Data Processing Addendum
This addendum forms part of the Terms of Service and governs our processing of personal data on your behalf. It applies automatically to every account — there is nothing to sign unless you need it on your own paper.
1. Roles
For contact data you upload and messages you send, you are the controller and Outfrank Ltd is the processor. For your own account and billing data, we are the controller — see the Privacy Policy.
2. Scope of processing
Subject matter: provision of email sending, verification and deliverability services.
Duration: for as long as your account is open, plus the retention periods in section 7.
Categories of data subject: the business contacts you choose to email, and the users you invite into your workspace.
Categories of data: name, business email address, employer, job title, any custom fields you add, and engagement records such as replies, bounces and opt-outs.
3. Our obligations
We process personal data only on your documented instructions, which the Terms and your use of the product constitute. If we believe an instruction breaches applicable law, we will tell you rather than silently comply.
Everyone with access is bound by confidentiality obligations that survive their employment.
4. Security
We maintain the technical and organisational measures described on the Security page, including encryption at rest and in transit, least-privilege access, enforced SSO with hardware keys for production, and annual third-party penetration testing.
5. Sub-processors
You give general authorisation for the sub-processors listed on the Security page. We give at least 30 days' notice before adding one, and you may object on reasonable data-protection grounds — if we cannot resolve the objection, you may terminate without penalty for the remaining term.
6. International transfers
Data stays in the region you select per workspace, EU or US. Where a transfer outside the UK or EEA is necessary, it relies on Standard Contractual Clauses together with the UK International Data Transfer Addendum, and a transfer impact assessment is available on request.
7. Retention and deletion
Contacts are retained until you delete them. On account closure, all customer personal data including backups is irreversibly deleted within 60 days, and we confirm in writing on request.
8. Assistance
We assist you with data subject requests, data protection impact assessments and regulator consultations, taking into account the nature of the processing and the information available to us. Most access, export and erasure requests can be fulfilled directly in the dashboard.
9. Breach notification
We notify you without undue delay and in any event within 24 hours of confirming a personal data breach affecting your data, with the information you need to meet your own notification obligations.
10. Audit
Our SOC 2 Type II report and penetration test summary are available under NDA and satisfy audit rights in most cases. Enterprise customers may request a bespoke audit once a year on reasonable notice.