Terms of Service

1. Contract and order of precedence

1.1 A subscription contract is formed when you complete a purchase through the checkout of the Salesforce AgentExchange (formerly AppExchange) under these Terms, or when both parties sign an order form. These Terms are available on the AgentExchange listing and at prospectgrid.ch/terms before you order; you can view, print and save them at any time. The person who accepts these Terms confirms that they are authorised to bind the Customer.

1.2 The contract consists of, in this order of precedence: (a) the order, meaning the AgentExchange checkout confirmation or the signed order form (the “Order”); (b) Part B; (c) Part A; (d) the Documentation, meaning the setup guide and other user documentation we provide, together with the description of the Service and of the basic setup on prospectgrid.ch as at the date of the Order.

1.3 Your own purchasing conditions or other general terms do not apply, even if we do not expressly object to them.

2. The Service

2.1 Prospect Grid is an application that you install as a managed package into your own Salesforce organisation (“org”). Your sales representatives use it to build a working grid of target accounts and contacts from your Salesforce data and from LinkedIn, and to carry out outreach steps (LinkedIn connection requests and messages, e-mails and calls) from inside Salesforce. The features are described in the Documentation and on prospectgrid.ch as at the date of the Order (together, the “Service”).

2.2 The application and your data run in your own Salesforce org. Prospect Grid does not operate application servers of its own. Two components sit outside your org: a licence service in Prospect Grid's own Salesforce org, which the package contacts once right after installation and then once a day to confirm the licence and to obtain the credentials for the messaging connection, and the messaging connection through Unipile described in section 4.3.

2.3 Upgrades to new versions of the application are included in the subscription. You install upgrades from the AgentExchange; where Salesforce permits it, Prospect Grid may also deliver an upgrade to your org directly (push upgrade) and will announce it in advance. We may change features to improve the Service, to comply with law or with requirements of Salesforce, or because a third-party service on which a feature depends changes or ends. If a change materially reduces the Service, we will inform you at least 30 days in advance, and you may terminate the affected subscription with effect from the date of the change and receive a refund of the fees you prepaid for the period after that date.

2.4 Basic setup assistance is included: we help you install the package, complete the setup in your org and connect your users' accounts, within the scope described on our implementation page. Further services such as advanced configuration or custom development require a separate written agreement.

3. Trial

3.1 Where the AgentExchange listing offers a trial, you may use Prospect Grid free of charge for the trial period stated on the listing, for evaluation only.

3.2 During the trial the Service is provided as is, without any warranty. Sections 1, 4, 8, 9, 10, 11, 12, 13, 14, 16 and 17 and Part B apply to trial use; during a trial our total liability is limited to USD 1,000. At the end of the trial the licence expires unless you order a subscription; you must then uninstall the package. Data created during the trial remains in your Salesforce org and is subject to section 14.3.

4. Prerequisites and third-party services

4.1 Salesforce. You need Salesforce Sales Cloud user licences in Enterprise, Unlimited or Performance Edition, obtained from Salesforce under your own agreement with Salesforce. Your org must have My Domain deployed and Salesforce Sites available, because the Service receives events on a Salesforce Site in your org. Before you install the package you register your Salesforce organisation ID with us, so that your org can obtain the credentials for the messaging connection. The Documentation describes these steps. Salesforce, Inc. and its affiliates (“Salesforce”) are not a party to these Terms. As between you and us, Prospect Grid alone is responsible for the Service and provides support for it under section 7; Salesforce does not provide the Service, gives no warranty for it, and has no responsibility or liability for the development, installation, operation or maintenance of Prospect Grid. Your use of the Salesforce platform remains governed by your agreement with Salesforce.

