Data processing terms

These terms form part of the terms between you, the creator, and Pull Up (“Pull Up”). They apply to the personal data of your fans that Pull Up processes for you. For that data you are the controller (GDPR, UK GDPR) or responsible party (POPIA), and Pull Up is your processor or operator.

Pull Up is a controller in its own right, not your processor, for your account data, Discover city follows, and security and anti-fraud data (see the privacy policy).

• Data subjects: people who vote in, RSVP to or ask for updates about your votes and events.
• Personal data: email addresses and WhatsApp numbers, first names, cities, votes, consent records, verification and RSVP status, message delivery events (delivered, opened, clicked, bounced), notes you add, and daily-salted IP hashes.
• Purpose: running your votes, showing results, verifying votes, preventing fraud, and sending the messages you send to fans who opted in.
• Duration: for as long as you use Pull Up, then until deletion as described below.

• Process fan data only on your documented instructions: these terms and what you do in the product (for example sending a message).
• Make sure everyone with access is bound to confidentiality.
• Apply the security measures below and keep them up to date.
• Help you answer fans' requests (access, correction, deletion) and with impact assessments where needed.
• Tell you without undue delay, and within 72 hours of becoming aware, about a breach affecting your fans' data, with what we know and what we're doing.
• Give you the information needed to show compliance, and allow reasonable audits (normally by sharing reports and answering questionnaires).

You confirm you have a lawful basis for your instructions, that you'll only message fans on the channels they opted into and about what they agreed to, and that you'll handle fans' requests and the data you export (CSV) with the same care.

• Encryption in transit (TLS) everywhere; encryption at rest by our infrastructure providers.
• Row-level access rules on every table: a creator can only ever read their own fans.
• Secret keys only on the server; signed cookies; every input validated.
• No raw IP addresses stored: only hashes salted with a value that changes daily.
• Bot protection and rate limits on public forms; vote-flood detection that holds suspicious votes.
• Global suppression of addresses that bounce, complain or opt out of everything.

You authorise Pull Up to use the sub-processors below. Each is bound by data protection terms at least as protective as these. We'll give at least 30 days' notice by email before adding or replacing one, and you may object; if we can't resolve it, you can close your account.

Fan data is stored in the United States. Where data leaves the EU, UK or South Africa, transfers rely on the European Commission's Standard Contractual Clauses (with the UK addendum) in our sub-processors' agreements, and on POPIA's conditions for cross-border transfers. These terms incorporate those clauses where they're needed between you and us.

Fans you delete, and fans who use “Delete my data”, are removed straight away. Addresses that asked to stop all Pull Up email stay on a bare suppression list so that choice keeps working. Fans who neither verified nor opted in are deleted 90 days after the vote closes. When you delete your account, your fans, votes and messages are deleted; backups roll off within 30 days.

Data protection questions and breach contacts: privacy@pullupnext.com.