Skip to content
GTM Engine

Data Processing Addendum

Template — have counsel review. This document is a draft template, not legal advice and not yet in force. Bracketed fields such as [jurisdiction] must be completed and the whole text reviewed by a qualified lawyer before use.

This Data Processing Addendum ("DPA") forms part of the agreement between the customer ("Controller") and [legal entity name and registered address] ("Processor") for the use of GTM Engine, and applies where the Processor processes personal data on the Controller's behalf.

1. Subject matter and duration

The Processor processes personal data contained in Customer Data to provide the Service for the term of the agreement. Categories of data subjects: the Controller's prospects and contacts, and its users. Categories of data: contact details, professional information, email content and metadata, engagement events.

2. Instructions

The Processor processes personal data only on documented instructions from the Controller, including those given through the Service's settings and features, unless required by law.

3. Security measures

  • Tenant isolation enforced by the database (row-level security on every workspace table).
  • Encryption of mailbox passwords, OAuth tokens and integration secrets with AES-256-GCM and versioned keys.
  • Role-based access within workspaces; two-factor authentication available to every user.
  • Append-only audit logs of security-relevant actions.
  • Encrypted connections (TLS) for the web application and required STARTTLS/TLS for mailbox connections.
  • [Additional organizational measures: access reviews, background checks, training.]

4. Personnel and sub-processors

Personnel with access are bound by confidentiality. The Controller authorizes the sub-processors listed in [Annex — sub-processor list]; the Processor gives [notice period] notice of changes, during which the Controller may object.

5. Assistance

The Processor helps the Controller respond to data subject requests (for example by export and deletion features) and with data protection impact assessments where needed.

6. Personal data breaches

The Processor notifies the Controller without undue delay, and in any case within [hours], after becoming aware of a personal data breach affecting Customer Data.

7. Deletion and return

At the end of the agreement the Processor deletes or returns personal data within [period], unless storage is required by law.

8. Audits

The Processor makes available information necessary to demonstrate compliance and allows audits [frequency, notice and cost terms].

9. Transfers

Transfers outside the EEA/UK are subject to [Standard Contractual Clauses / UK Addendum], incorporated by reference.