4.2 LinkedIn and mailbox accounts. Each user connects their own LinkedIn account (and Sales Navigator, where used) and their own Gmail or Microsoft 365 mailbox. These accounts belong to you or your users and remain subject to the terms of their providers, including the LinkedIn User Agreement. The LinkedIn User Agreement prohibits, among other things, using bots or other unauthorised automated methods to access LinkedIn, to add or download contacts or to send messages, and LinkedIn may restrict, suspend or terminate accounts that breach it. Prospect Grid is not affiliated with, endorsed by or connected to LinkedIn, Microsoft or Google. You decide how your users use their accounts with Prospect Grid, you are responsible for their compliance with the providers' terms, and you bear the risk of restrictions those providers impose on your users' accounts. Prospect Grid sends messages through your users' own accounts at the pace those platforms allow; you must not attempt to circumvent limits set by Prospect Grid, by Unipile or by the platforms.

4.3 Unipile. The connection to LinkedIn and to your users' mailboxes is provided through Unipile, a third-party messaging service operated by Unipile SAS, France, under an account that Prospect Grid holds for all of its customers. Unipile acts for us in providing the messaging connection; we select and instruct Unipile with care. The availability of the LinkedIn and e-mail features depends on Unipile and on the platforms it connects to. How personal data is processed in that connection is described in Part B.

4.4 Changes by third parties. If Salesforce, LinkedIn, Unipile, Google or Microsoft change their services, interfaces or terms so that a feature can no longer be provided as before, we may adapt or withdraw that feature. Section 2.3 applies; where the change is outside our control and takes effect without sufficient notice to us, we inform you as soon as we can instead of 30 days in advance, and your right to terminate the affected subscription under section 2.3 remains.

5. Subscription term, renewal and cancellation

5.1 Subscriptions are sold per named user for a term of one month or one year, as chosen in the Order. The term starts on the date of the Order or, after a trial, on the day after the trial ends. At the end of each term the subscription renews automatically for a further term of the same length unless it is cancelled before the end of the current term.

5.2 You can end the subscription under “My Installs & Subscriptions” on the AgentExchange, with effect from the end of the current term or with immediate effect, or by e-mail to support@prospectgrid.ch with effect from the end of the current term. Fees for the current term are not refunded. On the monthly plan you can therefore end the subscription at the end of any month. Where an order form states a different notice period, the order form applies.

5.3 You can add users at any time under “My Installs & Subscriptions” on the AgentExchange. Added users are available immediately, and the checkout charges the pro rata amount for them with your next billing period, at the rate stated in the Order. A reduction in the number of users takes effect at the start of the next billing period.

5.4 A user licence is assigned to one named person and may not be shared. You may reassign a licence to another person when the previous holder no longer uses the Service.

5.5 The parties agree that this contract is a licence and service contract for a fixed term, not a mandate. The Service is a standardised software product that you install and operate in your own Salesforce org; no relationship of personal trust of the kind that mandate law assumes is intended, and the rules on the termination of mandates do not fit the term the parties have chosen. If a court nevertheless holds that mandate law applies to a part of the Service, that part is severable, and the licence, its term and the fees for it remain unaffected. Setup assistance under section 2.4 is a separate service and may be ended separately without affecting the subscription.

6. Fees, payment and price changes

6.1 The fees are those stated on the AgentExchange listing or the pricing page at the time of the Order, or in the order form. At the date of this version the list price is USD 75 per user per month or USD 750 per user per year. Fees are stated in US dollars and exclude value added tax and similar taxes. Where Swiss value added tax is due on our supply to you, we charge it in addition, by separate invoice where the checkout cannot collect it. Where you are established outside Switzerland, you account for any tax due in your country under the rules that apply there. If you are required by law to withhold tax from a payment, you will increase the payment so that we receive the full fee.

6.2 Fees are payable in advance for each term. When you order through the AgentExchange checkout, you authorise the charge of the fees for each term, including renewals, to the payment method you provide. Payments are processed by Stripe; Prospect Grid does not receive your full card details. Where an order form provides for invoicing, invoices are payable within 30 days of the invoice date.

6.3 If a payment fails or an invoice is overdue, we will remind you. If the amount remains unpaid 14 days after the reminder, we may suspend access to the Service until payment is received. Statutory default interest applies to overdue amounts.

