Data Processing Addendum

1. Subject matter and duration

The processor processes personal data to provide GTMSDR to the controller, as described in the Terms of Service, for as long as the controller uses the service and for 30 days after it ends.

2. Data subjects and data

Data subjects: prospects and contacts at target accounts; leads; visitors of the controller's websites that carry the tracking snippet; the controller's customers as they appear in connected systems such as Stripe or a CRM.

• Business contact data: name, business email address, job title, employer, public profile links, phone number where given.
• Signals: public posts, job changes, hiring, funding, technology used by the employer, reviews written about products.
• Interaction data: emails sent, opens, clicks, replies, document views, form submissions, call outcomes, meetings.
• Visit data: pages viewed, referrer, campaign parameters, IP address, the company and, in the United States, the person matched to a visit.
• Customer data from connected systems: signups, payments and their amounts.

3. Instructions

The processor processes personal data only on the controller's documented instructions. The controller's settings in GTMSDR (goal, channels, budget, brand rules, connections, approval mode) and its use of the service are those instructions. The processor informs the controller if it believes an instruction breaks the law.

The processor may use aggregated, de-identified results that do not identify any data subject or controller to improve the service.

4. Confidentiality and security

People authorised to process the data are bound by confidentiality. The processor maintains technical and organisational measures appropriate to the risk, including:

• Encryption of data in transit and of stored access tokens for connected platforms.
• Sign-in sessions bound to a browser key, multi-factor sign-in and passkeys for staff with production access.
• Access limited to the staff who need it.
• Separation of each customer's data in the application.
• Monitoring and error reporting of the production systems.

5. Subprocessors

The controller authorises the subprocessors listed in section 5 of the Privacy Policy. The processor binds each one by contract to obligations no weaker than this addendum, gives notice of a new subprocessor at least 14 days in advance through the cabinet or by email, and the controller may object on reasonable grounds within that period.

6. Assistance

The processor helps the controller answer data subjects' requests, including deletion and opt-out, and with security, impact assessments and consultations with authorities, as far as the nature of the processing allows.

7. Personal data breaches

The processor notifies the controller without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the controller's data, with the information the controller needs to meet its own obligations.

8. International transfers

Where personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, the parties agree to the European Commission's standard contractual clauses (module two, controller to processor, and module three for subprocessors) and the UK addendum, which are incorporated by reference.

9. Return and deletion

When the service ends the controller can export its data for 30 days; the processor then deletes it, except where the law requires it to be kept, and except opt-out records, which are kept so that opt-outs keep working.

10. Audits

On request the processor makes available the information needed to show compliance with this addendum, and allows audits by the controller or an auditor it appoints, at the controller's cost, with reasonable notice and no more than once a year unless an authority requires it.

11. California

As a service provider, the processor does not sell or share personal information, does not retain, use or disclose it outside the direct business relationship with the controller, and does not combine it with personal information from other sources except as the law permits for providing the service.