Data Processing Agreement

This Data Processing Agreement ("DPA") is entered into by and between GTMify LLC ("GTMify") and the customer entity that has executed an agreement for the use of GTMify’s services ("Customer"). This DPA is incorporated into and forms an integral part of the main agreement between GTMify and the Customer (the "Agreement").

1. Definitions

For the purposes of this DPA, the following terms shall have the meanings set out below. Capitalized terms not otherwise defined herein shall have the meaning given to them in the Agreement.

• "Controller" means the entity which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data.
• "Data Protection Laws" means all applicable laws and regulations relating to data protection and privacy, including but not limited to the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the UK General Data Protection Regulation ("UK GDPR"), and the California Consumer Privacy Act ("CCPA").
• "Data Subject" means the identified or identifiable natural person to whom Personal Data relates.
• "Personal Data" means any information relating to a Data Subject that is processed by GTMify on behalf of the Customer as a result of the provision of the Services under the Agreement.
• "Processing" means any operation or set of operations which is performed on Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
• "Processor" means the entity which Processes Personal Data on behalf of the Controller.
• "Services" means the go-to-market automation services provided by GTMify to the Customer as described in the Agreement.
• "Sub-processor" means any third-party processor engaged by GTMify to Process Personal Data in connection with the Services.

2. Subject Matter and Details of Data Processing

This DPA applies to the Processing of Personal Data by GTMify in the course of providing the Services to the Customer. The details of the data processing are described in Annex I to this DPA.

3. Roles and Responsibilities

The parties acknowledge and agree that for the purposes of Data Protection Laws, the Customer is the Controller and GTMify is the Processor of the Personal Data. GTMify shall only Process Personal Data on behalf of and in accordance with the Customer’s documented instructions.

4. Processor’s Obligations

GTMify, as the Processor, agrees to:

• Process Personal Data only for the purposes of providing the Services and in accordance with the Customer’s lawful instructions.
• Ensure that all personnel authorized to Process Personal Data are subject to a duty of confidentiality.
• Implement and maintain appropriate technical and organizational measures to protect the security, confidentiality, and integrity of Personal Data, as further detailed in Annex II.
• Provide reasonable assistance to the Customer in fulfilling its obligations to respond to Data Subjects’ requests to exercise their rights under Data Protection Laws.
• Notify the Customer without undue delay after becoming aware of a Personal Data breach.
• Make available to the Customer all information necessary to demonstrate compliance with the obligations laid down in this DPA and allow for and contribute to audits, including inspections, conducted by the Customer or another auditor mandated by the Customer.

5. Sub-processing

The Customer acknowledges and agrees that GTMify may engage Sub-processors to Process Personal Data in connection with the provision of the Services. A list of GTMify’s current Sub-processors is attached as Annex III. GTMify shall provide the Customer with prior written notice of any intended changes concerning the addition or replacement of Sub-processors, thereby giving the Customer the opportunity to object to such changes.

GTMify shall ensure that any Sub-processor it engages is subject to a written agreement that imposes on the Sub-processor data protection obligations that are no less protective than those imposed on GTMify by this DPA.

6. Security of Processing

GTMify shall implement and maintain the technical and organizational security measures set out in Annex II to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These measures are designed to ensure a level of security appropriate to the risk of the Processing.

7. Data Subject Rights

GTMify shall, to the extent legally permitted, promptly notify the Customer if it receives a request from a Data Subject to exercise their rights under Data Protection Laws. GTMify shall provide the Customer with reasonable cooperation and assistance in relation to any such request.

8. International Data Transfers

To the extent that the Processing of Personal Data by GTMify involves a transfer of Personal Data to a country outside the European Economic Area (EEA), the UK, or Switzerland, GTMify shall ensure that such transfers are made in compliance with the requirements of Data Protection Laws. This may include entering into Standard Contractual Clauses (SCCs) or relying on other legally recognized transfer mechanisms.

9. Data Breach Notification

In the event of a Personal Data breach, GTMify shall notify the Customer without undue delay, and in any case within 48 hours of becoming aware of the breach. The notification shall include, at a minimum:

• A description of the nature of the Personal Data breach, including the categories and approximate number of Data Subjects and Personal Data records concerned.
• The name and contact details of the data protection officer or other contact point where more information can be obtained.
• A description of the likely consequences of the Personal Data breach.
• A description of the measures taken or proposed to be taken by GTMify to address the Personal Data breach, including, where appropriate, measures to mitigate its possible adverse effects.

