data together with the information listed in Article 15(1) and (2) GDPR, including the purposes of the processing, the categories of data, the recipients, the storage period or the criteria used to determine it, the source of any data not collected from you, and the safeguards for any transfer to a third country. The copy must not adversely affect the rights and freedoms of others (Article 15(4) GDPR).

Rectification (Article 16 GDPR). You may require us to correct inaccurate personal data concerning you without undue delay and, taking into account the purposes of the processing, to complete incomplete data, including by means of a supplementary statement.

Erasure (Article 17 GDPR). You may require us to erase personal data concerning you without undue delay where one of the grounds in Article 17(1) GDPR applies, in particular where:

1. (a)
   the data is no longer necessary for the purposes for which it was collected or otherwise processed;
2. (b)
   you withdraw the consent on which the processing is based and there is no other legal ground for it;
3. (c)
   you object under clause 2.10 and there are no overriding legitimate grounds for the processing, or you object to direct marketing under clause 2.11; or
4. (d)
   the data has been processed unlawfully.

Restriction of processing (Article 18 GDPR). You may require us to restrict processing where:

1. (a)
   you contest the accuracy of the data, for a period enabling us to verify its accuracy;
2. (b)
   the processing is unlawful and you oppose erasure and request restriction instead;
3. (c)
   we no longer need the data for the purposes of the processing, but you require it for the establishment, exercise or defence of legal claims; or
4. (d)
   you have objected under clause 2.10, pending verification of whether our legitimate grounds override yours.

Data portability (Article 20 GDPR). Where we process personal data that you have provided to us on the basis of your consent or of a contract with you, and the processing is carried out by automated means, you may receive that data in a structured, commonly used and machine-readable format and transmit it to another controller. Where technically feasible, you may require us to transmit it directly to another controller.

Withdrawal of consent (Article 7(3) GDPR). Where processing is based on your consent, for example analytics on our website and in the app, or marketing emails you have opted in to receive, you may withdraw that consent at any time with effect for the future. Withdrawing consent is as easy as giving it. Withdrawal does not affect the lawfulness of processing carried out on the basis of the consent before its withdrawal.

Automated individual decisions (Article 22 GDPR). You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. We do not make such decisions.

Notification of recipients (Article 19 GDPR). We communicate any rectification, erasure or restriction carried out under clauses 2.3 to 2.5 to each recipient to whom the data has been disclosed, unless this proves impossible or involves disproportionate effort. On request, we tell you who those recipients are.

Objection on grounds relating to your particular situation. You have the right to object at any time, on grounds relating to your particular situation, to processing of personal data concerning you that is based on our legitimate interests under Article 6(1)(f) GDPR, including profiling based on that provision. The processing for which we rely on legitimate interests is identified in §3 of the Privacy Policy. If you object, we will no longer process the data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.

Objection to direct marketing. Where we process personal data concerning you for direct marketing, you have the right to object at any time to that processing, including profiling to the extent that it is related to direct marketing. You do not need to give reasons. If you object, we will no longer process your personal data for direct marketing.

How to object. You may object by email to privacy@manypi.com. You may also object to marketing emails by using the unsubscribe link in any of them, or by changing your marketing preferences in the notification settings of the app.

Channels. You may exercise your rights:

1. (a)
   in the app, where the settings provide data export and account deletion and the notification settings contain your marketing preferences;
2. (b)
   for analytics consent, through the "Cookie settings" link in the footer of our website; or
3. (c)
   in every case, by email to privacy@manypi.com or by post to the address in clause 8.1.

Time limits (Article 12(3) and (4) GDPR). We provide information on the action taken on your request without undue delay and in any event within one month of receiving it. We may extend that period by two further months where necessary, taking into account the complexity and number of requests. If we do, we will inform you of the extension, together with the reasons for the delay, within one month of receiving your request. If we do not take action on your request, we will inform you without delay, and at the latest within one month of receiving it, of the reasons and of your right to lodge a complaint with a supervisory authority and to seek a judicial remedy (§7). Where you make a request by electronic means, we provide the information by electronic means where possible, unless you ask otherwise.

Charges (Article 12(5) GDPR). We do not charge for acting on a request. Where a request is manifestly unfounded or excessive, in particular because of its repetitive character, we may either charge a reasonable fee that takes into account the administrative costs or refuse to act on it, and we bear the burden of demonstrating that the request is manifestly unfounded or excessive. For any further copy requested under clause 2.2, we may charge a reasonable fee based on administrative costs (Article 15(3) GDPR).

Verification of identity (Article 12(6) GDPR). Where we have reasonable doubts about the identity of the person making a request, we may ask for the additional information necessary to confirm it. We use that information only for that purpose.

Who is responsible. If you received a message sent through the Service, or a Customer holds your details in its Workspace, it was that Customer that decided to collect your data and to contact you. The data usually consists of business contact details: your name, job title, employer and work email address, and sometimes a telephone number or a link to a professional profile. For that processing the Customer is the controller and we are its processor (Article 28 GDPR). We did not decide to contact you, and we do not use that data for our own purposes.

