Data Processing Agreement

1. Subject and duration

The processor processes personal data to provide the service described in the Terms & Conditions, for as long as the contract runs and until the data is returned or deleted under section 9.

2. Instructions

The processor processes personal data only on the controller's documented instructions — the contract, this agreement and the controller's use of the platform — unless the law requires otherwise, in which case it informs the controller first where it may.

3. Confidentiality

Everyone authorised to process the data is bound to confidentiality.

4. Security

The processor takes the technical and organisational measures in Annex 2 and keeps them up to date.

5. Sub-processors

The controller authorises the sub-processors in Annex 3. The processor will give at least [30] days' notice of a new sub-processor, during which the controller may object; each sub-processor is bound to the same obligations as this agreement.

6. Data subjects' rights

The processor helps the controller answer requests from data subjects. Opt-outs are carried out by the platform itself: a person who declines or asks to be removed is suppressed across the platform.

7. Personal data breaches

The processor notifies the controller without undue delay, and within [48] hours, after becoming aware of a breach affecting the controller's data, with the information the controller needs to meet its own obligations.

8. Assistance and audits

The processor helps the controller with impact assessments and consultations, and makes available the information needed to show compliance, including audits on reasonable notice no more than once a year.

9. Return and deletion

At the end of the contract the processor returns the controller's data on request within [30] days and then deletes it, except where the law requires it to be kept, and except the opt-out records that prevent a person being contacted again.

10. International transfers

Where data is transferred outside the European Economic Area, the transfer is covered by the European Commission's Standard Contractual Clauses or another lawful mechanism [to be confirmed per sub-processor].

Annex 1 — The processing

• Data subjects: the controller's prospects and the people who reply to its e-mails; the controller's users.
• Data: name, role, company, business e-mail address and phone, public profile links and figures, e-mails sent and replies received.
• Purpose: finding business contacts, verifying addresses, writing and sending e-mails, classifying and answering replies, reporting.
• Sensitive data: none is sought or processed intentionally.

Annex 2 — Security measures

• Tenant isolation by row-level security in the database, forced for every workspace table.
• Encryption in transit; provider keys and secrets sealed with a key-management service.
• Least-privilege access, and a separate sign-in for platform administrators.
• Address verification that never sends a message; sending paused when bounce or complaint rates rise.
• Backups verified on a schedule; documented incident and recovery procedures.

Annex 3 — Sub-processors

• Amazon Web Services — hosting, database, e-mail delivery — [region].
• Stripe — payments — United States / EEA.
• Sentry — error monitoring — [region].
• OpenAI — AI language models — United States.
• Anthropic — AI language models — United States.
• DeepSeek — AI language models — China.
• Public-data providers — finding public business profiles — [names and locations].