<aside> 🗓️

Last updated: June 30th, 2026

</aside>

Preamble

This Personal Data Processing Agreement (hereinafter “DPA”) is entered into between SMAB, a French limited liability company registered with the Bordeaux Trade and Companies Register under number 913 975 033, whose registered office is located at 4 rue Fernand Belliard, 33100 Bordeaux, France, operating under the brand “Vayne” (hereinafter “Vayne”), and the Client, as defined in the Terms of Service available at https://www.vayne.io.

Terms beginning with a capital letter have the same definition as given in the Terms of Service.

This DPA applies to the processing of personal data carried out by Vayne on behalf of the Client in the context of the Client’s use of the software accessible from Vayne’s website (https://www.vayne.io), the Vayne API and the Vayne MCP server (together, the “Services”).

This DPA incorporates by reference the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, which apply to international transfers of personal data as described in Article 7.

For the avoidance of doubt, Vayne processes the account, authentication and billing data of the Client and its users as a data controller; such processing is governed by Vayne’s privacy policy and falls outside the scope of this DPA.

1 — Purpose

The purpose of this DPA is to ensure that the processing of personal data carried out by Vayne on behalf of the Client complies with paragraphs 3 and 4 of Article 28 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter “GDPR”).

Vayne acts as a data processor, on behalf of the Client and on documented instructions from the Client. The Client acts either on its own behalf and for its own purposes as a data controller, or on behalf and for the purposes of its own clients as a data processor.

2 — Description of Processing Activities

The processing activities carried out by Vayne on behalf of the Client have the following characteristics:

Categories of data subjects:

• Business professionals whose information is publicly available on LinkedIn and who are prospects, leads or candidates of the Client (or of the Client’s own customers);
• The individual users of the Client who connect a LinkedIn account to theServices.

Categories of personal data processed:

• Identity and professional data extracted from public LinkedIn pages at theClient’s instruction: name, headline, current and past positions, company, education, location, profile picture URL, public LinkedIn profile URL and identifiers, public posts and public post engagement (comments, reactions);
• Professional contact data obtained through enrichment: professional email addresses and phone numbers;
• Data submitted by the Client as input to the Services: LinkedIn URLs and search criteria, email addresses submitted for reverse lookup, and names, companies and job titles submitted for contact finding;
• LinkedIn session credentials (session cookie) voluntarily provided by theClient to operate scraping on its behalf.