Exercising your rights against the Customer. Your rights under Articles 15 to 22 GDPR in respect of that data are directed against the Customer. You may exercise them by replying to the message you received or by any other means the Customer provides. §3 of the Acceptable Use Policy requires every message sent through the Service to identify the sender, to have a monitored reply address and to contain a functioning means of objecting to further messages.

Unsubscribe link. Where the message contains an unsubscribe link generated by the Service, using it adds your address to the suppression list of the Customer's Workspace, which blocks further outreach to that address through the Service from that Workspace.

Requests sent to us. As processor, we may not decide on your request ourselves, and we act on the Customer's records only on the Customer's instructions. If you send your request to us, or if the Customer does not respond to it, write to privacy@manypi.com and include the message you received, with its full headers if possible, so that we can identify the Workspace concerned. We will then:

1. (a)
   identify the Customer whose Workspace sent the message, to the extent the information you provide allows;
2. (b)
   forward your request to that Customer without undue delay;
3. (c)
   inform you which Customer is responsible, so that you can pursue your request against it directly;
4. (d)
   remind the Customer of its obligations as controller under the GDPR, the Data Processing Agreement and the Acceptable Use Policy; and
5. (e)
   follow up with the Customer if it does not deal with your request.

Stopping further contact. If you ask us to stop further contact from a Customer, we add your address to the suppression list of that Customer's Workspace and inform the Customer. We do so under a standing instruction that every Customer gives us in §7 of the Data Processing Agreement, so this step does not depend on the Customer's response. The suppression list keeps your address for the sole purpose of blocking it.

Limits of suppression. Suppression applies to the Workspace concerned. We do not operate a suppression list covering all Customers, so a request concerning one Workspace has no effect on the Workspaces of other Customers. If you have received messages from more than one Customer, send us an example from each and we will deal with each in the same way. Suppression blocks further outreach through the Service. It does not delete the Customer's records about you and does not cover messages the Customer sends by other means. Requests for access, erasure or any other right remain for the Customer to answer, and clause 3.4 applies to them.

Source of your data. Contact details in a Customer's Workspace are either imported by the Customer or found through the research functions of the Service, which retrieve publicly accessible sources, most often a company's own website and public professional directories and profiles. The Customer must tell you the source of your data under Article 14(2)(f) GDPR and, on request, provide any available information about it under Article 15(1)(g) GDPR. If the Customer does not do so, clause 3.4 applies.

Our own caches. The two operational caches described in §4 are an exception. For them we are the controller, and you may exercise your rights against us directly, without involving any Customer.

Customers who do not comply. A Customer that fails to deal with your request may be in breach of the Acceptable Use Policy as well as of the GDPR. You may report this to abuse@manypi.com. We will investigate the report and may take measures under §10 of the Acceptable Use Policy. Your right to complain to a supervisory authority about the Customer is unaffected (clause 7.7).

Our role. We maintain two operational caches that are shared across Customers. For them we are an independent controller, not a processor. They may contain personal data about people who do not use the Service. They are described in full in §8 of the Privacy Policy and §13 of the Data Processing Agreement.

Contents. The caches hold:

1. (a)
   company contact details, keyed by website domain: email addresses, telephone numbers, named roles and links to social profiles, as published by the company on its own website; and
2. (b)
   email deliverability results, keyed by email address: whether a mailbox was found to exist, the reason for that result and the response code of the receiving mail server.

Purpose and legal basis. We use the caches to avoid retrieving the same website and querying the same mail server repeatedly. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in operating the Service efficiently, and the legitimate interest of the operators of the systems we would otherwise query repeatedly, in avoiding redundant requests. We have carried out and documented a balancing of those interests against yours.

Safeguards. The following safeguards apply:

1. (a)
   entries are not used, and are deleted automatically, thirty (30) days after they were last checked; some kinds of result are used for a shorter period;
2. (b)
   no Customer account can read the deliverability cache, so that its contents cannot be browsed or searched, and a Customer receives only the result for an address it has itself submitted for verification;
3. (c)
   neither cache records which Customer or user requested a lookup;
4. (d)
   neither cache is used to build profiles of individuals; and
5. (e)
   entries in the company contact details cache are returned to a Customer whose research concerns that domain, in place of retrieving the website again, and neither cache is otherwise disclosed, sold or licensed.

Your rights. In respect of the caches you have the rights described in §2, including the right to object under clause 2.10. To obtain access to your entries, to have them rectified or erased, or to object, write to privacy@manypi.com. We deal with these requests ourselves, without involving any Customer. Data that has already been copied into a Customer's Workspace is held by that Customer as controller, and §3 applies to it.

AI features. The Service includes features based on artificial intelligence, namely the assistant, the research agent and the drafting and classification features. We identify them as such at the point of use.

