Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service between 9th Avenue (a sole proprietorship run by its founder in Texas, USA, not yet incorporated) and the customer, and applies whenever we process personal data on the customer's behalf that is subject to the EU or UK General Data Protection Regulation (GDPR) or similar laws.

• The customer is the controller of the personal data of its contacts and decides why and how it is processed.
• 9th Avenue is the processor and processes that data only to provide the service.

This page summarises the DPA. A countersigned copy, including the Standard Contractual Clauses, is available on request at [email protected].

• Process personal data only on the customer's documented instructions — the Terms, this DPA and the customer's use of the service — unless the law requires otherwise, in which case we inform the customer where allowed.
• Ensure that people authorised to process the data are bound by confidentiality.
• Implement appropriate technical and organisational measures (section 5).
• Engage sub-processors only as described in section 6.
• Help the customer respond to data subject requests, taking into account the nature of the processing; the service lets the customer export, edit, unsubscribe and delete contacts directly.
• Help the customer with security, breach notification, data protection impact assessments and prior consultation, where relevant to our processing.
• Notify the customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting customer data.
• Delete or return customer data at the end of the service (section 8).
• Make available the information needed to demonstrate compliance and allow reasonable audits (section 9).

The customer is responsible for having a lawful basis and valid consent for the data it uploads and the emails it sends, for giving its contacts the required privacy information, and for complying with the Acceptable Use & Anti-Spam Policy. The customer's instructions must comply with data protection law.

• Encryption in transit (TLS) for the app, the API and connections to our providers; encryption at rest by our hosting and storage providers.
• Logical separation of each customer's data by organization, enforced on every request.
• Hashed passwords, optional two-factor authentication, role-based access and signed links and webhooks.
• Least-privilege, logged administrative access; security-relevant actions are recorded in an audit log.
• Backups, monitoring and a documented incident response process.

The customer authorises us to use the sub-processors below. We impose data protection terms on each that are no less protective than this DPA and remain responsible for their performance. We will announce new sub-processors on this page and notify account owners at least 14 days in advance; the customer may object on reasonable data protection grounds, and if we cannot address the objection the customer may terminate the affected service.

Where personal data is transferred outside the EEA, the UK or Switzerland to a country without an adequacy decision, the transfer is covered by the EU Standard Contractual Clauses (module 2 or 3, as applicable) with the UK International Data Transfer Addendum, or by the recipient's certification under the EU–US Data Privacy Framework.

The customer can export its contacts at any time. Within 30 days after the account is closed we delete customer data from active systems, and from backups on their normal rotation, except where the law requires us to keep it. Suppression entries may be kept in minimal form to keep honouring unsubscribes and complaints.

On written request, we provide information reasonably needed to demonstrate compliance with this DPA, such as answers to security questionnaires and our providers' certifications. If that is not sufficient, the customer may carry out an audit once a year with 30 days' notice, at its own cost, during business hours and under confidentiality.

Data protection questions and requests: [email protected], 9th Avenue, Port Arthur, Texas, USA.