Data Processing Addendum (DPA)

1. Roles of the Parties

For the purposes of UK data protection law:

• The Customer acts as the Data Controller
• Offload acts as the Data Processor

The Customer determines the purposes and means of processing personal data using the platform.

Offload processes personal data only to provide the Services in accordance with the Customer's instructions.

2. Scope of Processing

Offload may process personal data for the following purposes:

• providing the Offload platform
• lead discovery and prospect identification
• contact enrichment
• outbound campaign management
• workflow automation
• analytics and performance monitoring
• infrastructure and platform security

Processing occurs only where necessary to deliver the Services.

3. Categories of Data Subjects

Data subjects may include:

• business contacts
• company employees
• leads and prospects
• users of the Offload platform
• Customer staff and account administrators

4. Categories of Personal Data

The platform may process the following categories of personal data:

• name
• business email address
• job title
• company name
• company information
• publicly available professional profile data
• communication logs
• campaign metadata
• usage and activity data

Offload does not intentionally collect sensitive personal data.

Customers must not upload special category data unless explicitly agreed.

5. Duration of Processing

Offload will process personal data only for as long as necessary to provide the Services and fulfil contractual obligations, unless otherwise required by law.

Upon termination of the Services, Customer data will be:

• returned to the Customer, or
• securely deleted

within a reasonable timeframe.

6. Processor Obligations

Offload agrees to:

• process personal data only on documented instructions from the Customer
• ensure personnel handling personal data are subject to confidentiality obligations
• implement appropriate technical and organisational security measures
• assist the Customer in responding to data subject requests
• assist with security and compliance obligations where reasonably possible
• notify the Customer of personal data breaches without undue delay

7. Security Measures

Offload implements appropriate security measures including:

• encrypted data transmission
• access control systems
• infrastructure monitoring
• authentication protections
• secure cloud infrastructure

Security practices may evolve to reflect industry best practices.

8. Subprocessors

Offload may engage subprocessors to assist in providing the Services, including providers of:

• cloud infrastructure
• data storage
• analytics
• communications services
• AI model providers

Offload ensures that subprocessors are bound by data protection obligations consistent with this DPA.

A list of subprocessors may be provided upon request.

9. International Transfers

Where personal data is transferred outside the UK, Offload ensures appropriate safeguards such as:

• Standard Contractual Clauses
• equivalent international transfer mechanisms recognised under UK law

10. Data Subject Rights

Offload will assist the Customer, where reasonably possible, in responding to requests relating to:

• access
• rectification
• deletion
• restriction
• portability
• objection to processing

The Customer remains responsible for responding to such requests.

11. Audits

Upon reasonable notice, the Customer may request information demonstrating Offload's compliance with this DPA.

Offload may satisfy audit requests through documentation, certifications, or summaries of security controls.

12. Governing Law

This DPA is governed by the laws of England and Wales.

Any disputes shall be subject to the exclusive jurisdiction of the courts of England and Wales.