Data Processing Addendum
Last updated: August 2026
This Data Processing Addendum (“DPA”) forms part of the agreement between you (“Controller”) and (“Processor”) and applies where we process personal data on your behalf in providing the Service. It supplements our Terms of Service.
1. Roles
For personal data in your prospect lists, email content and campaign activity (“Customer Personal Data”), you are the Controller and we are the Processor. For account and billing data about you, we act as an independent controller as described in our Privacy Policy.
2. Scope and instructions
We process Customer Personal Data only on your documented instructions — namely to provide the Service (verification, warmup, sequence sending, reply detection and analytics) — and as required by law. We will inform you if, in our opinion, an instruction infringes applicable data-protection law.
3. Subject matter and nature of processing
- Subject matter: operation of the outreach and verification platform.
- Duration: for the term of your subscription plus any legally required retention.
- Categories of data subjects: your prospects and email recipients.
- Categories of data: business contact details (name, email, company, role), engagement and reply data.
4. Confidentiality
We ensure that personnel authorised to process Customer Personal Data are bound by confidentiality obligations.
5. Security measures
We implement appropriate technical and organisational measures, including encryption of sensitive credentials in transit and at rest, access controls, network isolation of sending infrastructure, and logging. We maintain measures proportionate to the risk of the processing.
6. Sub-processors
You authorise us to engage sub-processors (e.g. hosting, database and payment providers) to process Customer Personal Data, subject to written terms imposing protection obligations no less protective than this DPA. We will make a list available on request and give notice of intended changes so you may object on reasonable grounds.
7. Data-subject requests
Taking into account the nature of the processing, we will assist you by appropriate technical and organisational measures — including the in-app export, deletion and one-click unsubscribe/suppression features — to respond to requests to exercise data-subject rights.
8. Personal-data breach
We will notify you without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data and provide information reasonably necessary for you to meet your notification obligations.
9. Assistance and audits
We will assist you with data-protection impact assessments and prior consultations where required, and will make available information necessary to demonstrate compliance with this DPA, allowing for audits on reasonable notice and subject to confidentiality.
10. International transfers
Where we transfer Customer Personal Data internationally, we do so under an appropriate transfer mechanism such as the Standard Contractual Clauses, which are incorporated by reference where applicable.
11. Return and deletion
On termination, we will delete or return Customer Personal Data at your choice, save to the extent retention is required by law. You may export your data at any time through the Service.