Data Processing Terms

1. Roles

• For contacts you upload to your own list, you are the controller and we are the processor acting on your instructions.
• For our market customer databases, we determine the purposes and means of processing and act as controller. See the Privacy Policy and the Data Source Policy.
• For your advertiser account data, we are the controller.

2. Your instructions and your warranties

• We process uploaded contacts only to deliver the platform’s functions to you: storing them, personalising campaigns, sending, tracking engagement and honouring suppressions.
• You warrant that you have a lawful basis for uploading each contact and for sending them marketing email.
• You warrant that your notices to those individuals cover processing by a service provider on your behalf.
• You will not upload special category data, and you will not upload data you obtained unlawfully.

3. Security

• Encryption in transit, and encryption at rest for credentials and tokens.
• Role-based access control and row-level security isolating each advertiser’s data.
• Audit logging of administrative access.
• Staff access limited to those who need it for support and operations.

4. Sub-processors

We will give notice before adding a sub-processor that processes your uploaded contacts, so you can object.

5. Assistance

• We will assist you in responding to data subject requests relating to your uploaded contacts.
• We will notify you without undue delay after becoming aware of a personal data breach affecting your data.
• We will make available the information needed to demonstrate compliance with these terms.

6. Deletion

You can delete an uploaded list at any time from the platform. On deletion the contacts are removed from active use. Suppression records derived from that list are retained, because forgetting that someone unsubscribed would cause us to email them again.

7. International transfers

Where uploaded contacts protected by European law are transferred outside the EEA or UK, the transfer relies on appropriate safeguards including Standard Contractual Clauses. [Confirm the applicable module and hosting regions with counsel.]