6.4 We may change the fees with at least 30 days' notice before the next renewal. The new fees apply from the renewal that follows the notice period. If you do not agree, you may cancel with effect from that renewal. Fees for a term that has already been paid do not change.

6.5 Fees are not refundable except where these Terms provide for a refund or the law requires one.

7. Support and availability

7.1 We provide support for the Service by e-mail at support@prospectgrid.ch on business days, Monday to Friday from 09:00 to 18:00 Swiss time, excluding Swiss public holidays. Unless agreed in writing in an order form or a separate support agreement, there are no guaranteed response or resolution times and no service level commitments.

7.2 Support covers the installation, configuration and use of the Service as described in the Documentation. It does not cover general Salesforce administration, custom development, data modelling or training beyond the basic setup.

7.3 We do not guarantee that the Service is available without interruption or free of errors. Its availability depends on the Salesforce platform, on Unipile and on LinkedIn, Google and Microsoft, none of which we control. We will announce planned maintenance of the licence service in advance where practicable.

8. Acceptable use

8.1 You will use the Service, and ensure that your users use it, only in compliance with these Terms and with applicable law. In particular you will:

• comply with the laws on data protection and on electronic marketing and unsolicited messages that apply in the countries where your recipients are located, including any requirement for consent, a correct sender identity and an opt-out;
• comply with the terms of LinkedIn, Google, Microsoft and Salesforce, and use only accounts that belong to you or your users, with their true identity;
• not send content that is unlawful, deceptive, defamatory or harassing, and not send malicious code;
• not process special categories of personal data (such as health, religion or political opinions) with the Service;
• not copy, modify, reverse engineer, decompile or create derivative works of the Service, except to the extent the law permits this despite this clause;
• not sell, rent, sublicense or otherwise make the Service available to third parties, and not use it to build a competing product;
• not circumvent the licence checks, usage limits or security measures of the Service.

8.2 If you or a user breach this section, or if the use of the Service creates a security risk, we may suspend access to the Service or to the affected user. We will inform you beforehand where practicable and restore access once the breach or risk has been resolved. Our right to terminate under section 14 remains unaffected.

9. Customer Data and our own processing

9.1 “Customer Data” means all data that you or your users enter into the Service or that the Service creates, retrieves or sends for you, including the records in your Salesforce org, the profile data of your prospects and the messages exchanged through your users' connected accounts. Customer Data remains yours. You grant us the right to process it only to the extent needed to provide the Service and support, as described in Part B.

9.2 You are responsible for Customer Data, in particular for having a lawful basis to process your prospects' data and to contact them, for the notices you owe them, and for the accuracy of the data.

9.3 In addition to the processing on your behalf described in Part B, Prospect Grid processes the following data for its own purposes as a controller: the contact details of your administrators and users as far as needed for the contract, support and licensing; the licence records that reach us through Salesforce when you install the package (org identifier, licence status and the details of the person who installed it), the daily licence checks (org identifier, time and result) and the order and subscription data held in the AgentExchange checkout; billing data processed through Stripe; and the correspondence we hold about your account. We process this data to perform the contract with you and on our legitimate interest in running and protecting the licensing of the Service; billing records are kept to meet our statutory accounting duties. The recipients are Salesforce, which hosts our org and operates the checkout, Google, which hosts our support mailbox, and Stripe, which processes the payments; billing data reaches Stripe, LLC in the United States, which is certified under the EU-U.S. and Swiss-U.S. Data Privacy Framework. We keep this data for the duration of the contract and thereafter as long as statutory retention periods require (ten years for accounting records under Swiss law). Data subjects may ask us for access, rectification, erasure, restriction and portability, and may object to processing based on our legitimate interest, by writing to support@prospectgrid.ch. They may also complain to the Swiss Federal Data Protection and Information Commissioner or, in the EEA, to the supervisory authority of their country. Support requests that contain personal data of your prospects are governed by Part B.