Data transmitted to our AI provider. OpenAI is our only AI provider and processes data on our behalf. Depending on the feature used, we transmit to it:

1. (a)
   instructions entered by the Customer's Users;
2. (b)
   contact records supplied as context for drafting a message;
3. (c)
   excerpts of replies received, of up to about 1,200 characters, to classify their sentiment and intent;
4. (d)
   the contents of files uploaded for analysis; and
5. (e)
   excerpts of web pages retrieved during research.

No training. We do not use personal data processed through the Service to train, fine-tune or improve any AI model. Our contract with OpenAI prohibits it from using data submitted through its API to train its models.

Scoring is not an automated decision. The Service scores and ranks contacts so that a Customer's Users can decide whom to approach first. The decision remains with them. The scoring does not produce legal effects concerning you or similarly significantly affect you, and is therefore not a decision within the meaning of Article 22 GDPR. §8 of the Terms of Service prohibits Customers from using the Service to make, or materially to inform, decisions of that kind.

Inaccurate information. AI-generated content may be inaccurate. If a message you received contained inaccurate information about you or your company:

1. (a)
   where the information is held in a Customer's Workspace, your right to rectification is directed against the Customer, and §3 applies; and
2. (b)
   where it comes from one of our caches, we will rectify or erase the entry on request under clause 4.5.

Locations in the EEA. Our primary database, authentication and file storage are located in the European Union (Supabase, EU region). Background processing, email verification and the research gateway run on servers in Germany and Finland (Hetzner Online GmbH). Our product analytics project is hosted by PostHog in Germany (PostHog Cloud EU, Frankfurt); PostHog, Inc. is a US company, and access from outside the EEA may occur. These locations do not mean that every service provider processes data only in the EEA.

Transfers to third countries. Some functions use providers established outside the EEA, in particular for AI inference, website hosting and content delivery, payment processing and the delivery of our own service email (United States) and for web data collection (Israel). Personal data is transferred to them only to the extent necessary for the function they perform.

Safeguards. For those transfers we rely on:

1. (a)
   for Israel, the adequacy decision of the European Commission under Article 45 GDPR (Commission Decision 2011/61/EU); and
2. (b)
   for providers in the United States, the EU-US Data Privacy Framework where the provider is certified under it (Commission Implementing Decision (EU) 2023/1795) and, in addition, the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) contained in the provider's data processing terms.

Further information. Each provider, its role, its location and the safeguard relied on are listed in §1 of the Sub-processor List. Data locations and transfers are described in §11 of the Privacy Policy. You may request a copy of the safeguards for a specific transfer at privacy@manypi.com.

Data processed for Customers. The same locations and safeguards apply to data we process on a Customer's behalf, as set out in §11 of the Data Processing Agreement.

Contacting us. You may raise any concern about how we have handled your data or your request at privacy@manypi.com. You do not need to contact us before exercising the rights in this section.

Complaint to a supervisory authority (Article 77 GDPR). You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. The supervisory authority competent for us is:

Judicial remedy against a supervisory authority (Article 78 GDPR). You have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning you, and where the competent supervisory authority does not handle your complaint or does not inform you within three months of the progress or outcome of your complaint.

Judicial remedy against a controller or processor (Article 79 GDPR). Without prejudice to clauses 7.2 and 7.3, you have the right to an effective judicial remedy where you consider that your rights under the GDPR have been infringed as a result of processing that does not comply with the GDPR. Proceedings against us may be brought before the courts of Germany, where we are established, or before the courts of the Member State where you have your habitual residence.

Compensation (Article 82 GDPR). If you have suffered material or non-material damage as a result of an infringement of the GDPR, you have the right to receive compensation from the controller or processor responsible, under the conditions of Article 82 GDPR.

Representation (Article 80 GDPR). You may mandate a not-for-profit body, organisation or association that meets the requirements of Article 80(1) GDPR to lodge a complaint on your behalf, to exercise the rights in clauses 7.2 to 7.4 on your behalf and, where the law of the Member State concerned provides for it, to exercise the right to compensation on your behalf.

Complaints about a Customer. Where your complaint concerns processing by a Customer rather than by us, the rights in this section are exercised against that Customer as controller. You may lodge the complaint with any supervisory authority competent under clause 7.2; it need not be the authority competent for us. We will tell you which Customer is responsible under clause 3.4, so that you can name it in your complaint.

Controller. The controller for the processing described in §2 and §4 is:

Contact details. You can reach us as follows:

1. •
   Data protection enquiries and requests to exercise your rights: privacy@manypi.com
2. •
   Legal and contractual enquiries: legal@manypi.com
3. •
   Abuse reports: abuse@manypi.com
4. •
   Security reports: security@manypi.com
5. •
   Telephone: +49 30 3977 0918

Data protection officer. On our assessment, the conditions of Article 37(1) GDPR and § 38 BDSG for the designation of a data protection officer are not met, and we have therefore not designated one. If those conditions come to be met, we will designate a data protection officer, publish the contact details in this notice and communicate them to the supervisory authority. Data protection matters are the responsibility of the owner, Ole Nepomuk Mai, at the address in clause 8.1.