Data processing addendum.

The short version

When we process personal data on your behalf you are the controller and we are the processor. This addendum is incorporated into the Terms automatically; you do not need to sign it unless your procurement requires a signature, in which case we will sign.

1. Scope of processing

Item	Detail
Subject matter	Producing and publishing marketing campaigns, and reading attribution
Duration	Term of the subscription, plus 30 days of backup
Categories of data subject	Your prospects and contacts; your team users
Personal data	Name, email, company, job title, campaign activity. No special categories.
Location	United Kingdom, with US model providers under SCCs and the UK Addendum

2. Our obligations

• Process only on your instructions and to deliver the service.
• Apply the technical and organisational measures described under Security.
• Notify any personal data breach without undue delay and in any case within 48 hours of becoming aware.
• Assist with data subject requests, DPIAs and supervisory authority enquiries.
• Delete or return data on termination, at your choice.

3. Sub-processors

We keep a current list with name, purpose and location. We give 30 days notice by email before adding a new one, and you may object on reasonable data-protection grounds.

4. Audit

One documentary audit a year is included. On-site audits for enterprise customers under mutual NDA and at reasonable cost.