Data processing agreement

DRAFT — not reviewed by a lawyer and not in force. Text in [square brackets] must be completed before publication.

Scope

This agreement applies where Attestry processes personal data on the customer's behalf (GDPR and UK GDPR Art. 28): records the customer submits for enrichment or checking (for example an e-mail address sent to the verify endpoint, or a list sent as a batch), and the customer's account users.

For business-contact data that Attestry supplies from its own sources, Attestry and the customer are each an independent controller; that relationship is governed by the terms of service, not by this agreement.

What Attestry does as processor

• Processes submitted records only to return the requested result, on the customer's documented instructions (the API request).
• Does not use submitted records to build or improve its own contact data, and does not disclose them to other customers.
• Keeps submitted records only as long as the request needs: request bodies are not written to logs; batch inputs and results are deleted automatically after 30 days.
• Ensures staff with access are bound by confidentiality.
• Applies the security measures described in SECURITY.md.
• Helps the customer answer data-subject requests and carry out impact assessments, and tells the customer without undue delay, and in any case within [72 hours], about a personal-data breach affecting their data.
• Deletes or returns the customer's data when the account is closed.

Sub-processors

[Hosting provider — location — purpose]. [Payment provider]. [E-mail delivery provider]. Attestry gives [30 days] notice of a new sub-processor; the customer may object.

International transfers

[Transfer mechanism, e.g. EU Standard Contractual Clauses (Module 2/3) and the UK Addendum, with the completed annexes.]

Audits

[Audit and information rights.]

Annex: details of processing

Subject matter: enrichment and checking of business records. Duration: the term of the customer's subscription. Data subjects: the customer's business contacts and account users. Categories of data: name, employer, job title, work e-mail address; no special categories.