9.4 We may use licence and usage information that does not identify a person, such as the number of orgs and users, to operate and improve the Service.

10. Intellectual property

10.1 Prospect Grid and its licensors own all rights in the Service and the Documentation, including all updates. During the term we grant you a non-exclusive, non-transferable right, without the right to sublicense, to install the application in your Salesforce org and to use it for your internal business purposes with the number of users you have subscribed. No other rights are granted.

10.2 The Salesforce platform and its components remain the property of Salesforce and are licensed to you by Salesforce. Content retrieved from LinkedIn remains subject to LinkedIn's terms.

10.3 If you give us suggestions or feedback about the Service, we may use them without restriction or compensation.

10.4 We will name you as a customer, or use your logo, only with your prior consent.

11. Confidentiality

11.1 Each party will keep confidential the non-public information it receives from the other party in connection with the contract (“Confidential Information”), use it only for the purposes of the contract and disclose it only to employees, advisers and subcontractors who need to know it and are bound by confidentiality. Customer Data is your Confidential Information; the Service, its Documentation and our pricing for you are ours.

11.2 Information is not confidential if it is or becomes public without breach of this section, was already known to the receiving party, was received lawfully from a third party, or was developed independently. A party may disclose Confidential Information where the law or a court or authority requires it, after informing the other party where permitted.

11.3 This section applies during the contract and for three years after it ends, and for as long as the information remains a trade secret. For Customer Data and any personal data it applies without a time limit and is supplemented by Part B.

11.4 When the contract ends, each party returns or deletes the other party's Confidential Information on request, except for copies it must keep by law or that are held in routine backups, which stay protected by this section.

12. Warranties

12.1 We warrant that the Service performs materially as described in the Documentation when it is installed and used as intended. If it does not, we will correct the defect within a reasonable time after you report it. If we do not succeed within a reasonable time, you may terminate the affected subscription and we will refund the fees you prepaid for the period after the termination.

12.2 The figures on our website about pipeline and response rates are illustrative. They describe what the way of working behind Prospect Grid is meant to achieve; they are not a measurement, a benchmark or a promise of the results you will achieve.

12.3 We give no warranty for third-party services, in particular the Salesforce platform, Unipile, LinkedIn, Gmail and Microsoft 365, or for their availability and continued interoperability, and none for uninterrupted or error-free operation. Section 13 applies to our liability for Unipile as our subcontractor. Trial use is provided as is.

12.4 To the extent permitted by law, any further warranties are excluded.

12.5 Sections 12.3 and 12.4 do not exclude our liability for intent or gross negligence and do not apply to a defect that we have fraudulently concealed. Section 13.3 applies to this section as well.

13. Liability

13.1 The total liability of each party arising out of or in connection with the contract, whatever the legal basis, is limited to the fees paid or payable by you for the Service in the twelve months before the event giving rise to the claim. This limit does not apply to your obligation to pay the fees, to your obligations under sections 10, 11 and 13.4, or to a party's infringement of the other party's intellectual property rights.

13.2 Neither party is liable for indirect or consequential loss, loss of profit, revenue or business, loss of data, or damage to reputation. Prospect Grid is not liable for restrictions, suspensions or terminations that LinkedIn, Google, Microsoft or Salesforce impose on your accounts, nor for claims of recipients arising from your outreach.

13.3 Sections 13.1 and 13.2 do not limit liability for intent or gross negligence, liability for death or personal injury, or liability that the law does not allow to be limited. Sections 13.1 and 13.2 also apply for the benefit of our employees, agents and subcontractors, who may rely on them directly.

13.4 You will hold us harmless from claims of third parties, including recipients of your messages, platform providers and authorities, that arise from Customer Data, from the content of your users' messages, or from a use of the Service in breach of the law, these Terms or third-party terms. This does not apply to the extent the claim is caused by our breach of the contract or by our negligence. We will inform you of such a claim promptly and let you conduct the defence; we will not admit liability or settle the claim without your consent, which you will not withhold without good reason.

