Last updated: 29 October 2026
This Data Processing Agreement (“DPA”) forms part of the Terms and Conditions (“Terms”) between Bighiveinnovate Technology Private Limited (“Sales Sunday”, “Processor”) and the customer that accepts the Terms (“Customer”, “Controller”). It applies when Sales Sunday processes personal data on the Customer’s behalf. If this DPA conflicts with the Terms, this DPA wins for data protection matters.
1. Definitions
- Data Protection Laws means the EU GDPR (Regulation 2016/679), the UK GDPR and Data Protection Act 2018, India’s Digital Personal Data Protection Act, 2023, and any other data protection law that applies to the processing.
- Customer Data means personal data that the Customer or its users submit to the Service, or that the Service accesses on their instructions, including through connected accounts.
- Controller, processor, data subject, personal data, processing, personal data breach and supervisory authority have the meanings given in the GDPR (and the equivalent terms under the DPDP Act, such as data fiduciary and data principal).
- Sub-processor means any third party engaged by Sales Sunday to process Customer Data.
- SCCs means the Standard Contractual Clauses approved by the European Commission in Decision 2021/914, and UK Addendum means the UK International Data Transfer Addendum.
2. Roles and scope
The Customer is the controller of Customer Data and Sales Sunday is its processor. The subject matter, nature, purpose and duration of processing, and the types of personal data and data subjects, are set out in Annex 1.
The Customer is responsible for having a lawful basis for the processing, giving data subjects the required information, obtaining any required consents, and the accuracy of Customer Data.
3. Customer instructions
Sales Sunday will process Customer Data only on the Customer’s documented instructions, which are the Terms, this DPA, and the Customer’s configuration and use of the Service. Sales Sunday will tell the Customer if it believes an instruction breaks Data Protection Laws, unless the law prohibits this. If the law requires Sales Sunday to process Customer Data otherwise, it will tell the Customer first unless the law forbids it.
4. Confidentiality
Sales Sunday ensures that everyone authorised to process Customer Data is bound by confidentiality obligations and has access only to the data needed for their role.
5. Security
Sales Sunday implements the technical and organisational measures in Annex 2 to protect Customer Data, appropriate to the risk, as required by GDPR Article 32. Sales Sunday may update these measures as long as the overall level of protection does not decrease.
6. Sub-processors
- The Customer gives general authorisation for Sales Sunday to use sub-processors. The current list is at salessunday.com/subprocessors.
- Sales Sunday will notify the Customer at least 30 days before adding or replacing a sub-processor, by updating that page and by email to customers who subscribe to updates.
- The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected part of the Service and receive a pro-rata refund of prepaid fees for it.
- Sales Sunday imposes data protection obligations on each sub-processor that are at least as protective as this DPA, and remains responsible for their performance.
7. International transfers
Customer Data is hosted in India. Some sub-processors process data in other countries, as listed on the sub-processor page.
To the extent Customer Data subject to the EU GDPR is transferred to a country without an adequacy decision, the parties agree to the SCCs, which are incorporated by reference: Module Two (controller to processor) where the Customer is a controller, and Module Three (processor to processor) where the Customer is a processor. For those SCCs: Clause 7 (docking clause) applies; Clause 9 option 2 (general authorisation) applies with the notice period in Section 6; the optional language in Clause 11 does not apply; Clauses 17 and 18 are governed by and subject to the courts of Ireland; and Annexes I and II are completed by Annexes 1 and 2 of this DPA. For data subject to the UK GDPR, the UK Addendum applies, completed in the same way.
8. Data subject requests
Sales Sunday will promptly forward to the Customer any request it receives from a data subject about Customer Data, and will not respond directly except to redirect the person to the Customer. Taking into account the nature of the processing, Sales Sunday will help the Customer respond, including through the Service’s export, correction and deletion tools.
9. Personal data breaches
Sales Sunday will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Data. The notice will describe, as far as known, the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed. Sales Sunday will provide further information as it becomes available and help the Customer meet its notification obligations.
10. Impact assessments and consultation
Sales Sunday will provide reasonable help to the Customer with data protection impact assessments and prior consultations with supervisory authorities, where required by Data Protection Laws and related to the Service.
11. Deletion and return
The Customer can export Customer Data at any time during the subscription and for 30 days after termination. Sales Sunday will then delete Customer Data within 90 days, and backups are overwritten within 35 days, unless the law requires Sales Sunday to keep it. On request, Sales Sunday will confirm deletion in writing.
12. Audits
Sales Sunday will make available the information reasonably necessary to demonstrate compliance with this DPA, including completed security questionnaires and summaries of third-party assessments. If this is not enough, or if a supervisory authority requires it, the Customer may conduct an audit, no more than once a year, with at least 30 days’ written notice, during business hours, at the Customer’s cost, under confidentiality obligations, and in a way that does not disrupt the Service or expose other customers’ data.
13. Liability and term
Each party’s liability under this DPA is subject to the limitations in the Terms, except where Data Protection Laws do not allow such limits. This DPA lasts as long as Sales Sunday processes Customer Data.
14. Contact
Bighiveinnovate Technology Private Limited
606, Mayuresh Planet, 401, Plot No. 42 and 43, Sector 15, CBD Belapur, Navi Mumbai, Maharashtra 400614, India
Email: [email protected]
Annex 1: Details of processing
| Item | Details |
|---|---|
| Parties | Data exporter / controller: the Customer. Data importer / processor: Bighiveinnovate Technology Private Limited, contact [email protected] |
| Subject matter | Providing the Sales Sunday CRM and business operating system |
| Nature of processing | Collection, storage, organisation, retrieval, analysis (including AI-assisted summaries and suggestions), transmission (including sending emails and calendar invites on the Customer’s instructions), and deletion |
| Purpose | To provide, secure and support the Service under the Terms |
| Duration | The term of the Customer’s subscription, plus the export and deletion periods in Section 11 |
| Data subjects | The Customer’s users and employees; the Customer’s leads, prospects, customers, contacts, partners and vendors |
| Categories of personal data | Names, job titles, company names, email addresses, phone numbers, postal addresses, deal and activity history, notes, call records, email and calendar content from connected accounts, and usage data |
| Special categories | None intended. The Customer should not submit special category data unless it has a lawful basis and appropriate safeguards |
| Frequency of transfer | Continuous, while the Service is used |
| Supervisory authority | The authority competent for the Customer under GDPR Article 56 or, where the Customer has no EU establishment, the authority of the Member State where its EU representative is established |
Annex 2: Technical and organisational measures
| Area | Measures |
|---|---|
| Encryption | TLS 1.2+ in transit; encryption at rest for databases, file storage and backups; OAuth tokens stored encrypted |
| Access control | Role-based access; least privilege; multi-factor authentication for staff; access reviews; prompt removal of access when staff leave |
| Tenant isolation | Customer workspaces are logically separated so one customer cannot access another’s data |
| Data minimisation | Personal identifiers removed or masked before content is sent to AI providers wherever the feature allows; only the minimum content needed is sent |
| Logging and monitoring | Security and access logs kept for 12 months; alerting on suspicious activity |
| Secure development | Code review, dependency updates, vulnerability scanning and separate staging and production environments |
| Availability and recovery | Regular encrypted backups, overwritten within 35 days; tested recovery procedures |
| Incident response | Documented process to detect, contain, investigate and notify personal data breaches within 48 hours |
| Personnel | Confidentiality obligations and data protection training for staff |
| Sub-processors | Due diligence before engagement and written data protection terms with each one |