Data processing agreement
This agreement applies when Volatile Design (“we”, the processor) processes personal data for a customer (“you”, the controller) through Volatile Leads. It’s designed to meet Article 28 of the UK GDPR. You agree to it when you accept our terms.
1. What we process
| Subject matter | Providing Volatile Leads: finding businesses from public sources, checking their details, storing leads and notes, writing drafts on request, sending emails through your connected email account, receiving forwarded email, and TPS checks. |
|---|---|
| Duration | For as long as you use the service, plus up to 30 days after your workspace closes. |
| Types of personal data | Business contact details (names, job titles, business email addresses and phone numbers), notes you add, the content of emails you send and receive through the service, and TPS/CTPS screening results. |
| Data subjects | People at businesses you find, contact or hear from, and your own team members. |
2. Our commitments
- We process your data only on your documented instructions: these terms, and what you do in the service. If we believe an instruction breaks data protection law, we’ll tell you.
- Everyone who can access your data is bound by confidentiality.
- We keep appropriate security measures in place (section 4).
- We only use the sub-processors listed in section 3, under written terms that protect the data at least as well as this agreement. We’ll give you at least 14 days’ notice by email of any new sub-processor. If you object on reasonable data protection grounds, you can cancel without penalty.
- We’ll help you respond to people exercising their rights (access, correction, deletion, objection), and with security, breach notification and impact assessments, as far as is reasonable given what we do.
- We’ll tell you without undue delay, and within 48 hours of becoming aware of it, if a personal data breach affects your data, with the information you need to meet your own obligations.
- When your workspace closes, we delete your data within 30 days, unless the law requires us to keep it. You can export your leads before then.
- We’ll give you the information you reasonably need to show that we meet this agreement, and answer reasonable written questions about our security.
3. Sub-processors
| Provider | What for | Where |
|---|---|---|
| dogado GmbH (server hosting) | Runs the server where the app and its database live | Germany (EU) |
| Cloudflare | Network security and delivery of the website | Global; UK/EU-adequate transfers |
| Stripe | Subscriptions and card payments (account holders only) | Ireland/USA |
| Anthropic (Claude) | Writing email drafts, only when you click Write draft | USA |
| Google (Places API) | Finding a business’s website, phone and reviews, only for lookups | USA |
| Data Soap | TPS/CTPS checks and text messages, only when you run a check or send a text | United Kingdom |
| Brevo | Service emails from us (verification, password resets, invitations) | France (EU) |
Google, Anthropic and Data Soap only receive data when you use the matching feature: a Google lookup (company name and town), Write draft (the lead’s business details and website findings), a TPS check (the phone number), or a text (the mobile number and your message). Transfers outside the UK are covered by UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.
4. Security measures
- Encrypted connections (HTTPS/TLS) for the app and all provider connections.
- Connected email passwords stored encrypted; user passwords stored as one-way hashes.
- Each workspace’s data kept separate; staff access limited to what’s needed to run and support the service.
- Server hosted in a professional data centre in Germany, with firewalling, software updates and regular backups.
- Website checks refuse private and internal network addresses.
- Personal data minimised: closed leads are trimmed after 12 months, keeping only what’s needed to honour an opt-out.
5. Your responsibilities
You’re responsible for having a lawful basis for the data you put into or create with the service, for meeting PECR and other marketing rules, and for honouring opt-outs and other requests from the people you contact.
Contact
Volatile Design, Ipswich, Suffolk, United Kingdom. Email [email protected].