Data Processing Addendum
Draft pending legal review. This document is a working draft and does not yet constitute the final, legally-reviewed addendum.
This Data Processing Addendum ("DPA") forms part of the agreement between you ("Customer", "Controller") and Client Path Ltd ("Client Path", "Processor") for your use of the Service (the "Agreement", i.e. our Terms of Service). It governs our processing of personal data that you upload or generate using the Service ("Customer Personal Data") where you act as controller and we act as processor. It is designed to satisfy Article 28 of the UK GDPR.
If there is a conflict between this DPA and the Terms of Service on the subject of data protection, this DPA prevails.
1. Roles
For Customer Personal Data, Customer is the controller and Client Path is the processor. For personal data about Customer's own users that we process to run our business, Client Path is a controller and our Privacy Policy applies.
2. Processing instructions
We process Customer Personal Data only on your documented instructions, which include the Agreement, your use of the Service's features, and any further written instructions you give. We will tell you if we believe an instruction infringes applicable data protection law.
3. Subject matter, duration, nature, and purpose
- Subject matter & nature: providing an agentic CRM — researching prospects, scoring, deal management, and drafting outreach.
- Duration: for the term of the Agreement plus the deletion period in §9.
- Purpose: to provide and support the Service as instructed by Customer.
- Categories of data subjects: Customer's prospects, contacts, and the people at the organisations Customer researches; Customer's own personnel who use the Service.
- Categories of personal data: business contact details, role/employment information, publicly available company and contact research, communications metadata, and any other personal data Customer chooses to input.
- Special category data: not intended; Customer should not input it.
4. Confidentiality
We ensure that personnel authorised to process Customer Personal Data are bound by confidentiality obligations.
5. Security
We implement appropriate technical and organisational measures, including encryption in transit and at rest, tenant isolation, least-privilege access controls, audit logging, and secrets encryption. A summary is at Annex 2. [PLACEHOLDER: confirm Annex 2 against the current security posture.]
6. Sub-processors
You authorise us to engage the sub-processors listed below to process Customer Personal Data. We impose data-protection obligations on each sub-processor no less protective than this DPA, and we remain responsible for their performance.
| Sub-processor | Service | Location |
|---|---|---|
| Vercel Inc. | Application hosting & compute | [PLACEHOLDER: region] |
| Neon Inc. | Managed Postgres database | [PLACEHOLDER: region] |
| Stripe, Inc. | Payment processing | US / EU |
| Resend | Transactional email | [PLACEHOLDER: region] |
| Tavily | Web research retrieval | [PLACEHOLDER: region] |
| [PLACEHOLDER: LLM provider(s)] | AI generation | [PLACEHOLDER: region] |
| Sentry | Error monitoring | [PLACEHOLDER: region] |
We will give at least [PLACEHOLDER: e.g. 30 days'] notice before adding or replacing a sub-processor, during which you may object on reasonable data-protection grounds.
7. International transfers
Where we transfer Customer Personal Data outside the UK, we rely on the UK International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses together with the UK Addendum, plus any supplementary measures indicated by a transfer risk assessment. The relevant clauses are incorporated by reference at Annex 3. [PLACEHOLDER: attach/confirm the executed transfer mechanism.]
8. Assistance to the Controller
Taking into account the nature of processing, we will assist you, by appropriate technical and organisational measures, in: (a) responding to data-subject rights requests; (b) meeting your security, breach-notification, and DPIA obligations. The Service provides self-service data export and erasure to support (a).
9. Return and deletion
On termination of the Agreement, we will delete or return Customer Personal Data within [PLACEHOLDER: e.g. 30 days] at your choice, and delete existing copies except where retention is required by law.
10. Personal data breach
We will notify you without undue delay, and in any event within [PLACEHOLDER: e.g. 72 hours], after becoming aware of a personal data breach affecting Customer Personal Data, with the information you reasonably need to meet your own notification obligations.
11. Audits
We will make available information necessary to demonstrate compliance with Article 28 and allow for and contribute to audits, including inspections, subject to reasonable confidentiality and frequency limits. [PLACEHOLDER: define audit mechanism — e.g. third-party report on request vs on-site.]
12. Liability
Each party's liability under this DPA is subject to the limitations and exclusions in the Agreement.
Annex 1 — Details of processing
As set out in §3 above.
Annex 2 — Technical and organisational measures
[PLACEHOLDER: list the current TOMs — encryption in transit (TLS) and at rest, tenant/org isolation enforced by access policies, RBAC/least privilege, audit logs, secrets encryption (AES-GCM), monitoring, backup & recovery, secure SDLC.]
Annex 3 — Transfer mechanism
[PLACEHOLDER: the executed UK IDTA / EU SCCs + UK Addendum, with module and clause selections.]
Contact
DPA and data-protection queries: dpo@clientpath.pro.