Data Processing Agreement

Last updated: June 2026

This Data Processing Agreement ("DPA") is entered into between Go2MarketCo ("Processor," "we," "us") and the entity or individual that has agreed to our Terms of Service ("Controller," "you"). This DPA supplements and forms part of our Terms of Service and sets out the terms under which we process personal data on your behalf.

1. Definitions

• "Controller" means you, the entity that determines the purposes and means of the processing of Personal Data using the Service
• "Processor" means Go2MarketCo, which processes Personal Data on behalf of the Controller
• "Data Subject" means an identified or identifiable natural person whose Personal Data is processed
• "Personal Data" means any information relating to a Data Subject, including names, email addresses, phone numbers, and any other data stored in the Service that can identify a natural person
• "Sub-processor" means any third party engaged by the Processor to process Personal Data on behalf of the Controller
• "Processing" means any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, erasure, or destruction
• "Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data
• "Applicable Data Protection Laws" means all laws and regulations relating to the processing of Personal Data applicable to the parties, including the GDPR, CCPA, and equivalent legislation

2. Scope and Purpose

2.1 Subject Matter

This DPA governs the processing of Personal Data by the Processor on behalf of the Controller through the Controller's use of the AMP-MAP platform.

2.2 Nature and Purpose of Processing

The Processor processes Personal Data for the purpose of providing the Service, including:

• Storing and managing contact, company, and deal records
• Executing email campaigns and marketing automation workflows
• Providing segmentation, analytics, and reporting
• Synchronizing data with third-party integrations as configured by the Controller
• Processing form submissions and booking requests

2.3 Types of Personal Data

The Personal Data processed may include: names, email addresses, phone numbers, job titles, company names, physical addresses, IP addresses, engagement data (email opens, clicks), and any custom fields created by the Controller.

2.4 Categories of Data Subjects

Data Subjects include the Controller's contacts, leads, customers, prospects, business partners, and any individuals whose data is uploaded or collected via the Service.

2.5 Duration

Processing continues for the duration of the Controller's subscription and for a reasonable period thereafter to fulfill data retention obligations as described in our Privacy Policy.

3. Obligations of the Processor

3.1 Lawful Processing

The Processor shall:

• Process Personal Data only on documented instructions from the Controller, including as set forth in the Terms of Service and this DPA
• Inform the Controller if, in its opinion, an instruction infringes Applicable Data Protection Laws
• Not process Personal Data for any purpose other than providing the Service, unless required by law

3.2 Confidentiality

The Processor shall ensure that all personnel authorized to process Personal Data are bound by appropriate confidentiality obligations, whether contractual or statutory.

3.3 Technical and Organizational Measures

The Processor shall implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of Personal Data in transit (TLS 1.2+) and at rest (AES-256)
• Multi-tenant data isolation through separate databases per workspace
• Role-based access controls and granular permission management
• Comprehensive audit logging of all data access and modifications
• Regular vulnerability assessments and security testing
• Secure authentication including support for two-factor authentication (2FA)
• API key authentication with scope-based access controls
• Automated rate limiting and brute-force protection
• Encrypted storage of third-party integration credentials (AES-256-GCM)

4. Sub-processors

4.1 Authorization

The Controller provides general authorization for the Processor to engage the Sub-processors listed below to assist in providing the Service. A current list is also maintained at /legal/subprocessors.

Sub-processor	Purpose	Location
Cloud infrastructure & hosting provider	Application hosting, compute, and database storage	United States / EU
Stripe, Inc.	Payment processing and subscription billing	United States
Twilio Inc.	SMS and messaging delivery	United States
Email delivery provider (SMTP)	Transactional and marketing email delivery	United States / EU
Salesforce, Inc.	CRM integration sync (only if connected by the customer)	United States
HubSpot, Inc.	CRM integration sync (only if connected by the customer)	United States
Google LLC	SSO, Calendar, and Google Ads integrations (only if connected)	United States
Microsoft Corporation	SSO and Calendar integrations (only if connected)	United States
Clay / data-enrichment provider	Contact and company data enrichment (only if enabled)	United States

4.2 Notification of Changes

The Processor shall notify the Controller at least 30 days in advance before engaging a new Sub-processor. The Controller may object to a new Sub-processor by notifying the Processor within 14 days of receiving notice. If the Controller objects and the Processor cannot reasonably accommodate the objection, either party may terminate the affected portion of the Service.