10. Audit Rights

Upon reasonable request, GTMify shall make available to the Customer information necessary to demonstrate compliance with its obligations under this DPA. GTMify shall allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer, at the Customer’s expense.

11. Data Return and Deletion

Upon termination of the Agreement, GTMify shall, at the choice of the Customer, delete or return all Personal Data to the Customer within thirty (30) days of termination, and delete existing copies unless applicable law requires storage of the Personal Data.

12. Term and Termination

This DPA shall remain in effect for as long as GTMify Processes Personal Data on behalf of the Customer under the Agreement. The provisions of this DPA shall survive the termination of the Agreement for as long as GTMify continues to Process Personal Data.

13. Compliance Certifications and Audits

GTMify is committed to maintaining robust security and compliance standards. While GTMify is working toward obtaining SOC 2 Type II certification, the company implements security controls consistent with SOC 2 Trust Service Criteria, including:

• Security (CC): Comprehensive access controls, encryption, monitoring, and incident response procedures.
• Availability (A): Redundant infrastructure, automated backups, and disaster recovery capabilities.
• Processing Integrity (PI): Data validation, system monitoring, and error handling procedures.
• Confidentiality (C): Data classification, access restrictions, and encryption of sensitive information.
• Privacy (P): Privacy notice compliance, consent management, and data subject rights fulfillment.

GTMify shall provide the Customer with copies of relevant audit reports, security assessments, and compliance certifications upon request.

14. Data Protection Impact Assessment

GTMify acknowledges that the Customer may be required to conduct a Data Protection Impact Assessment (DPIA) under applicable Data Protection Laws. GTMify shall provide reasonable assistance to the Customer in conducting any such assessment and shall provide information regarding its Processing activities and security measures as necessary.

15. Limitation of Liability

Except as otherwise provided in the Agreement, neither party shall be liable to the other for any indirect, incidental, special, consequential, or punitive damages arising out of or related to this DPA, regardless of the form of action and whether or not such party has been advised of the possibility of such damages.

16. Governing Law and Dispute Resolution

This DPA shall be governed by and construed in accordance with the laws of the jurisdiction specified in the Agreement. Any disputes arising out of or relating to this DPA shall be resolved in accordance with the dispute resolution procedures set forth in the Agreement.

Annex I: Details of Processing

A. List of Parties

• Data Controller: The Customer, as defined in the Agreement.
• Data Processor: GTMify LLC.

B. Subject Matter, Duration, Nature, and Purpose of the Processing

• Subject Matter: The Processing of Personal Data in connection with the provision of GTMify’s go-to-market automation services.
• Duration: The term of the Agreement.
• Nature and Purpose: To enable the Customer to use the Services for automated email and LinkedIn marketing, AI-powered copywriting, lead list generation and enrichment, intent detection, content publishing and engagement, and other related go-to-market activities.

C. Categories of Data Subjects

The Personal Data Processed will concern the following categories of Data Subjects:

• Prospects, customers, and business contacts of the Customer.
• Employees or other representatives of the Customer who use the Services.

D. Categories of Personal Data

The Personal Data Processed will include the following categories of data:

• Contact Information: Name, email address, phone number, job title, company name, and social media profiles (e.g., LinkedIn URL).
• Professional Information: Employment history, skills, and other information available on public profiles.
• Technical Information: IP address, browser type, and other information collected through cookies and similar technologies.
• Engagement Data: Information about interactions with marketing campaigns, such as email opens, clicks, and replies.

Annex II: Technical and Organizational Security Measures

GTMify implements the following technical and organizational security measures to protect Personal Data, designed to ensure compliance with SOC 2 Trust Service Criteria and Data Protection Laws:

A. Infrastructure Security

GTMify’s services are hosted on PlatformOS, which leverages Amazon Web Services (AWS) infrastructure. This includes:

• Physical Security: AWS data centers are secured with physical access controls, surveillance, environmental controls, and other measures to prevent unauthorized access.
• Network Security: Use of firewalls, security groups, and network access control lists to restrict access to the network and implement defense-in-depth principles.
• DDoS Protection: AWS Shield provides protection against Distributed Denial of Service (DDoS) attacks at the network and application layers.
• Redundancy and Failover: Multi-Availability Zone (Multi-AZ) deployment ensures high availability and automatic failover in case of infrastructure failure.

