Data Processing Agreement

Terms used in this DPA (Personal Data, Processing, Data Subject, Controller, Processor, Sub-processor, Supervisory Authority, Personal Data Breach) have the meanings given to them in the GDPR (Regulation (EU) 2016/679), the UK GDPR, the California Consumer Privacy Act (as amended by the CPRA), and other applicable data-protection laws. "Customer" means the entity that has entered into the Warm Deals Subscription Agreement and acts as Controller in respect of Personal Data submitted to the Service.

The subject matter of the processing is the provision of Warm Deals' B2B lead generation, multi-channel outreach, and marketing-automation services. The duration of processing corresponds to the term of the underlying Subscription Agreement, plus any post-termination period reasonably required to delete or return Personal Data and to comply with legal obligations.

Warm Deals processes Personal Data on behalf of the Customer for the sole purpose of delivering the Service: prospect discovery and enrichment, outbound email, SMS, voice and LinkedIn outreach, inbox and conversation management, CRM synchronisation, lead scoring, segmentation, A/B testing, analytics, and any other functionality made available through the Service.

• Business contact data (name, job title, work email, work phone).
• Employer / company data (name, domain, size, industry).
• Campaign engagement events (opens, clicks, replies, calls, bookings).
• Optional CRM identifiers provided through customer-initiated integrations.
• IP addresses, user-agent strings, and tracking-pixel events generated by recipients of the Customer's outreach.

• The Customer's prospects (typically business contacts).
• The Customer's existing customers and leads.
• The Customer's authorised end-users of the Service (sales reps, admins).

• Process Personal Data only on documented Customer instructions.
• Ensure persons authorised to process the Data are bound by confidentiality.
• Implement and maintain appropriate technical and organisational measures (Section 8).
• Assist the Customer with Data Subject rights requests (Section 9).
• Notify the Customer without undue delay (and in any event within 72 hours of becoming aware) of any Personal Data Breach.
• Delete or return all Personal Data after the end of the Service at the Customer's choice.
• Make available all information necessary to demonstrate compliance with Article 28 GDPR.

The Customer authorises Warm Deals to engage the sub-processors listed at /sub-processors. Warm Deals will notify the Customer at least 30 days before adding or replacing any sub-processor and the Customer may object on reasonable data-protection grounds. Warm Deals remains fully liable for the acts and omissions of its sub-processors as if they were its own.

• Encryption at rest (AES-256) and in transit (TLS 1.2 or higher).
• Role-based access controls following the principle of least privilege, with mandatory MFA for all administrative accounts.
• Network segmentation, hardened OS images, automated patching, secrets management using a dedicated key-management system.
• Centralised audit logging (Audit Log) covering authentication, configuration changes, data export, and Sub-processor activity.
• Periodic vulnerability scanning, dependency review, and at least annual third- party penetration testing.
• Documented incident-response and business-continuity plans.
• Background checks and security training for all personnel.

Warm Deals provides the Customer with self-service tools (the Compliance Center, suppression list, erasure endpoints, exports) to assist with requests from Data Subjects to exercise rights of access, rectification, erasure, restriction, portability, and objection. Warm Deals will provide reasonable assistance with any additional requests that cannot be fulfilled through self-service.

Warm Deals will make available, on reasonable written request and no more than once per twelve-month period, all information necessary to demonstrate compliance with this DPA, including the results of its most recent SOC 2 / ISO 27001 audit reports under NDA. Where required by applicable law, the Customer (or a mutually agreed independent auditor) may conduct an on-site audit, subject to reasonable confidentiality and scheduling constraints and at the Customer's expense.

Where Personal Data is transferred outside the EEA, UK or Switzerland, Warm Deals relies on the EU Standard Contractual Clauses (Commission Implementing Decision 2021/914), the UK International Data Transfer Addendum, the Swiss FDPIC-approved SCCs, or an applicable Adequacy Decision. The relevant SCCs are incorporated by reference into this DPA, with Warm Deals acting as Data Importer and the Customer as Data Exporter. Module 2 (Controller-to-Processor) applies by default.

Each Party's aggregate liability arising out of or related to this DPA, whether in contract, tort or otherwise, is subject to the limitations of liability set forth in the underlying Subscription Agreement. Nothing in this DPA limits any liability that cannot be limited under applicable law.

This DPA takes effect on the Effective Date of the Subscription Agreement and terminates automatically upon termination of the Subscription Agreement, except for obligations that by their nature survive termination (e.g. deletion or return of Personal Data, confidentiality, indemnification).

This DPA is governed by the laws specified in the underlying Subscription Agreement. Where the Customer is established in the EEA, UK or Switzerland, the GDPR / UK GDPR / Swiss FADP applies regardless of the chosen forum, and the Supervisory Authority of the Customer's main establishment retains jurisdiction over disputes arising from the processing of Personal Data.