We process on your instructions. Nothing else.

This Data Processing Agreement (“DPA”) forms part of the agreement between you (“Customer,” the controller) and EmailListChecker, Inc. (“Processor”) and governs our processing of personal data on your behalf when you use the Service. Where you act as a processor for your own customers, we act as your sub-processor and these terms apply accordingly.

The subject matter is email verification, cleaning, finding, and analytics. The duration is the term of your subscription plus the deletion period below. The nature and purpose is automated deliverability assessment of the contact data you submit.

Personal data: email addresses you submit, plus any adjacent columns you choose to include (e.g. names), and the verdicts and confidence scores we generate (VALID CATCH-ALL INVALID).

Data subjects: your contacts, leads, subscribers, and users whose addresses you choose to verify. You are responsible for having a lawful basis to submit them.

• Process personal data only on your instructions, and tell you if an instruction appears to breach applicable law.
• Ensure personnel are bound by confidentiality and trained on data protection.
• Implement the technical and organizational measures described in our Information Security Requirements.
• Assist you with data-subject requests, DPIAs, and regulator consultations, taking into account the nature of processing.
• Make available the information needed to demonstrate compliance and allow for audits (see below).

You authorize us to engage sub-processors for hosting, payments, transactional email, and analytics. We maintain a current list in our GDPR document and impose data-protection terms on each sub-processor no less protective than this DPA.

We give at least 30 days' noticebefore adding or replacing a sub-processor. If you reasonably object, we'll work in good faith to resolve it, and you may suspend or terminate the affected processing if we cannot.

Where personal data is transferred outside the EEA, UK, or Switzerland, we rely on the EU Standard Contractual Clauses (Module Two or Three as applicable), the UK International Data Transfer Addendum, and supplementary measures. The SCCs are incorporated into this DPA by reference and prevail in case of conflict on transfer matters.

We maintain a SOC 2 Type II program with encryption in transit and at rest, least-privilege access, monitoring, and regular penetration testing. On becoming aware of a personal-data breach affecting your data, we notify you without undue delay and provide the information you need to meet your own notification duties.

On termination, or sooner on your instruction, we delete or return personal data and delete existing copies unless law requires retention. List data also auto-purges during the term according to your retention window.

We demonstrate compliance through our SOC 2 Type II report and security documentation, available under NDA. Where a deeper audit is legally required, you may conduct one on reasonable prior notice, no more than once per year, at your cost, without disrupting our operations or compromising other customers' security.

This DPA is incorporated into and governed by our Terms of Service. Accepting the Terms or using the Service constitutes acceptance of this DPA. To request a countersigned copy, email [email protected].