13.5 We will defend you against a claim of a third party that the Service infringes its intellectual property rights, and we will pay the damages finally awarded or agreed in a settlement we approve. This does not apply where the claim arises from Customer Data, from a use that does not follow the Documentation or these Terms, from a combination with products we did not provide, or from a modification not made by us. If such a claim is made or is likely, we may obtain the right for you to continue using the Service, change the Service so that it no longer infringes, or terminate the affected subscription and refund the fees you prepaid for the period after the termination. This section states our whole liability for claims of that kind.

14. Suspension and termination

14.1 Either party may terminate the contract for cause with immediate effect if the other party materially breaches it and does not remedy the breach within 30 days after a written notice, if the other party becomes insolvent, or, on our side, if fees remain unpaid 14 days after a reminder or if your use of the Service is unlawful or endangers the security of the Service, of other customers or of a platform.

14.2 Ordinary termination takes place by cancellation under section 5.

14.3 When the contract ends, your right to use the Service ends and you must uninstall the package from your org. Before you uninstall, disconnect all connected LinkedIn and mailbox accounts in the Setup Wizard, as the Documentation describes: uninstalling does not disconnect them, and after the uninstall your org no longer holds the identifiers needed to do so. Note that uninstalling a managed package removes the package's objects and the records stored in them from your org. Salesforce offers an export of the package data during the uninstall and keeps the export file for two days; export the data you want to keep. Data in your own Salesforce objects is not affected. We delete what remains for you in our Unipile account as described in Part B. Fees that fell due before the end of the contract remain payable. Sections 6.5, 9, 10, 11, 12, 13, 16 and 17 and Part B, as far as it concerns deletion and return, survive the end of the contract.

15. Changes to these Terms

15.1 We may change these Terms, including Part B. We will announce a change at least 30 days before it takes effect by e-mail to the administrator contact of your subscription and by publishing the new version, with its version number and date, at prospectgrid.ch/terms. The change applies from the first renewal after the notice period. If you do not agree, you may cancel with effect from that renewal.

15.2 Changes that are required by law, by requirements of Salesforce for applications on the AgentExchange, or for the security of the Service may take effect earlier; we will inform you as soon as we can.

16. General

16.1 Notices to Prospect Grid are to be sent to support@prospectgrid.ch or to our postal address. Notices to you are sent to the e-mail address of the administrator contact given in the Order.

16.2 Neither party may assign the contract without the other party's consent, except to an affiliate or to a successor in a merger, acquisition or sale of substantially all of its assets, with notice to the other party.

16.3 Neither party is liable for a failure to perform, other than a payment obligation, that is caused by events beyond its reasonable control, including outages of third-party platforms, for as long as the event lasts. If such an event prevents a core feature of the Service for more than 30 consecutive days, either party may terminate the affected subscription with immediate effect, and we refund the fees you prepaid for the period after the termination.

16.4 The contract documents listed in section 1.2 form the entire agreement between the parties about the Service and replace all earlier agreements about it; statements on our website that are not part of those documents are not part of the contract. If a provision is invalid, the remaining provisions remain in force and the invalid provision is replaced by a valid one that comes closest to its purpose. A waiver is only effective in writing. These Terms are written in English; the English version is binding.

16.5 Where these Terms require a notice, an agreement or a waiver to be in writing, an e-mail to the address given in section 16.1 is sufficient. The parties waive the requirement of a handwritten or qualified electronic signature.

17. Governing law and jurisdiction

17.1 The contract is governed by Swiss substantive law, excluding its conflict-of-law rules and the United Nations Convention on Contracts for the International Sale of Goods.

17.2 The courts of the Canton of Zurich, Switzerland, at the seat of Prospect Grid GmbH have exclusive jurisdiction over any dispute arising out of or in connection with the contract. Where the Commercial Court of the Canton of Zurich has jurisdiction under Swiss procedural law, that court decides. Mandatory places of jurisdiction remain reserved.

