Legal
KingMinos DPA annex
This is version 1.0 of the KingMinos DPA annex, effective 22 October 2026. View the current version.
Version: 1.0 · Last updated: 22 October 2026 Contact: privacy@outboundsync.com
This annex is the KingMinos data-processing addendum. It covers every person lookup a customer runs — house-key and BYOK — and other personal data the customer submits. It forms part of the KingMinos Service Terms.
KingMinos keeps no database of people. Each Result is a real-time lookup made on the customer’s instructions, so OutboundSync acts as the customer’s processor for it. Account, billing, and support data about the customer and its Members are outside this annex; OutboundSync is the controller for those (see the Privacy Policy).
This annex applies to every KingMinos customer, including self-service customers who buy credits without an Order Form.
Where this annex is silent, the OutboundSync Data Processing Agreement applies to the extent it does not conflict. If they conflict about KingMinos Customer Personal Data, this annex wins.
1. Scope and roles
Customer Personal Data means (a) personal data in a request the customer sends to KingMinos and (b) personal data in a Result returned for that request, whether a vendor hop used OutboundSync’s vendor account (house-key) or the customer’s own key (BYOK).
OutboundSync, Inc. is the processor (and a service provider / contractor under US state privacy laws) for Customer Personal Data. The customer is the controller, or a processor for its own customer.
OutboundSync processes Customer Personal Data only on the customer’s instructions: to run the requested KingMinos endpoints, to bill credits, to prevent abuse, and to meet the law. We do not use Customer Personal Data for our own enrichment products, and we do not serve it to another customer.
2. Details of processing
| Item | Detail |
|---|---|
| Subject matter | Running KingMinos requests the customer submits: real-time lookups with house-key vendors, BYOK vendors, and the open web |
| Duration | The KingMinos account, then deletion or return as in section 6 |
| Nature | Receive inputs, route the lookup to vendors and public sources (house-key vendors we select, or BYOK vendors the customer chose), return a Result, cache it for that customer’s Workspace only, bill credits |
| Purpose | Provide the Service |
| Types of personal data | Whatever the customer submits and whatever the vendors return. Typical fields: name, email, LinkedIn URL, job title, employer, phone numbers. Customers must not submit the sensitive categories banned by the Acceptable Use Policy. |
| Data subjects | People the customer looks up; members whose identifiers appear in a request |
| Special categories | Not intended. Customer must not submit them. |
3. Subprocessors
The customer authorizes the subprocessors on the subprocessor list. Those are infrastructure services and house-key vendors, and they apply to every customer.
A BYOK vendor is not OutboundSync’s subprocessor. The customer engages that vendor directly, under the customer’s own contract, and instructs us to send a request to it with the customer’s key. That vendor is the customer’s own processor (or subprocessor), and the customer’s contract with it governs. It is not on our list, and our notice-of-change duty below does not cover it.
We will post a change to that list and give reasonable notice before a new infrastructure subprocessor starts processing Customer Personal Data (at least 10 days, by email or in-app). If the customer objects on reasonable data-protection grounds within 30 days and we cannot offer a workable alternative, the customer may cancel the affected KingMinos service.
4. Caching
House-key Results are cached for the requesting customer’s Workspace only, for up to 30 days depending on the endpoint, so a repeat lookup in that Workspace is fast and free. They are never served to another customer.
BYOK results are never cached. We do not write them to the per-workspace result cache. A later request with a BYOK hop calls the vendor again.
Raw vendor payloads for a BYOK hop follow the same 30-day raw-retention rule as other raw responses, then are deleted.
Company logos derived from a domain may still be stored as public company branding, including a logo fetched with the customer’s own key, and may be served to other customers. That store holds a logo image, not a person record.
5. Security and requests
We apply the same hosting and access controls described in the Privacy Policy (cloud hosting, database, and object storage; TLS; scrubbed error logs; limited production access). Staff who can see Customer Personal Data are under a confidentiality duty.
If we become aware of a security incident affecting Customer Personal Data, we will notify the customer without undue delay and no later than 72 hours after we become aware, with the facts we have.
If a person or a regulator contacts us about Customer Personal Data, we will pass the request to the customer where the law lets us, and we will help the customer respond. We will not answer for the customer unless the law requires it. When a person asks us to delete their data, object, or opt out, we delete what we still hold about them in every Workspace, add them to a suppression list so KingMinos declines later lookups of them for any customer, and tell each customer that held a Result.
The customer is responsible for notices and consents to the people it looks up, and for what it does with a result.
6. Deletion or return at end of service
When the KingMinos service for a workspace ends, we will delete Customer Personal Data we still hold (cached Results expire within 30 days in any case), or return it if the customer asks in writing, within 30 days. We may keep copies the law requires (including the credit ledger) and isolated backups until they expire. BYOK results were never in the result cache; any leftover raw objects expire under the 30-day rule.
7. Transfers
We process in the United States.
If an EU or UK customer signs up, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module 2 controller-to-processor, or Module 3 processor-to-processor if the customer is itself a processor) and the UK International Data Transfer Addendum apply by reference to Customer Personal Data transferred to us, with OutboundSync as data importer. We do not attach a filled SCC pack unless that customer asks. Swiss transfers follow the same clauses with the usual Swiss adjustments.
8. Changes
We may update this annex as section 22 of the KingMinos Service Terms describes: email notice to the account address before a material change takes effect, and continued use after that is acceptance. A change will not lower the protection of Customer Personal Data below what this annex and the law require.
9. Contact
OutboundSync, Inc., 131 Continental Dr, Suite 305, Newark, DE 19713-4324, USA.