Legal

Data processing addendum

For customers who need a processor agreement on file.

⚠️ Draft for review. A DPA is a contract — this outline shows the shape and must be replaced with a reviewed instrument before any customer signs it.

Roles

You are the controller of the personal data in your collections. ADM is the processor. Our sub-processors are our email delivery platform, our cloud hosting providers, and the model providers that generate email copy.

Instructions

We process contact data only to deliver the service: to personalise and send your campaigns, to record engagement, and to maintain suppression. Nothing else, and never for our own purposes.

Security

Encryption in transit and at rest, access limited to staff who need it, credentials held in the deployment platform rather than in source control, and tenant isolation enforced in the application so one organisation cannot read another's data.

Breach

We notify you without undue delay after becoming aware of a personal data breach affecting your data, with what we know and what we are doing about it.

Deletion

On termination we return or delete your contact data at your choice, except suppression records, which are retained to honour opt-outs.