Customer Data Processing Agreement

This Customer Data Processing Agreement (the “DPA”) sets out the terms on which WREN TECHNOLOGIES LTD (“Wren”, “we”, “us”, “processor”) processes personal data on behalf of a customer (“you”, “controller”) as required by Article 28 of the UK GDPR. It applies wherever we act as processor rather than controller — principally, Pulse uploads. It does not apply to Wren’s own business database and directory activity, including email campaigns and outbound integrations that Wren runs using Wren Data, where we act as controller: see our Privacy and Fair Processing Notice for that.

This DPA is incorporated by reference into our Terms of Service and applies automatically wherever we process personal data on your behalf under those Terms; no separate signature is required.

1. Roles and scope

For the processing described in this DPA, you are the controller and Wren is the processor. We process personal data only on your documented instructions, which are given by your use of the relevant feature (for example, uploading a file to Pulse) and by any further written instruction you give us.

Our own use of business and contact information to build, maintain and license our database, and to run our own marketing, is separate controller activity and is not governed by this DPA — see our Privacy Notice.

2. Particulars of processing

Subject matter. Providing the Pulse enrichment feature of the Services for the duration of your account.

Duration. For as long as you use the relevant feature, and thereafter only as needed to delete or return your data as set out in Section 7.

Nature and purpose. Matching and enrichment of the personal data you submit, solely to provide the feature you have requested.

Categories of personal data. Names, job titles, business email addresses, business telephone numbers, business postal addresses, and company identifiers contained in the file you provide. The Services are not designed for special category data, criminal-offence data or other high-risk data; see Section 9.

Categories of data subject. The business contacts, prospects, customers and other individuals identified in the data you submit to us.

Recipients. Our sub-processors, as set out in Section 5.

3. Instructions and confidentiality

We will process personal data only on your documented instructions, unless required to do otherwise by UK law, in which case we will tell you before processing (unless the law prohibits this). If we consider an instruction breaches data protection law, we will tell you promptly.

We may refuse, pause or reject an instruction, upload or file where it appears unlawful, unsafe, outside the intended scope of Pulse, technically unsuitable, or likely to include prohibited or high-risk data that we have not expressly agreed to process.

Our personnel who access your data are bound by confidentiality obligations at least as protective as those in our Mutual Non-Disclosure Agreement, and access is limited to those with an operational need.

4. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit and at rest, role-based access control, multi-factor authentication, network segmentation, regular patching, and incident-response arrangements, consistent with the measures described in our Privacy Notice.

5. Sub-processors

You authorise us to engage the sub-processors listed in our Service Providers and Sub-processors register for the processing described in this DPA. We will give you at least 30 days’ notice before adding or replacing a sub-processor for this processing, as described in that register’s change-notification process, and you may object on reasonable grounds in accordance with it.

Where we engage a sub-processor, we put a written contract in place requiring data-protection obligations that offer an equivalent level of protection for the personal data processed under this DPA. We remain responsible to you for the sub-processor’s processing of that personal data.

6. Assistance and incidents

Taking into account the nature of the processing, we will reasonably assist you in responding to a data subject rights request, and with any data protection impact assessment or prior consultation with the ICO, where you cannot reasonably fulfil that obligation yourself.

If we become aware of a personal data breach affecting personal data we process on your behalf, we will notify you without undue delay, with enough information to allow you to meet your own breach-notification obligations.

7. Deletion, return and audits

On expiry or termination of the relevant feature or your account, we will delete or return the personal data processed under this DPA, in line with the deletion periods stated in our Data Retention Policy — for example, Pulse uploads, enrichment outputs and file metadata are deleted 30 days after initial upload because they contain Customer Data. We may retain a copy where required by law, for no longer than that legal requirement demands.

On request, we will provide a written summary of our relevant technical and organisational measures and reasonable information needed to demonstrate compliance with this DPA. Any audit must be limited to what is reasonably necessary to verify our compliance, must be requested on reasonable notice, and must first rely on documents, security summaries or written responses where those are sufficient. We may refuse or limit an audit where it would compromise security, confidentiality, personal data, another customer’s information, or the operation of the Services. Where an audit requires significant time or assistance, we may charge reasonable costs.

8. International transfers

Where processing under this DPA involves a transfer of personal data outside the UK, we rely on an appropriate transfer mechanism — UK adequacy regulations, or safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses — as set out in our Service Providers and Sub-processors register.

9. Your warranties

You warrant that:

• you have a lawful basis to provide the personal data to us and to have it processed as instructed;
• the personal data was collected fairly and in accordance with applicable law;
• providing the data to us does not put you in breach of any contract or duty of confidentiality owed to a third party;
• you will not submit special category data (UK GDPR Article 9), criminal-offence data, payment-card data, passwords, authentication secrets, medical information, or data concerning children unless we have expressly agreed in writing before upload;
• you will notify us promptly of any change that affects the lawfulness of the processing described in this DPA.

You will indemnify us against costs, claims and losses arising from a breach of these warranties.

10. Contact

Questions about this Agreement can be sent to dpo@wren-data.co.uk.