Data Processing Agreement

Part A: Data Processing Agreement (v1.0)

DATA PROCESSING AGREEMENT

This Data Processing Agreement (”DPA”) forms part of the agreement under which Truelist provides its services (the ”Agreement”) between:

• Controller: the customer named in the signature block or in Annex I.A, or, for the online version, the customer that accepts this DPA by using the services (”Customer”); and
• Processor: Truelist, Inc., 502 W 7th St, Ste 100, Erie, PA 16502, USA (”Truelist”).

Version: 1.0 Effective date: the date of the last signature below, or for the online version, the date the Customer first uses the services after 4 November 2026.

1. Definitions

Terms such as “personal data”, “processing”, “controller”, “processor”, “data subject”, “personal data breach” and “supervisory authority” have the meanings given in Regulation (EU) 2016/679 (”GDPR”). ”Sub-processor” means any third party engaged by Truelist that processes Customer Personal Data. ”Customer Personal Data” means personal data that Truelist processes on the Customer’s behalf under the Agreement. ”SCCs” means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914.

2. Scope and roles

The Customer is the controller and Truelist is the processor of Customer Personal Data. Annex I describes the processing. This DPA applies to the extent the Customer is subject to the GDPR, the UK GDPR or equivalent data protection laws.

3. Instructions

• Truelist processes Customer Personal Data only on the Customer’s documented instructions, including with regard to transfers to a third country, unless EU or Member State law requires otherwise. If so, Truelist will inform the Customer before processing unless that law prohibits it.
• The Agreement, this DPA and the Customer’s use of the services (uploads, API calls, integrations, deletions) are the Customer’s complete instructions.
• Truelist will tell the Customer if, in its opinion, an instruction infringes data protection law.

4. Confidentiality and security

• Truelist ensures that persons authorised to process Customer Personal Data are bound by confidentiality.
• Truelist implements the technical and organisational measures in Annex II.

5. Sub-processors

• The Customer gives general authorisation for Truelist to engage Sub-processors. The current list is in Annex III and at /docs/sub-processors.
• Truelist will give at least 30 days’ notice of any new or replacement Sub-processor, by updating that page and emailing account administrators. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected services.
• Truelist imposes data protection obligations on each Sub-processor that are no less protective than this DPA, and remains liable for its Sub-processors.

6. Assistance

• Truelist assists the Customer, by appropriate technical and organisational measures, in responding to data subject requests (access, rectification, erasure, restriction, portability, objection). Truelist forwards any such request it receives directly to the Customer.
• Truelist assists the Customer with its obligations under GDPR Articles 32 to 36 (security, breach notification, data protection impact assessments and prior consultation), taking into account the nature of the processing and the information available to Truelist.

7. Personal data breaches

Truelist notifies the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice includes the information the Customer reasonably needs to meet its own notification obligations.

8. Retention, deletion and return

• Email addresses and validation results stored in the Customer’s account are deleted within 60 days of validation.
• Uploaded lists and result files are removed from the Customer’s account 35 days after the list finishes processing. Account administrators are notified when the list is 30 days old and again 24 hours before removal. The files are then permanently deleted from storage within 125 days of upload.
• Recurring lists: the source file is kept for as long as the recurring list is active, because each validation cycle re-reads it.
• Backups are overwritten on a rolling cycle of no more than 35 days.
• Logs: application and access logs, which may contain email addresses submitted for validation, are deleted within 30 days.
• The Customer can delete lists earlier at any time in its account, or ask us to delete its data.
• When the Agreement ends, Truelist deletes or returns Customer Personal Data at the Customer’s choice within the periods above, unless EU or Member State law requires it to be kept.
• Account and billing records (account users’ names, emails, invoices) are kept for as long as the account exists and afterwards as required by tax and accounting law.

9. Audits

Truelist makes available to the Customer all information necessary to demonstrate compliance with GDPR Article 28. This includes its SOC 2 Type II and ISO/IEC 27001 reports, which the Customer can request through Truelist’s trust center at https://trust.inc/truelist. Truelist allows and contributes to audits, including inspections, by the Customer or an auditor it mandates, on reasonable notice. Where those reports do not reasonably answer the Customer’s questions, the parties will agree on the scope, timing and cost of the audit.