B1. Roles and scope

B1.1 The Customer is the controller of the personal data processed with the Service (or, where the Customer processes it for its own clients, a processor acting on their instructions). Prospect Grid is the Customer's processor for the processing described in Annex 1. Where the Customer acts as a processor for its own clients, Prospect Grid takes instructions from the Customer only, and the Customer warrants that its clients have authorised it to engage Prospect Grid on the terms of this DPA.

B1.2 This DPA covers the processing that Prospect Grid carries out on the Customer's behalf outside the Customer's Salesforce org: the messaging connection through Unipile and, where the Customer sends it to us, the content of support requests. The licence service in Prospect Grid's own Salesforce org, including the licence records and the daily licence checks, is Prospect Grid's own processing as a controller and is described in section 9.3 of Part A. The processing inside the Customer's Salesforce org is carried out by Salesforce as the Customer's processor under the Customer's agreement with Salesforce and is not covered by this DPA.

B2. Subject matter, duration, nature and purpose

The subject matter, duration, nature and purpose of the processing, the categories of data subjects and the categories of personal data are set out in Annex 1. The Customer's rights and obligations as controller are set out in this DPA, in particular the right to give instructions under B3, to object to sub-processors under B6, to receive assistance under B8, to be notified under B9, to have data deleted or returned under B10 and to audit under B11, and the obligation to have a lawful basis for the processing and to give its data subjects the notices it owes them under section 9.2 of Part A.

B3. Instructions

B3.1 Prospect Grid processes personal data only on the Customer's documented instructions, including with regard to transfers to other countries, unless Swiss or EU law requires otherwise; in that case Prospect Grid informs the Customer of the legal requirement before processing, unless the law prohibits this.

B3.2 The Terms of Service, the Order and this DPA are the Customer's complete instructions. The Customer also instructs Prospect Grid through the functions of the Service, for example when a user connects an account, builds a grid or triggers a message. Further instructions must be given in writing, by e-mail to support@prospectgrid.ch.

B3.3 Prospect Grid informs the Customer without delay if, in its opinion, an instruction infringes the FADP, the GDPR or other data protection law.

B4. Confidentiality and personnel

Prospect Grid ensures that every person authorised to process the personal data, including its own staff and the staff of its sub-processors, is bound by confidentiality by contract or by law, and that they process the data only on the Customer's instructions.

B5. Security

B5.1 Prospect Grid implements and maintains the technical and organisational measures described in Annex 2, so that the security of the processing is appropriate to the risk. Prospect Grid may update the measures as long as the level of protection does not decrease.

B5.2 The Customer is responsible for the security settings inside its own Salesforce org, including user permissions, sharing rules, multi-factor authentication for its users, and the configuration of the Salesforce Site and its guest user profile as set out in the Documentation, and for the security of its users' LinkedIn and mailbox accounts.

B6. Sub-processors

B6.1 The Customer authorises Prospect Grid to engage the sub-processors listed in Annex 3 for the purposes stated there.

B6.2 Prospect Grid informs the Customer of any intended addition or replacement of a sub-processor at least 30 days before the change, by e-mail to the administrator contact and by updating Annex 3 on this page. The Customer may object within that period on reasonable grounds relating to data protection. If the parties cannot resolve the objection, the Customer may terminate the affected subscription with effect from the date of the change and receives a refund of the fees prepaid for the period after that date.

B6.3 Prospect Grid imposes on each sub-processor, by written contract, data protection obligations that provide a level of protection equivalent to this DPA, and remains fully liable to the Customer for the performance of that sub-processor's obligations.

B7. International transfers

B7.1 Personal data processed under this DPA is stored in Switzerland and in the European Union as set out in Annex 1 and Annex 3, subject to B7.2. Switzerland and the member states of the European Economic Area recognise each other as providing an adequate level of data protection, so transfers between them require no additional safeguard.