B. Data Encryption

• Data in Transit: All data transmitted between the Customer and the Services, and between the Services and Sub-processors, is encrypted using TLS 1.2 or higher (TLS/SSL).
• Data at Rest: Personal Data stored within the Services is encrypted at rest using industry-standard encryption algorithms (e.g., AES-256) with encryption keys managed by AWS Key Management Service (KMS).
• Encryption Key Management: Encryption keys are securely managed, rotated regularly, and access is restricted to authorized personnel only.

C. Access Control

• Authentication: Access to the Services is protected by multi-factor authentication (MFA) where applicable and strong password policies.
• Authorization: Role-based access control (RBAC) is used to ensure that users only have access to the information and functionality necessary for their roles.
• Least Privilege: The principle of least privilege is applied to both human and programmatic access, with regular reviews of access permissions.
• Session Management: Secure session management with automatic timeout and re-authentication for sensitive operations.

D. Vulnerability Management

• Vulnerability Scanning: Regular vulnerability scanning of the platform and infrastructure using automated tools and manual assessments.
• Patch Management: A process for timely application of security patches and updates to operating systems, applications, and dependencies.
• Dependency Scanning: Automated scanning of application dependencies for known vulnerabilities.
• Remediation: Critical vulnerabilities are prioritized for immediate remediation.

E. Logging and Monitoring

• Audit Logs: Comprehensive logging of access and activity within the Services, including user actions, API calls, and system events.
• Log Retention: Logs are retained for a minimum of 90 days and archived for longer-term retention.
• Monitoring: Continuous monitoring of the platform for security events and anomalies using automated tools and manual review.
• Alerting: Automated alerting for suspicious activities and security events.

F. Incident Response

• Incident Response Plan: A documented incident response plan to address security incidents in a timely and effective manner.
• Incident Classification: Procedures for classifying incidents by severity and impact.
• Response Team: A designated incident response team available 24/7 to respond to security incidents.
• Breach Notification: A process for notifying customers of Personal Data breaches in accordance with this DPA and applicable law.
• Post-Incident Review: Procedures for conducting post-incident reviews and implementing corrective measures.

G. Personnel Security

• Confidentiality: All GTMify employees and contractors are subject to confidentiality obligations and sign confidentiality agreements.
• Security Training: Regular security awareness training for all personnel, with emphasis on data protection and privacy.
• Background Checks: Appropriate background checks are conducted for personnel with access to sensitive information.
• Access Termination: Procedures for promptly terminating access when personnel leave the organization.

H. Business Continuity and Disaster Recovery

• Backup Procedures: Regular automated backups of all Personal Data with redundant storage across multiple geographic locations.
• Disaster Recovery Plan: A documented disaster recovery plan with defined recovery time objectives (RTO) and recovery point objectives (RPO).
• Testing: Regular testing of backup and disaster recovery procedures to ensure effectiveness.
• Data Restoration: Procedures for restoring data in the event of data loss or corruption.

I. Vendor Management

• Vendor Assessment: Security assessments of all Sub-processors before engagement.
• Contractual Obligations: Written agreements with all Sub-processors imposing data protection obligations consistent with this DPA.
• Ongoing Monitoring: Periodic review of Sub-processor security practices and compliance.
• Remediation: Procedures for addressing non-compliance by Sub-processors.

J. Data Minimization and Retention

• Minimization: GTMify processes only the Personal Data necessary to provide the Services.
• Retention Periods: Personal Data is retained only for as long as necessary to provide the Services or as required by applicable law.
• Deletion: Procedures for secure deletion of Personal Data when it is no longer needed.
• Anonymization: Where appropriate, Personal Data is anonymized or pseudonymized to reduce privacy risks.

Annex III: List of Sub-processors

GTMify uses the following Sub-processors to provide the Services. The list is grouped by function for clarity. Locations indicate the primary jurisdiction of the Sub-processor.

Hosting & Infrastructure

AI & Large Language Models

Workflow & Orchestration

Lead Sourcing & Discovery

Contact Enrichment & Verification

Intent & Visitor Identification

Content & Social Engagement

Email Sending & Deliverability

Multi-Channel Outreach

CRM & Pipeline

Channel Delivery

Meeting & Scheduling

Analytics

Customer Support & Help Center

Supports GTMify’s help center, product feedback board, changelog, and in-product support messaging. Where the AI support assistant is enabled, conversation content is sent to the AI Sub-processors listed above solely to generate a reply, and is not used to train or fine-tune any model.

Operations & Productivity

Disclosed for transparency. These tools support GTMify’s internal operations and may incidentally process Personal Data through email, calendar, contracts, and team coordination.

For questions about this DPA or GTMify’s data protection practices, please contact [email protected].