10. International transfers

• Truelist is established in the United States and is not certified under the EU-US Data Privacy Framework. To the extent processing involves a transfer of Customer Personal Data from the EEA to a country without an adequacy decision, the parties enter into the SCCs, Module Two (controller to processor), which are incorporated into this DPA by reference, as completed in Part B and the Annexes. The Customer is the data exporter and Truelist is the data importer.
• For transfers from the United Kingdom, the UK International Data Transfer Addendum (version B1.0) applies to the SCCs, and Part B’s choices apply to it as far as possible. For transfers from Switzerland, the SCCs apply with references to the GDPR read as references to the Swiss FADP, and the FDPIC is the competent supervisory authority.
• Onward transfers to Sub-processors are made under Clause 9 of the SCCs, with appropriate safeguards in place with each Sub-processor.

11. Liability

Each party’s liability under this DPA is subject to the limitations in the Agreement. Nothing in this DPA limits either party’s liability to data subjects under the SCCs or the GDPR.

12. Precedence, law and changes

• If this DPA conflicts with the Agreement, this DPA prevails. If this DPA or the Agreement conflicts with the SCCs, the SCCs prevail.
• The SCCs are governed by the law and courts set out in Part B. Otherwise, this DPA follows the governing law of the Agreement.
• Changes to this DPA require written agreement of the parties. For the online version, Truelist may update it with 30 days’ notice, provided the change does not reduce the protection given to Customer Personal Data.

Part B: SCC Module Two: options chosen

The SCC clauses themselves are used unchanged. These are the only choices the SCCs leave open:

Official text of the SCCs: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj

Annex I

A. List of parties

Data exporter

• Name: the Customer, as identified in its Truelist account or the signed copy.
• Contact: the account owner’s email address.
• Activities relevant to the transfer: uses Truelist to validate email addresses.
• Role: controller.

Data importer

• Name: Truelist, Inc., 502 W 7th St, Ste 100, Erie, PA 16502, USA.
• Contact: Grant Ammons, Cofounder. Privacy contact: hello@truelist.io, security contact: security@truelist.io.
• Activities relevant to the transfer: provides email validation services.
• Role: processor.

B. Description of transfer

• Categories of data subjects: people whose email addresses the Customer submits for validation (for example, the Customer’s contacts, leads, subscribers or users), and the Customer’s own authorised account users.
• Categories of personal data:
  • email addresses;
  • any other data in the files the Customer uploads, such as names or other columns, which is stored with the list;
  • validation results for each address (deliverability status, mailbox, domain and mail-server checks);
  • application and access logs, which may contain submitted email addresses;
  • for account users: name, email address, login and usage logs, and billing details handled by Stripe.
• Sensitive data: none intended. The Customer must not submit special categories of data.
• Frequency of transfer: continuous, whenever the Customer uses the service.
• Nature of processing:
  • receiving data through upload, API or connected integrations, and storing it;
  • checking each address against DNS and the recipient’s mail server, which involves contacting that mail server;
  • generating and storing result files;
  • logging, to operate, secure and troubleshoot the service;
  • deletion.
• Purpose: validating email addresses for accuracy and deliverability, and providing and supporting the Truelist account.
• Retention: as set out in DPA §8.
• Transfers to Sub-processors: as listed in Annex III, for the duration set out in DPA §8.

C. Competent supervisory authority

As determined under Clause 13(a): the supervisory authority of the Member State where the Customer is established.

Annex II: Technical and organisational measures

• Encryption: TLS 1.2 or higher in transit, and industry-standard encryption at rest.
• Hosting: AWS (us-east-2, United States) and OVH (France), using their physical and environmental security controls. Application logs are stored on Truelist-operated servers in the United States.
• Network: isolated network environments and firewalls. Storage buckets block public access, and files are served through signed links that expire after at most 7 days.
• Access control: production access is restricted to staff who need it, follows least privilege and is logged. Strong authentication is required on internal systems.
• Assurance: independent third-party SOC 2 Type II and ISO/IEC 27001 audits. The reports are available on request through Truelist’s trust center at https://trust.inc/truelist.
• Data minimisation and retention: automatic deletion as set out in DPA §8, and customers can delete data at any time.
• Personnel: confidentiality obligations for everyone with access to customer data.
• Incident response: monitoring and error alerting, with breach notification under DPA §7.
• Sub-processors: each is assessed for appropriate security and bound by written data protection terms.
• Data subject requests: handled through account deletion tools and support (hello@truelist.io).

Annex III: Sub-processors

Signature block

To get a copy countersigned by Truelist, email hello@truelist.io.