B7.2 Where personal data is transferred to a country that Switzerland or the European Union has not recognised as providing an adequate level of protection, this happens only on the basis of a safeguard under Article 16 paragraph 2 FADP and, where the GDPR applies, Chapter V GDPR, in particular the EU Standard Contractual Clauses with the additions required for Switzerland. Recipients in the United States that are certified under the Swiss-U.S. and EU-U.S. Data Privacy Framework are recognised as adequate under Article 16 paragraph 1 FADP together with Annex 1 of the Swiss Data Protection Ordinance and under Article 45 GDPR. Unipile's network proxy providers, listed in Unipile's privacy policy, may route connection traffic through other countries; this is transit, the traffic is encrypted, and Unipile puts the transfer safeguards for those providers in place. Prospect Grid remains fully liable to the Customer for Unipile under B6.3.

B8. Assistance to the Customer

B8.1 Taking into account the nature of the processing, Prospect Grid assists the Customer with appropriate measures in fulfilling its obligation to respond to requests of data subjects (access, rectification, erasure, restriction, portability, objection). Most requests can be handled by the Customer directly in its Salesforce org and through the functions of the Service. If Prospect Grid receives a request from a data subject directly, it forwards the request to the Customer without delay and does not respond to the data subject itself, unless the law requires otherwise.

B8.2 Prospect Grid assists the Customer, taking into account the nature of the processing and the information available to it, in ensuring the security of the processing, in the notification of personal data breaches, in data protection impact assessments and in prior consultations with a supervisory authority.

B9. Personal data breaches and requests from authorities

B9.1 Prospect Grid notifies the Customer without undue delay after becoming aware of a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data processed under this DPA. The notification describes, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Information not yet available is provided as soon as it is. A notification is not an acknowledgement of fault or liability.

B9.2 If an authority asks Prospect Grid to disclose personal data processed under this DPA, Prospect Grid informs the Customer before disclosing, unless the law prohibits this, and refers the authority to the Customer where it can. Prospect Grid challenges a request that is unlawful or goes further than the law allows, and discloses only what it is legally required to disclose. Prospect Grid requires the same of its sub-processors.

B10. Deletion and return

B10.1 During the contract the Customer controls the personal data in its own Salesforce org and can delete it there at any time. Disconnecting a user's account in the Service removes that account from Prospect Grid's Unipile account. Do this for all users in the Setup Wizard before you uninstall the package, because the uninstall removes the records that hold the account identifiers.

B10.2 When the contract ends, the Customer may ask Prospect Grid, within 30 days of the end of the contract, to return the personal data held for it in Prospect Grid's Unipile account in a common electronic format. Prospect Grid deletes the accounts it can identify as the Customer's from its Unipile account within 30 days of the end of the contract, or within 30 days of the return where the Customer has asked for one. Under Unipile's privacy policy, the messages and authentication tokens stored for an account are deleted when the account is deleted. Support correspondence that contains personal data processed under this DPA is deleted within 90 days of the end of the contract, together with any copies. Further retention takes place only where Swiss or EU law requires it; in that case the data is kept only for as long and as far as the law requires and remains protected by this DPA. The personal data in the Customer's own Salesforce org is not affected and remains the Customer's responsibility. On request, Prospect Grid confirms the deletion in writing.

B11. Audits and information

B11.1 Prospect Grid makes available to the Customer the information necessary to demonstrate compliance with this DPA and with Article 9 FADP and Article 28 GDPR, including confirmation that the application has passed the Salesforce security review required for paid applications on the AgentExchange, the description of the measures in Annex 2 and, subject to confidentiality and to the consent of the provider concerned, the audit reports and certifications of its sub-processors (for Unipile, the SOC 2 Type II report). Prospect Grid answers reasonable written questions once per contract year.

B11.2 Where the information provided is not sufficient to demonstrate compliance, or after a personal data breach, the Customer or an independent auditor bound by confidentiality may audit the processing under this DPA. The Customer gives at least 30 days' notice, the audit takes place during business hours, no more than once per contract year unless a breach has occurred, and in a form that does not endanger the data of other customers. The Customer bears the costs of the audit unless it reveals a material breach of this DPA by Prospect Grid.

