Data Processing Agreement (DPA)

2. Controller and Processor Obligations

2.1 Instructions: Processor shall process Customer Personal Data only on documented instructions from Controller, including with respect to transfers of personal data to a third country, unless required to do so by applicable law.

2.2 Lawful Basis & Compliance: Controller warrants and represents that it has established a valid lawful basis (e.g., legitimate interest or opt-in consent under GDPR, CAN-SPAM compliance) for all prospect records uploaded to the Service, and that all required privacy notices have been provided to data subjects.

2.3 Confidentiality: Processor shall ensure that persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

3. Technical and Organizational Measures (TOMs)

Processor implements and maintains industry-standard technical and organizational security measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access:

• Encryption in Transit: Industry-standard TLS 1.3 cryptographic protocols with strict HTTP Strict Transport Security (HSTS) across all public endpoints and API integrations.
• Encryption at Rest: AES-256-GCM symmetric authenticated encryption for all stored SMTP passwords, Microsoft Graph API tokens, and Meta access credentials.
• Session Isolation: Scoped HttpOnly, Secure browser session cookies with cryptographic CSRF token validation on state-changing API requests.
• Ephemeral Execution: Credential decryption occurs only transiently in volatile execution memory during active campaign dispatch and is immediately purged upon socket completion.
• Access Controls & Confidentiality: Principle of least privilege, multi-factor authentication for infrastructure management, and regular security audit logging.

4. Subprocessors

4.1 Authorized Subprocessors: Controller grants general written authorization to Processor to engage third-party subprocessors to assist in providing the Service. An up-to-date directory of authorized subprocessors is publicly maintained at /subprocessors.

4.2 Prior Notice of Changes: Processor shall provide Controller with at least thirty (30) days prior notice of any intended appointment of new subprocessors via email or dashboard notification, allowing Controller the opportunity to object on reasonable data protection grounds.

4.3 Subprocessor Flow-Down: Processor shall impose data protection obligations on subprocessors that are no less protective than those stipulated in this DPA.

5. Data Subject Requests & Breach Notifications

5.1 Data Subject Rights Assistance: Taking into account the nature of the processing, Processor shall provide technical tools (including the suppression list manager and the Privacy Rights Portal) to assist Controller in fulfilling its statutory obligations to respond to data subject requests under GDPR, CCPA, and DPDP.

5.2 Security Incident Notification: Processor shall notify Controller without undue delay, and in any event within seventy-two (72) hours, upon becoming aware of a confirmed Personal Data Breach impacting Customer Personal Data. Such notification shall describe the nature of the breach, affected categories of records, and remediation steps taken.

6. Data Deletion and Return

6.1 Upon Termination: Upon termination of the Service or Controller's written request, Processor shall, at Controller's choice, delete or return all Customer Personal Data, and delete existing copies unless applicable law requires continued storage.

6.2 Suppression Lists: Controller acknowledges that email addresses added to global suppression lists (unsubscribes) are retained in hashed or encrypted format solely to enforce permanent opt-outs and prevent unlawful re-contact.

7. International Data Transfers

Where the processing of Customer Personal Data involves transfers out of the European Economic Area, the United Kingdom, or Switzerland to countries without an adequate level of data protection, the parties agree that the European Commission's Standard Contractual Clauses (SCCs) (Module 2: Controller-to-Processor) are hereby incorporated by reference into this DPA.