Draft pending legal review.
Data Processing Agreement
This agreement, under Article 28 GDPR, is part of the Terms of Service between the customer (controller) and us (processor).
1. Subject and duration
We process personal data to provide Coldoutbound for as long as the customer's account exists.
2. Nature, purpose and data
Purpose: sending the customer's email sequences from the customer's mailboxes, receiving and matching replies, bounces and unsubscribes, recording visits from the customer's email links where the customer puts the visit tag on their website, and the CRM integrations the customer turns on.
Data subjects: the customer's recipients and leads, the people who write to the connected mailboxes, and the customer's users.
Data: names, email addresses, company, job title, phone and other fields the customer uploads; email content and metadata; visit records (the link's code, page, page title, time and user agent); mailbox credentials.
3. Our obligations
We process only on the customer's documented instructions (these terms and their use of the service); keep the data confidential; apply appropriate technical and organizational measures (encryption of credentials and data in transit, access control, backups, abuse monitoring); assist with data-subject requests and impact assessments; notify personal data breaches without undue delay; and delete or return the data when the account closes.
We make available the information needed to show compliance and allow reasonable audits, at the customer's cost and with reasonable notice.
4. Subprocessors
The customer authorizes the subprocessors listed on the Subprocessors page. We will announce additions or replacements at least 14 days ahead; the customer may object and, if we can't address the objection, close the account.
5. Transfers
The service is hosted in the EU. Where a subprocessor is outside the EEA, transfers rely on an adequacy decision or the EU Standard Contractual Clauses.
6. Aggregated data
The customer instructs and authorizes us to derive company-level and aggregated statistics from the processing as described in section 5 of the Terms. Once derived they contain no personal data and are ours to use.