4.3 Sub-processor Obligations

The Processor shall ensure that each Sub-processor is bound by data protection obligations no less protective than those in this DPA. The Processor remains fully liable for the acts and omissions of its Sub-processors.

5. Data Subject Rights

5.1 Assistance

The Processor shall assist the Controller in responding to Data Subject requests to exercise their rights under Applicable Data Protection Laws, including requests for access, rectification, erasure, portability, restriction, and objection.

5.2 Self-Service Tools

The Service provides built-in tools for the Controller to fulfill Data Subject requests, including:

• Data export (CSV/JSON) for portability requests
• GDPR erasure endpoint for right-to-deletion requests
• Contact record editing for rectification requests
• Unsubscribe and preference management for objection requests

6. Security Measures

Without prejudice to Section 3.3, the Processor shall:

• Regularly test, assess, and evaluate the effectiveness of its security measures
• Ensure that only authorized personnel have access to Personal Data on a need-to-know basis
• Maintain incident response procedures to detect, respond to, and recover from Data Breaches
• Implement business continuity and disaster recovery plans

7. Data Breach Notification

7.1 Notification Timing

The Processor shall notify the Controller without undue delay, and in any event within 72 hours, after becoming aware of a Data Breach affecting the Controller's Personal Data.

7.2 Notification Content

The notification shall include, to the extent available:

• A description of the nature of the Data Breach, including the categories and approximate number of Data Subjects affected
• The name and contact details of the Processor's point of contact
• A description of the likely consequences of the Data Breach
• A description of the measures taken or proposed to address the Data Breach, including measures to mitigate its adverse effects

7.3 Cooperation

The Processor shall cooperate with the Controller and take reasonable steps to assist in the investigation, mitigation, and remediation of the Data Breach.

8. Data Return and Deletion

8.1 During the Subscription

The Controller may export its data at any time using the Service's built-in export features.

8.2 Upon Termination

Upon termination of the subscription, the Processor shall:

• Provide the Controller with 30 days to export all Personal Data
• Delete all Personal Data from active systems within 30 days after the export period
• Delete all Personal Data from backups within 90 days after the export period
• Provide written confirmation of deletion upon the Controller's request

9. Audits

9.1 Audit Rights

The Controller may audit the Processor's compliance with this DPA, subject to the following conditions:

• Audits may be conducted no more than once per year, unless required by a Data Protection Authority or following a Data Breach
• The Controller shall provide at least 30 days' advance written notice
• Audits shall be conducted during normal business hours and shall not unreasonably interfere with the Processor's operations
• The Controller shall bear the costs of the audit unless the audit reveals material non-compliance

9.2 Audit Reports

The Processor shall make available to the Controller all information necessary to demonstrate compliance with this DPA. The Processor may satisfy audit requests by providing relevant third-party audit reports or certifications.

10. International Data Transfers

10.1 Transfer Mechanisms

Where Personal Data is transferred to countries outside the EEA that have not been deemed to provide an adequate level of data protection, the Processor shall ensure that appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) as approved by the European Commission
• Supplementary measures where required by applicable law

10.2 Transfer Impact Assessments

The Processor shall conduct transfer impact assessments as required under Applicable Data Protection Laws and make summaries available to the Controller upon request.

11. Term and Termination

This DPA is effective from the date the Controller accepts the Terms of Service and shall continue until the end of the Processor's processing of Personal Data. The obligations under this DPA shall survive termination to the extent necessary to fulfill post-termination obligations.

12. Contact

For questions about this DPA, contact us:

• Email: [email protected]
• Data Protection Officer: [email protected]