Data processing addendum.

1. Roles, and what this covers

This addendum forms part of the agreement between [ADM legal entity] ("Processor") and the customer ("Controller"). It governs ADM's processing of personal data on the Controller's behalf.

The Controller is the controller of the contact data in its collections, including leads generated through the platform on the Controller's brief and approved by the Controller. The Processor is the processor of that data. ADM is an independent controller for its own account and billing data, and for the platform-wide suppression list — neither is covered by this addendum, and both are described in the privacy notice.

2. Subject matter, duration, nature and purpose — Art. 28(3) opening

3. Processing only on documented instructions — Art. 28(3)(a)

The Processor processes personal data only on the Controller's documented instructions, including on transfers to third countries, unless required otherwise by Union or Member State law — in which case the Processor informs the Controller of that requirement before processing, unless the law prohibits it.

The agreement, this addendum, and the Controller's configuration and use of the platform constitute those instructions. That includes the campaigns the Controller creates, the collections it maintains, and the lead generation briefs it submits. The Processor records lead generation instructions — the brief, the criteria, the approving user and the time — so the instruction is evidenced rather than asserted.

The Processor informs the Controller if, in its opinion, an instruction infringes the GDPR or other data protection law.

4. Confidentiality — Art. 28(3)(b)

Personnel authorised to process the data are bound by confidentiality obligations, and access is limited to those who need it to perform their work.

5. Security — Art. 28(3)(c), Art. 32

The Processor implements appropriate technical and organisational measures, including: encryption of data in transit and at rest; tenant isolation enforced in the application and covered by an automated regression suite; role-based access control; credentials held in the deployment platform rather than in source control; and a suppression mechanism that fails closed — if the opt-out list cannot be read, sending stops rather than proceeding without it.

6. Sub-processors — Art. 28(3)(d), Art. 28(2)

The Controller grants general authorisation for the sub-processors listed at /legal/subprocessors. The Processor gives at least 30 days' notice before adding or replacing a sub-processor, and the Controller may object on reasonable data protection grounds. The Processor imposes the same obligations on each sub-processor by contract, and remains fully liable to the Controller for their performance.

7. Assisting with data subject rights — Art. 28(3)(e)

The Processor assists the Controller, by appropriate technical and organisational measures, in responding to requests to exercise data subject rights. In practice this is built into the product rather than being a support ticket: the Controller can search every collection for one contact and export what is held (Art. 15), and can erase a contact across collections and queued campaigns in a single action (Art. 17). Unsubscribe requests from recipients are actioned automatically and immediately (Art. 21(2)).

Where a data subject contacts the Processor directly about the Controller's data, the Processor refers them to the Controller and informs the Controller promptly.

8. Assisting with Arts. 32–36 — Art. 28(3)(f)

The Processor assists the Controller in ensuring compliance with the security, breach notification and data protection impact assessment obligations, taking into account the nature of the processing and the information available to it.

Breach. The Processor notifies the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data, with the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken — enough for the Controller to meet its own 72-hour obligation under Art. 33.

9. Deletion or return — Art. 28(3)(g)

On termination the Processor deletes or returns the Controller's personal data at the Controller's choice, and deletes existing copies, within 90 days unless Union or Member State law requires storage.

One exception, and it is deliberate. Suppression records are retained. They hold an address and the date it opted out, nothing more. Deleting them would let a later import re-add a person who had objected, silently undoing their own request — so they are retained to give effect to the objection under Art. 21(3), and ADM is the controller of that record in its own right.

10. Audit — Art. 28(3)(h)

The Processor makes available to the Controller the information necessary to demonstrate compliance with Art. 28, and allows for and contributes to audits, including inspections, conducted by the Controller or an auditor it mandates. [Specify notice period, frequency, confidentiality terms, and who bears cost.]

11. International transfers

Transfers outside the EEA are made under the European Commission's Standard Contractual Clauses or an applicable adequacy decision. Each sub-processor's processing location and transfer basis is listed on the sub-processor page.

12. Controller's own obligations

The Controller warrants that it has a lawful basis for the processing it instructs, including for the outreach it sends; that it has provided or will provide the information required by Arts. 13 and 14 to the data subjects concerned; and that its instructions comply with applicable law. The platform supports this — it carries the Art. 14 first-layer notice in every email, classifies recipients, and warns on markets requiring prior consent — but responsibility for the lawfulness of the sending remains the Controller's.