This Data Processing Addendum (“DPA”) applies when Markester processes personal information on behalf of a customer (“Client”) in connection with the delivery of Services. The DPA forms part of our Privacy Policy and, where applicable, supplements any written agreement between Markester and the Client.

15.1 Roles of the Parties

・The Client is the Data Controller, determining the purposes and legal basis for processing.

・Markester acts as the Data Processor when processing personal information strictly on the Client’s behalf and instructions.

・In certain situations where Markester sources or enriches B2B contact data for client campaigns, Markester may act as a Joint Controller, consistent with applicable law.

15.2 Nature and Purpose of Processing

Processing activities may include:

・Collecting and organizing business contact data

・Sending commercial outreach communications

・Managing campaign performance and analytics

・Tracking replies, conversions, or unsubscribe requests

・Storing suppression lists

・Providing customer support and technical assistance

・Conducting fraud, abuse, and security monitoring

Markester processes data only to deliver Services, comply with law, or act on the Client’s documented instructions.

15.3 Types of Data Processed

Personal information typically processed includes:

・Business names and roles

・Business email addresses

・Business phone numbers

・Company-level identifiers

・Public data relevant to B2B decision-making

・Performance and response metrics

・Suppression and opt-out records

Markester does not require or intentionally request sensitive personal data (e.g., biometric, health, criminal, or children’s data).

15.4 Sub-processors

Markester may use trusted third-party vendors (“Sub-processors”) to support delivery of the Services, including:

・Hosting and cloud providers

・CRM and campaign-execution tools

・Business-intelligence partners

・Payment processors

・Email and communication platforms

・Security and analytics providers

All Sub-processors are subject to confidentiality and data-security obligations.

15.5 Data Security

Markester implements commercially reasonable technical and organizational measures designed to:

・Safeguard data against unauthorized access

・Maintain service availability

・Detect and prevent abuse or intrusion

・Support secure storage and encrypted transmission where appropriate

No solution is guaranteed to be impenetrable, but efforts are consistent with industry standards.

15.6 International Data Transfers

Where personal data is transferred outside a jurisdiction with required protections, Markester will implement relevant safeguards, including:

・Standard Contractual Clauses (where required)

・Confidentiality obligations

・Vendor compliance assessments

15.7 Data Subject Requests

When acting as Processor, Markester:

Will notify the Client of any rights requests received directly from an individual

Will not act upon deletion or access requests without Client instruction

Will support the Client in fulfilling legal obligations where feasible

15.8 Confidentiality

All individuals authorized by Markester to process personal information are bound by confidentiality agreements or statutory confidentiality duties.

15.9 Return or Deletion of Data

Upon termination of Services or Client request:

Markester will delete or return personal information, unless retention is required by law.

Suppression-list records may be retained solely to prevent further contact, consistent with CAN-SPAM, GDPR, and similar frameworks.

15.10 Compliance Monitoring

Markester will make reasonable information available to demonstrate compliance and support audits when legally required, provided such requests:

・Are coordinated in advance,

・Do not compromise security or confidentiality of other customers, and

・Are limited to relevant processing activities.

15.11 Breach Notification

In the event of a confirmed security incident affecting Client-processed personal information, Markester will:

・Notify the Client without unreasonable delay,

・Provide known details of the nature of the breach,

・Cooperate in mitigation consistent with law.

15.12 Conflicts

Where this DPA conflicts with applicable privacy or data-protection laws, those laws apply. Where this DPA conflicts with a separate written agreement, the written agreement controls to the extent permitted by law.