Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between [Company legal name] (“LeadForge”) and the Customer. It applies whenever LeadForge processes Customer Personal Data on the Customer’s behalf. Capitalised terms not defined here have the meanings given in the Terms.

[Counsel: this draft is structured to meet Article 28 of the GDPR and UK GDPR. Review it against the final Terms and the chosen transfer mechanism.]

1. Definitions

• Data Protection Laws: all laws on data protection and privacy that apply to the processing, including the GDPR, the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and the CCPA/CPRA.
• Customer Personal Data: personal data within Customer Data that LeadForge processes on the Customer’s behalf.
• Subprocessor: a third party that LeadForge engages to process Customer Personal Data.
• Security Incident: a breach of security leading to the accidental or unlawful destruction, loss, alteration or unauthorised disclosure of, or access to, Customer Personal Data.
• “Controller”, “processor”, “data subject”, “personal data” and “processing” have the meanings given in the GDPR.

2. Roles of the parties

2.1 The Customer is the controller of Customer Personal Data and LeadForge is its processor. Where the Customer is itself a processor for a third party, LeadForge is its subprocessor, and the Customer will pass on that third party’s relevant instructions.

2.2 LeadForge is an independent controller for account, billing, security and website data, and for its own lead database, as described in the Privacy Policy. This DPA does not apply to that data. [Counsel: confirm the roles when a Customer uses records from LeadForge’s lead database.]

2.3 For the purposes of the CCPA/CPRA, LeadForge is a service provider. It will not sell or share Customer Personal Data, will not retain, use or disclose it outside the direct business relationship with the Customer, and will not combine it with other data except as those laws permit.

3. The Customer’s responsibilities

The Customer:

• is responsible for the lawfulness of the processing it instructs, including having a lawful basis for its outreach and for obtaining Lead Data, whether imported or found with its own data-provider keys;
• will give data subjects the information required by Articles 13 and 14 GDPR, including when Lead Data comes from third-party sources, no later than the first communication with them;
• will honour objections, unsubscribes and other data-subject rights, including opt-outs it receives outside the Service;
• will comply with anti-spam and ePrivacy laws such as CAN-SPAM, PECR and CASL, as described in the Terms and the Acceptable Use Policy;
• will not submit special categories of personal data, data about children or payment card data; and
• is responsible for its agreements with, and instructions to, the providers it engages directly through Customer-Provided Keys (see Section 6).

4. LeadForge’s obligations

LeadForge will:

• process Customer Personal Data only on the Customer’s documented instructions, which are the Terms, this DPA and the Customer’s use and configuration of the Service, unless the law requires otherwise, in which case it will inform the Customer first where the law permits;
• tell the Customer if it believes an instruction infringes Data Protection Laws;
• ensure that everyone authorised to process Customer Personal Data is bound by confidentiality;
• implement the technical and organisational measures in Annex 2;
• help the Customer respond to data-subject requests, including by providing tools in the Service to find, export, correct, delete and suppress records, and by forwarding to the Customer, without undue delay, requests it receives about Customer Personal Data;
• help the Customer with security, breach notification, data protection impact assessments and prior consultation, taking into account the nature of the processing;
• notify the Customer of a Security Incident without undue delay, and in any case within [Breach notification period] of becoming aware of it, with the information the Customer reasonably needs to meet its own obligations;
• at the end of the Service, delete or return Customer Personal Data, at the Customer’s choice, within [Deletion period], unless the law requires it to be kept [Counsel: address whether minimal suppression records may be kept to keep honouring opt-outs]; and
• make available the information needed to demonstrate compliance with this DPA and allow audits as described in Section 8.

5. Subprocessors

5.1 The Customer gives LeadForge general authorisation to engage the Subprocessors listed on the Subprocessors page.

5.2 LeadForge will give at least [Notice period] notice before adding or replacing a Subprocessor, [by email to account administrators or through a subscription on the Subprocessors page]. The Customer may object on reasonable data-protection grounds within that period. The parties will discuss the objection in good faith, and if it cannot be resolved the Customer may terminate the affected part of the Service [and receive a pro-rata refund].

5.3 LeadForge will impose data-protection obligations on each Subprocessor that are no less protective than this DPA, and remains responsible for its Subprocessors’ performance.

6. AI providers and services used with Customer-Provided Keys

6.1 LeadForge AI. When the Customer uses the LeadForge AI add-on, the AI provider that generates content or classifies replies is a Subprocessor of LeadForge and is listed on the Subprocessors page. [Counsel: record the provider’s contractual commitments on data retention and on not using Customer Personal Data to train its models.]

6.2 The Customer’s own AI key. When the Customer supplies its own key for Anthropic, OpenAI, Google Gemini or another AI provider, that provider is engaged by the Customer under the Customer’s own agreement with it, and is not a Subprocessor of LeadForge. LeadForge transmits Customer Personal Data to that provider on the Customer’s instruction, limited to what is needed for each requested generation or classification. The Customer is responsible for that provider’s terms, including its data-retention and model-training settings.

6.3 Data providers. When the Customer uses its own keys to find leads through data providers, the data provider is engaged by the Customer, and the Customer is responsible for having the right to obtain and use the resulting Lead Data. LeadForge processes the returned Lead Data as the Customer’s processor.

6.4 Mailbox providers. Google, Microsoft and the SMTP providers of Connected Mailboxes are the Customer’s own providers, not Subprocessors of LeadForge.

6.5 Handling of keys. LeadForge stores Customer-Provided Keys encrypted, uses them only for the Customer’s account and on the Customer’s instructions, and stops using a key when the Customer removes it. If a key stops working, LeadForge may pause the processing that depends on it and notify the Customer.

7. International transfers

Where LeadForge or a Subprocessor processes Customer Personal Data outside the EEA, the UK or Switzerland, in a country without an adequacy decision, the parties agree that the European Commission’s Standard Contractual Clauses (Module 2, controller to processor, or Module 3, processor to processor, as applicable) and the UK International Data Transfer Addendum are incorporated by reference. [Counsel: complete the clause options, annexes and governing law.] LeadForge will ensure appropriate safeguards are in place for transfers to its Subprocessors.

8. Audits

LeadForge will make available [summaries of independent security assessments or certifications, if any] and answer reasonable security questionnaires. Where these are not enough to demonstrate compliance, or a supervisory authority requires it, the Customer may carry out an audit on at least [Audit notice period] notice, no more than [Audit frequency], during business hours, subject to confidentiality and at the Customer’s expense.

9. Liability and order of precedence

Each party’s liability under this DPA is subject to the limitations in the Terms. [Counsel: confirm.] If this DPA conflicts with the Terms, this DPA prevails for the processing of Customer Personal Data. The Standard Contractual Clauses prevail over both.

Annex 1: Details of the processing

Annex 2: Technical and organisational measures

[Engineering and counsel: confirm each measure before this DPA is signed.]

• Encryption of data in transit (TLS) and at rest [confirm scope].
• Encryption of Customer-Provided Keys and mailbox credentials, with [key management approach].
• Tenant isolation and role-based access control, so each customer can access only its own workspace.
• Least-privilege access for LeadForge staff, with multi-factor authentication [confirm].
• Logging and monitoring of security-relevant events, without logging secrets or email content [confirm].
• Backups [frequency and retention], with tested restoration.
• Vulnerability management, dependency scanning and secure development practices.
• An incident response procedure with defined roles and customer notification.
• Due diligence on Subprocessors before engagement and periodically after.
• Data minimisation: AI providers receive only the data needed for each request.

Annex 3: Subprocessors

The current list of Subprocessors is on the Subprocessors page.