Data Processing Agreement

Processing details

• Subject matter: email and phone verification, duplicate removal.
• Duration: the service term plus 30 days.
• Data categories: contact information (email, phone, name, company).
• Data subjects: the end contacts on your lists.

Processor obligations

• Process only on your documented instructions.
• Ensure personnel confidentiality.
• Implement appropriate technical and organizational security.
• Maintain and disclose a sub-processor list.
• Assist with data-subject requests and breach handling.
• Delete or return personal data after termination.

Security measures

• AES-256 encryption at rest, TLS 1.3 in transit.
• Least-privilege access controls and audit logging.
• Automatic deletion of raw uploads within 24 hours.

Breach notification

We will notify you without undue delay (and within 72 hours where feasible) after becoming aware of a personal-data breach affecting your data, including the nature, likely consequences and measures taken.

Audit and sub-processors

You may audit our compliance with reasonable notice, or rely on our security documentation. We engage the sub-processors listed on our Sub-processor page and will notify you of material changes.