B12. Liability

Section 13 of Part A applies to liability under this DPA. Each party is responsible for its own compliance with data protection law. Nothing in this DPA limits a party's liability where the law does not permit a limitation.

B13. Term and changes

This DPA applies for as long as Prospect Grid processes personal data on the Customer's behalf. Changes to this DPA follow section 15 of Part A; changes required by data protection law may take effect earlier with notice.

B14. Contact

For all matters under this DPA, including instructions, data subject requests and breach notifications: support@prospectgrid.ch, Prospect Grid GmbH, Birmensdorferstrasse 252, 8055 Zürich, Switzerland.

Annex 1: Details of the processing

Annex 2: Technical and organisational measures

• Architecture. Customer Data stays in the Customer's Salesforce org and is protected by the Salesforce platform and the Customer's own security settings. Prospect Grid operates no application servers; outside the Customer's org, personal data is held only in the Unipile account for the messaging connection and in the support mailbox.
• Separation. Prospect Grid holds one Unipile account for all of its customers. Each user's connection is a separate account inside it; its identifiers are stored only in the org that created it, and the Service in each org reads and writes only the connections created from that org.
• Access control. Access to Prospect Grid's Salesforce org and to the Unipile account is limited to named persons at Prospect Grid and at Siempi AG who need it for operation and support. Salesforce access uses multi-factor authentication as required by Salesforce, with phishing-resistant methods on the org that runs the licence service. Credentials are held in a password manager shared only among those persons.
• Credentials. The credentials for the Unipile connection are stored in a protected setting of the package and in Prospect Grid's org, are not visible to the Customer's users, and are rotated at least once a year and whenever a person with access leaves or a compromise is suspected. The licence service issues them only to orgs that hold a valid licence.
• Encryption. All traffic between the Customer's org, the licence service, Unipile and the platforms is encrypted in transit (TLS). Unipile encrypts stored data (AES-256-GCM) and holds it in France.
• Inbound events. Events that Unipile sends to the Customer's org (replies, status changes) are authenticated with a secret that the package generates for each installation.
• Sub-processor assurance. Unipile states that it is certified SOC 2 Type II and CASA Tier II and that it acts as a data processor; it is bound by the obligations in B6.3.
• Platform review. The application has passed the Salesforce security review required for paid applications on the AgentExchange and is resubmitted as Salesforce requires.
• Development. The source code is kept in version control; changes are reviewed and pass automated tests and checks before a version is released.
• Availability. The data outside the Customer's org is held by Unipile and by Google, whose platforms provide redundancy and restore. Prospect Grid keeps the package source and the configuration of the licence service in version control, so the licence service can be rebuilt and redeployed.
• Data minimisation and deletion. Only the data needed to deliver and track the users' messages is held outside the Customer's org; it is deleted as set out in B10.
• Incident response. Security incidents are handled as set out in B9, with the sub-processors' incident procedures.
• Review. Prospect Grid reviews these measures at least once a year and after every material change to the Service, and records the result.

Annex 3: Sub-processors

Other providers (Prospect Grid as controller). The following providers do not process personal data on the Customer's behalf and are not sub-processors under B6; they process the data described in section 9.3 of Part A. Salesforce (SFDC Ireland Limited, company number 394272), Salesforce Tower, Spencer Place, Dublin 1, D01 W2Y3, Ireland: hosting of Prospect Grid's own Salesforce org, which runs the licence service and holds the licence records, in Switzerland (Salesforce Hyperforce), and operation of the AgentExchange checkout, which holds the order and subscription data. Stripe Payments Europe, Limited, One Wilton Park, Wilton Place, Dublin 2, Ireland: payment processing for subscriptions ordered through the AgentExchange checkout, under Stripe's own data processing agreement, with transfers to Stripe, LLC in the United States, which is certified under the EU-U.S. and Swiss-U.S. Data Privacy Framework.

Annex 3 as at 21 September 2026. Changes are announced under B6.2.