Data processing statement

Depending on the service, we process:

• CRM records and properties, such as contacts, companies, deals, notes and custom objects
• files your team uploads, such as event attendee lists, webinar reports and system exports
• exports, API responses or webhook data from systems such as HubSpot, Microsoft, Google and ZoomInfo
• details of your users, such as names, email addresses, roles and approvals

This usually covers your customers, prospects, partners and staff. Please don’t send special category data unless we’ve agreed in writing how it will be handled.

• HubSpot connections use HubSpot OAuth with the permissions you approve. Portal admins can disconnect furball at any time.
• File uploads are made by users you’ve given access to. furball keeps the original file unchanged and works on a prepared copy.
• Exports, API calls and webhooks are only set up on your explicit instruction.

We process your data only to deliver the services you ask for, including to:

• prepare, format, validate and import lists and files into HubSpot
• audit data quality, completeness and adoption across your CRM
• identify, review and merge duplicate records
• standardise and enrich values such as phone numbers, locations, job titles and industries
• match records across systems before or during an integration
• provide support and resolve issues you report
• analyse data with enterprise AI services where this is part of the service and enabled

In furball Data Ingestion Studio, preparing a file never writes to HubSpot. Imports start only after a user confirms them, and restricted users need an approver first.

We process personal data only on your documented instructions, including for any international transfer, unless the law requires otherwise. Your settings in furball, your agreement with us and your written requests form those instructions. You remain responsible for the legal basis for processing. If we believe an instruction breaks data protection law, we’ll tell you immediately.

Only people who need access to deliver the service can reach your data. Everyone at Cat Media who processes personal data is bound by confidentiality and trained in data protection and security.

In line with Article 32 of the GDPR, we apply technical and organisational measures that include:

• encryption in transit with TLS and at rest with AES
• single sign-on with Microsoft Entra ID, multi-factor authentication and least-privilege access
• per-portal roles and approvals in furball, enforced on the server
• secrets held in Azure Key Vault rather than in code
• pseudonymisation or anonymisation where it’s practical
• monitoring, regular reviews of our controls and a documented incident response procedure

Read more on our security page.

We use a small number of trusted subprocessors, under contracts that protect your data to the same standard as this statement:

• Microsoft: Azure hosting, Azure Key Vault and Azure OpenAI for furball; Microsoft 365 for managed-service files.
• HubSpot: Cat Media's CRM, used to manage service requests and project communications.
• OpenAI and Anthropic: Enterprise AI services, used in managed data-quality work only where agreed with you.

None of these providers may use your data to train their AI models. We’ll tell you before adding or replacing a subprocessor, so you can object. Details of each provider’s safeguards are available on request.

furball runs on Microsoft Azure. Files for managed services are stored temporarily in encrypted SharePoint. We prefer to process data in the EU, the EEA or the UK. Any transfer outside these regions relies on an adequacy decision or the Standard Contractual Clauses under Article 46 of the GDPR.

We keep your data only for as long as the service needs it, or as agreed with you. When the service ends, we delete or return your data, as you choose. Backups are deleted as they expire. Disconnecting a HubSpot portal stops furball’s access to it, and we can confirm deletion in writing on request.

We’ll help you meet your obligations as controller, including by:

• passing on any request we receive from a data subject and helping you respond
• notifying you without undue delay after we become aware of a personal data breach
• supporting data protection impact assessments and consultations with regulators
• providing the information needed to demonstrate compliance and allowing reasonable audits

Contact our data protection team at legal@catmedia.ie or write to Cat Media Ltd, The Academy Building, Park West Business Park, Dublin 12, D12 FF83, Ireland. For personal data that Cat Media controls, read our privacy policy or use our data privacy request form.

Our lead supervisory authority is the Data Protection Commission in Ireland.